A Model of International Personal Information Processing in the Medical Field for Compliance with Multijurisdictional Legislations

Abstract

As personal information processing in the medical field is being increasingly internationalized and national personal information protection legislations are being rapidly developed, ensuring compliance with multiple rules from different jurisdictions has become a critical challenge. This study proposes a novel description model that integrates personal information processing and its legal evaluation, enabling organizations to effectively navigate the complex landscape of international data protection regulations. The proposed model comprises 10 essential elements for the legal evaluation of international processing. The model adheres to the “legal syllogism” approach, a standard legal analysis method, and distinguishes between three key components: facts, applicable rules, and rule application results. This method allows model users to apply multiple rules to the same processing and obtain results for each application, facilitating a comprehensive understanding of compliance requirements. The model’s 10 elements include data subjects, processing parties, datasets, processing activities (collection, storage, data flow, and further processing), and arrangements. Each element is described in detail using flowcharts and table templates. The authors demonstrate the model’s application, highlighting its multi-jurisdictional utility and advantages over existing models by using the example of a cross-border patient monitoring system. The proposed model’s significant contribution lies in its comprehensive coverage of legal concepts and its alignment with the legal syllogism approach, enabling seamless incorporation of legal analysis, in particular, in the process of privacy impact assessment.