Chapter I General Provisions
|
| Article 1 | This Law is enacted to govern the processing of personal data by computers so as to prevent infringement upon personal rights, and to facilitate the proper utilization of personal data. |
| Article 2 | The protection of personal data shall be governed by the provisions of this Law, or governed by other laws if so provided in such other laws. |
| Article 3 | The terms used herein denote the following meanings:
1.Personal data: the name, date of birth, I.D. Card number, characteristic, fingerprints, marital, family, educational, occupational, and health status, medical history, financial conditions, social activities of a natural person and other data which can serve to identify said specific person;
2.Personal data file: gathering of personal data through storage at magnetic storage or at other similar media for certain specific purpose;
3.Computer processing: to use computers or automatic machinery to key in, store, compile, correct, search, delete, output, or transmit data or process otherwise;
4.Collection: to collect personal data for the establishment of personal data file;
5.Utilization: refers to use of personal data file by government agency or non-government agency kept by it for internal use or for use by a third party other than the principal;
6.Government agency: refers to a government agency at the central government or local government level which is empowered to exercise sovereign power;
7.Non-government agency: refers to the following enterprises or groups or individuals other than those mentioned above:
(1)credit search businesses and groups or individuals whose major line of business is to collect or process personal data by computers;
(2)hospitals, schools, telecommunication, financial, securities, insurance, and mass communications industries; and
(3)other businesses, groups or individuals designated by the Ministry of Justice in conjunction with the government authority in charge of such industry at the central government level.
8.Principal: the individual to which the personal data belongs; and
9.Specific purpose: refers to those purposes prescribed by the Ministry of Justice in conjunction with the government authority in charge of the industry at the central government level. |
| Article 4 | The following rights exercisable by the principal with regard to his personal data shall not be waived in advance nor limited by specific agreement:
1.any inquiry and request for review of the personal data thereof;
2.any request to make copies of the personal data thereof;
3.any request to supplement or correct the personal data thereto;
4.any request to discontinue processing of personal data by computers or utilization of personal data thereof; and
5.any request for deletion of personal data therefrom. |
| Article 5 | Where a group or an individual is designated by a government agency or non-government agency to process data, the group or individual so designated to process data shall be considered part of the staff of said designating agency within the meaning of this Law. |
| Article 6 | The collection or utilization of personal data shall respect the rights and interests of the principal and such personal data shall be handled in accordance with the principles of honesty and credibility so as not to exceed the scope of the specific purpose. |
Chapter II Data Processing by The Government Agency
|
| Article 7 | The government agency shall not collect or process personal data unless it has a certain specific purpose which complies with at least one of the followings:
1.it is within the scope of job functions provided by laws and regulations;
2.a written consent has been obtained from the principal; and
3.there is no possibility that it shall infringe upon the rights and interests of the principal. |
| Article 8 | The government agency shall utilize the personal data in accordance with the scope of its job functions provided by laws and regulations, and in compliance with the specific purpose of collection, provided, however, that it may utilize the personal data other than for the specific purpose upon occurrence of any of the following conditions:
1.such utilization is provided for in the laws and regulations;
2.such utilization is justifiable and for internal purpose only;
3.such utilization shall safeguard the national security;
4.such utilization shall improve public interests;
5.such utilization shall eliminate any emergency danger which could endanger the principal's life, body, freedom or property;
6.such utilization shall prevent the rights and interests of another from being seriously damaged, and there is a need to utilize the same;
7.such utilization shall serve academic study purposes and the material interests of the principal will not be adversely affected;
8.such utilization shall benefit the rights and interests of the principal; and
9.such utilization has the written consent of the principal. |
| Article 9 | The international transmission and utilization of personal data by the government agency shall be handled in accordance with relevant laws and regulations. |
| Article 10 | A government agency which keeps personal data file shall announce the following in a government gazette or by other proper means; the above provisions apply to any amendment thereof:
1.name of personal data file;
2.name of the government agency keeping the personal data file;
3.name of the government agency utilizing the personal data file;
4.basis on which the personal data file is kept and the specific purpose for keeping the file;
5.classification of personal data;
6.scope of personal data;
7.means of collecting personal data;
8.places where personal data are normally transmitted and recipient of said data; and
9.the direct recipient of personal data transmitted through international channel; and
10. name and address of government agency accepting applications for inquiries making, correction or review. The classification of personal date referred to in Item 5 above shall be prescribed by the Ministry of Justice with the government authority in charge of the industry at the central government level. |
| Article 11 | The provisions of the preceding article have no application to utilization of the following personal data file:
1.where national security, foreign affairs and military secrets, overall economic interests or other major national interests are involved;
2.where cases are being reviewed by the grand justice of the Judicial Yuan, or cases are being reviewed by the Government Official Disciplinary Committee, and matters under investigation, trial, judgment, enforcement or handling of non-litigious matters by court;
3.where matters relevant to precautionary measures against criminal offenses, criminal investigation, enforcement, correction or protective measures or rehabilitation affairs are involved;
4.where matters relevant to administrative punishment and compulsory enforcement thereof are involved;
5.where matters relevant to administration of entry/exit of the country, security check or investigation and verification of refugees are involved;
6.where matters relevant to collection of taxes and dues are involved;
7.where matters relevant to personnel, job duties, salary payment, sanitation, welfare or other relevant issues of a government agency are involved;
8.where the personal data file is used for computer processing for experimental purpose;
9.where deletion will be made prior to announcement in the government gazette;
10. where the name, address, exchange of money and articles of the principal is recorded for the purpose of official contacts;
11. where a personal data file is specifically produced by the government official for performance of duties for internal use in said government agency; and
12. where laws and regulations specify otherwise. |
| Article 12 | With regard to the personal data files kept by the government agency, the said government agency shall, at the request of the principal, reply to his inquiry, provide files for his review, or make copies of the files for him, provided, however, that the above provisions do not apply to any of the following:
1.where the file shall not be made public pursuant to the provisions of the preceding article;
2.where the performance of official duties may be interfered with; and
3.where the material interests of a third party may be adversely affected. |
| Article 13 | The government agency shall maintain the accuracy of personal data, and shall make corrections or supplements thereto in accordance with its duty or at the request of the principal.
