CIVIL LAW PROTECTION OF PERSONAL DATA IN THE USE OF ARTIFICIAL INTELLIGENCE IN MEDICINE
Keywords:
Artificial intelligence, medical data protection, civil liability, informed consent, privacy law, healthcare regulationAbstract
This study examines the intersection of civil law protections for personal medical data and the expanding use of artificial intelligence in healthcare settings. Drawing on legal frameworks from multiple jurisdictions, the research analyzes how existing data protection mechanisms address the unique challenges posed by AI systems in medicine. Through systematic review of legislation, case law, and regulatory frameworks, this study identifies significant gaps in current civil liability protections. Results indicate that traditional informed consent models prove inadequate for AI applications, while liability frameworks struggle to address the "black box" nature of advanced algorithms. The research reveals emerging approaches to these challenges, including modified consent procedures and novel liability models. This paper contributes to the discourse on balancing technological innovation with fundamental privacy rights, offering recommendations for legislative reform and suggesting that a hybrid regulatory approach incorporating both civil law remedies and sector-specific oversight may offer the most comprehensive protection for patients' data in the age of medical AI.
References
Article 29 Working Party. (2018). Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679. European Commission.
Bundesgerichtshof. (2021). Decision of June 16, 2021 – VI ZR 488/19. Federal Court of Justice of Germany.
California State Legislature. (2020). California Privacy Rights Act of 2020. California Secretary of State.
CNIL. (2020). Délibération n° 2020-054 du 12 mai 2020 portant adoption d'un référentiel relatif aux traitements de données à caractère personnel mis en œuvre à des fins de gestion des vigilances sanitaires. Commission Nationale de l'Informatique et des Libertés.
Cohen, I. G. (2019). Is there a duty to share healthcare data? In I. G. Cohen, H. F. Lynch, E. Vayena, & U. Gasser (Eds.), Big data, health law, and bioethics (pp. 209-222). Cambridge University Press.
Cohen, I. G., & Mello, M. M. (2019). HIPAA and protecting health information in the 21st century. JAMA, 320(3), 231-232.
Cohen, I. G., Gerke, S., & Kramer, D. B. (2021). Ethical and legal implications of remote monitoring of medical devices. Milbank Quarterly, 98(4), 1257-1289.
Court of Justice of the European Union. (2020). Judgment in Case C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems.
Datatilsynet. (2021). Notification of administrative fine to Oslo University Hospital. Norwegian Data Protection Authority.
Department of Health and Social Care. (2022). Data saves lives: Reshaping health and social care with data. UK Government.
Esteva, A., Kuprel, B., Novoa, R. A., Ko, J., Swetter, S. M., Blau, H. M., & Thrun, S. (2017). Dermatologist-level classification of skin cancer with deep neural networks. Nature, 542(7639), 115-118.
European Commission. (2020). Assessment of the EU Member States' rules on health data in the light of GDPR. Publications Office of the European Union.
European Commission. (2021). Proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence. COM(2021) 206 final.
European Data Protection Board. (2020). Guidelines 05/2020 on consent under Regulation 2016/679. EDPB.
Floridi, L., & Cowls, J. (2019). A unified framework of five principles for AI in society. Harvard Data Science Review, 1(1).
Gerke, S., Minssen, T., & Cohen, I. G. (2020). Ethical and legal challenges of artificial intelligence-driven healthcare. In A. Bohr & K. Memarzadeh (Eds.), Artificial intelligence in healthcare (pp. 295-336). Elsevier.
Government of Canada. (2022). The artificial intelligence and data act: Companion document. Innovation, Science and Economic Development Canada.
Hall, W., & Pesenti, J. (2017). Growing the artificial intelligence industry in the UK. Department for Digital, Culture, Media & Sport and Department for Business, Energy & Industrial Strategy.
Health Research Authority. (2021). Guidance on the management of data protection impact assessments in health and social care research. National Health Service.
Hoffman, S. (2020). Citizen science: The law and ethics of public access to medical big data. Berkeley Technology Law Journal, 30(3), 1741-1806.
Hoffman, S., & Podgurski, A. (2021). Artificial intelligence and discrimination in health care. Yale Journal of Health Policy, Law, and Ethics, 19(3), 1-81.
Infocomm Media Development Authority. (2020). Model AI governance framework second edition. Singapore Government.
Information Commissioner's Office. (2021). Regulatory sandbox report: NHS AI Lab AI imaging database. UK Information Commissioner's Office.
Information Commissioner's Office. (2022). International data transfer agreement and guidance. UK Information Commissioner's Office.
In re Blackbaud Inc. Customer Data Breach Litigation, 2021 WL 2718439 (D.S.C. 2021).
Jones v. Tsige, 2012 ONCA 32 (Court of Appeal for Ontario, 2012).
Lloyd v. Google LLC, [2021] UKSC 50 (Supreme Court of the United Kingdom, 2021).
Mittelstadt, B. (2019). Principles alone cannot guarantee ethical AI. Nature Machine Intelligence, 1(11), 501-507.
National Institute of Standards and Technology. (2020). Privacy framework version 1.0. U.S. Department of Commerce.
NHSX. (2021). A guide to good practice for digital and data-driven health technologies. National Health Service.
Nissenbaum, H. (2010). Privacy in context: Technology, policy, and the integrity of social life. Stanford University Press.
Office of the Privacy Commissioner of Canada. (2020). A regulatory framework for AI: Recommendations for PIPEDA reform. Government of Canada.
Pan-Canadian Health Data Strategy Expert Advisory Group. (2021). Pan-Canadian health data strategy: Report 1 – Charting a path toward ambition. Public Health Agency of Canada.
Personal Data Protection Commission Singapore. (2020). Advisory guidelines on the PDPA for selected topics. Singapore Government.
Personal Data Protection Commission Singapore. (2022). Guide to basic data anonymisation techniques. Singapore Government.
Price, W. N. (2017). Regulating black-box medicine. Michigan Law Review, 116(3), 421-474.
Price, W. N. (2019). Medical AI and contextual bias. Harvard Journal of Law & Technology, 33(1), 65-116.
Rajkomar, A., Oren, E., Chen, K., Dai, A. M., Hajaj, N., Hardt, M., Liu, P. J., Liu, X., Marcus, J., Sun, M., Sundberg, P., Yee, H., Zhang, K., Zhang, Y., Flores, G., Duggan, G. E., Irvine, J., Le, Q., Litsch, K., ... Dean, J. (2018). Scalable and accurate deep learning with electronic health records. NPJ Digital Medicine, 1(1), 18.
Selbst, A. D., & Barocas, S. (2018). The intuitive appeal of explainable machines. Fordham Law Review, 87(3), 1085-1139.
Singapore Personal Data Protection Commission. (2021). Guide on active enforcement. Singapore Government.
Solove, D. J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review, 154(3), 477-564.
Treasury Board of Canada Secretariat. (2021). Directive on automated decision-making. Government of Canada.
UK AI Council. (2021). AI roadmap. UK Government.
U.S. Congress. (2021). Health Information Technology for Economic and Clinical Health Act amendments. Public Law No. 116-321.
U.S. Food and Drug Administration. (2021). Artificial intelligence/machine learning (AI/ML)-based software as a medical device (SaMD) action plan. U.S. Department of Health and Human Services.
Vayena, E., Blasimme, A., & Cohen, I. G. (2018). Machine learning in medicine: Addressing ethical challenges. PLOS Medicine, 15(11), e1002689.
