Legal Protections for Personal Health Information in the Age of Big Data – A Proposal for Regulatory Framework

This article outlines the need for, and possible solutions to, the problem of third parties' legally untrammelled ability to collect and use identified or identifiable personal, sometimes very sensitive, health data. The “datafication” of health information about individuals collected, managed, and disseminated without their knowledge and informed consent effectively treats data subjects – us – as mere means to an end. The article examines jurisprudential and technical proposals for safeguarding privacy of data subjects, and then critically analyses the European Union's General Data Protection Regulation 2016/679 on the “protection of natural persons with regard to the processing of personal data and on the free movement of such data”; the United Kingdom's approach to statutory controls on privacy-intrusive powers of national security and law enforcement agencies in in form of proportionality and necessity tests implemented under the Investigative Powers Act (UK) 2016; and the United States' preference for integrated government–private–sector cybersecurity systems that safeguard data subjects' rights to privacy and security by targeting specific Big Data and the Internet of Things (IoT) sectors. The article outlines proposal that envisages a four-tier legal framework for protection of identifiable personal health data. Protections at each tier would be discrete yet capable of integration – from operationalising data privacy and ethics by design at the level computer software (algorithmic) instructions to national legislation and international treaties