In the event there is a dispute about the accuracy of personal data, the government agency shall, pursuant to its duty or at the request of the principal, discontinue the computer processing or utilization thereof, provided, however, that the above provisions do not apply to a situation where the processing or utilization is necessary for performance of an official duty, and the dispute is specifically identified or a written consent is obtained from the principal.
In the event the specific purpose for processing the personal data no longer exists or the period for processing has expired, the government agency shall, pursuant to its duty or at the request of the principal, delete or discontinue the processing or utilization of said personal data, provided, however, that the above provisions do not apply to a situation where the processing or utilization thereof is necessary for performance of an official duty, or the use purpose is changed pursuant to the provisions of this Law or a written consent is obtained from the principal. |
| Article 14 | The government agency shall maintain a book to record all the particulars required to be made public pursuant to the provisions of Paragraph 1 of Article 10 hereinabove for review. |
| Article 15 | Where a request is made by the principal to the government agency pursuant to the provisions of this Law, it shall be handled within thirty days. Where said request is not handled within the aforesaid time period, a written notice stating the reason said request was not handled shall be sent to the principal. |
| Article 16 | The government agency may charge a fee to those who make an inquiry or request to review, or make a copy of the personal data.
The amount of the fee shall be prescribed by the said government agency. |
| Article 17 | The government agency which keeps personal data files shall, pursuant to relevant laws and regulations, appoint a full time employee to handle matters relevant to the security and maintenance of said files to prevent personal data from being stolen, altered without authorization, damaged, lost or disclosed. |
Chapter III Data Processing by Non-government Agency
|
| Article 18 | A non-government agency shall not collect or process by computer any personal data unless it has some specific purpose and it complies with any of the followings:
1.where a written consent is obtained from the principal;
2.where an agreement or similar contractual relationship is entered into with the principal whereby the rights and interests of the principal shall not be infringed upon;
3.where the information is already known to the public and no material adverse effect will be caused to the interests of the principal;
4.where there is a need for academic study, and no material adverse effect will be caused to the interests of the principal; and
5.the provisions of Article 3, Item 7 Subitem 2 of this Law and other laws and regulations otherwise specify. |
| Article 19 | Any non-government agency which is not registered with the government authority in charge of the industry and does not have a license issued thereto pursuant to the provisions of this Law shall not collect, process by computer, make international transmission or utilize personal data.
Credit search industry and groups or individuals whose major line of business is to collect or process by computer personal data shall obtain a special permit from and register with the government authority in charge of the industry for issuance of a license.
The registration procedures, qualifications required for applying issuance of a special permit and handling fee referred to in the two preceding paragraphs shall be prescribed by the government authority in charge of the industry at the central government level. |
| Article 20 | Those applying for registration referred to in the preceding article shall submit an application stating thereon the followings:
1.name, domicile and residential address of the applicant; if the applicant is a juristic person or a group of non juristic persons, the name, address of the head office and branch office(s), and the name, domicile and residential address of the statutory representative or administrator;
2.name of personal data file;
3.the specific purpose for keeping the personal data file;
4.classification of personal data;
5.scope of personal data;
6.period for keeping the personal data file;
7.method used for collecting personal data;
8.scope of utilization of personal data file;
9.the recipient who directly receives personal data through international transmission;
10. name of the person responsible for maintaining personal data file; and
11. security and maintenance plan for personal data file.
In the event there is any change to the entries of registration, an application for amendment registration shall be filed within 15 days after said change. In the event of termination of business operations, an application for terminating business operations shall be filed within one month after the cause of business termination occurs.
Those applying for termination of business operations shall report their method of handling personal data to the government authority in charge of the industry for approval.
