| Article 22 | (Confidentiality and Integrity of Transmission and Safety of Data Storage)
- A core system shall adopt an encrypted transmission mechanism for the transmission of personal or classified data through the Internet, to prevent unauthorized information disclosure or detect information changes.
- It is advisable for a core system of a type 1 organization to adopt an encrypted transmission mechanism for the transmission of personal or classified data through the Intranet.
- No such encryption as described in the preceding two paragraph is necessary if physical protective measures are available as substitutes in the course of transmission.
- In the event of the international transmission of classified data, an organization shall develop an encrypted transmission mechanism and confirm the compliance of the collection, processing, use, international transmission, and control of client information by an entrusted institution (the head office or an overseas subsidiary to which a foreign organization outsources information processing offshore due to division of work) with the applicable provisions of the Personal Data Protection Act of the R.O.C. Authorization from the subject shall be obtained prior to transmission. No restriction of a competent authority on international transmission may be violated. Complete audit records shall be kept.
- The encryption mentioned shall use algorithms that are public, certified by international institutions, and not cracked.
- Encryption GoldKeys or certificates shall be replaced periodically.
- It is advisable for an encryption mechanism to support a GoldKey with the maximum length from an algorithm.
- It is advisable that regulations be set forth and necessary safety protection measures be implemented for the safekeeping of the GoldKey server side of an encryption system.
- Important files of configuration settings and other information requiring protection that are contained in a core system of a type 1 organization shall be encrypted or otherwise appropriately stored.
- Encryption and decryption programs or public chmod programs (such as database tools) shall be subject to control with restrictions on their use to prevent unauthorized access and keep audit trails.
|
|