The specific purpose referred to in Item 3 of Paragraph 1 and the classification referred to in Item 4 above shall be prescribed by the Ministry of Justice in conjunction with the government authority in charge of the industry at the central government level. |
| Article 21 | After applications for registration filed pursuant to the provisions of the preceding Article are approved, the non-government agency shall list all the particulars referred to in Items 1 to 10 of Paragraph 1 of the preceding Article in the government gazette or by public notice in a local newspaper. |
| Article 22 | The non-government agency shall maintain a book to record all the particulars referred to in Items 1 to 10 of Paragraph 1 of Article 20 for review. |
| Article 23 | The non-government agency shall utilize the personal data within the scope of the specific purpose, provided, however, that it may utilize the personal data otherwise upon occurrence of any of the following:
1.such utilization shall improve public interests;
2.such utilization shall protect the life, body, freedom or property of the principal from imminent danger;
3.such utilization shall prevent the rights and interests of another person from sustaining material adverse effect; and
4.such utilization has the written consent of the principal. |
| Article 24 | Where the international transmission or utilization of personal data by a non-government agency meets any one of the following criteria, the government agency in charge of the industry may limit the transmission and utilization thereof:
1.where major national interests are involved;
2.where national treaty or agreement specifies otherwise;
3.where the nation receiving personal data lacks laws which fairly protect the rights and interests of the principal thereby causing injury to the principal; and
4.where international transmission and utilization of personal data are made through a circuitous means in order to evade the provisions of this Law. |
| Article 25 | Where the government authority in charge of the industry deems it necessary, it may send officials with identification certificates to any non-government agency which is subject to its jurisdiction and granting of a special permit or approval of registration and order such non-government agency to present relevant information with regard to matters provided by this Law or to take other necessary measures to comply with this Law, or to enter the premises of the non-government agency to conduct an investigation. In the event the investigations show the relevant information is in violation of the provisions of this Law, it may be confiscated.
With regard to the above order, investigation, or confiscation by the government authorities, the non-government agency shall not evade, obstruct or refuse. |
| Article 26 | The provisions of Articles 12, 13, 15, 16 Paragraph 1 and 17 shall be applied mutatis mutandis to all non-government agencies.
The criteria for the charging of a fee by a non-government agency pursuant to the provisions of Paragraph 1 of Article 16 hereinabove shall be prescribed by the government authority in charge of the industry at the central government level. |
Chapter IV Damages and Other Remedy
|
| Article 27 | A government agency which infringes upon the rights and interests of the principal and violates any provision of this Law shall be liable for the damages arising therefrom, provided, however, that the above provisions do not apply to damages arising from natural disaster, incident or other force majeure.
With regard to damages caused to non-property, the injured party may also request proper monetary compensation. With regard to damages of reputation, the injured party may also request the rehabilitation of his reputation.
The total amount of compensation for the damages referred to in the two preceding paragraphs shall not be less than NT$20,000 but not more than NT$100,000 for each case of damages per person, provided, however, that the above provisions do not apply to the situation where the injured party can prove that the damages sustained by it are more than the aforesaid prescribed amount.
With regard to damages caused to the principal by the same cause and fact, the total amount of compensation shall not be more than NT$20 million.
The right of claim referred to in the second Paragraph above shall not be transferred or inherited, provided, however, that these provisions do not apply to the situation where the monetary compensation is undertaken in an agreement or is claimed in a legal action. |
| Article 28 | A non-government agency which infringes upon the rights and interests of a principal as a result of its violation of this Law shall be liable for the damages arising therefrom, provided, however, that these provisions do not apply to the situation where the non-government agency can prove that the damages are not caused by its willful conduct or negligence.
The provisions of Paragraphs 2 to 5 of the preceding Article are applicable to claims for damages made in accordance with the provisions of the preceding Paragraph. |
| Article 29 | The right to claim damages is subject to a statute of limitation of two years calculated from the time the claimant has knowledge of the damages and the identity of the party liable for the damage arising therefrom or five years calculated from the date the damaged actually occurs. |
| Article 30 | With regard to compensation for damages, apart from complying with the provisions of this Law, the government agency shall comply with the provisions of the State Compensation Law, while the non-government agency shall comply with the provisions of the Civil Code. |
| Article 31 | Where a principal exercises his right prescribed in Article 4 hereinabove against a government agency, but the government agency refuses or fails to handle his case within the time period specified in Article 15 hereinabove, the principal may, within twenty days after refusal or upon expiry of the specified time period, file a written application with the supervising government agency requesting proper handling.
The supervising government agency shall, within two months after accepting said application, notify the principal in writing of the results of his application. |
| Article 32 | Where a principal exercises his right prescribed in Article 4 hereinabove against a non-government agency, but the non-government agency refuses to handle his case, the principal may, within twenty days after refusal or upon expiry of the specified time period, file a written application with the government authority in charge of the industry requesting proper handling of his case.
The said government authority in charge of the industry shall, within two months after accepting said application, notify the principal of the results of his application. If the application is considered reasonable, the government authority in charge of the industry shall order the non-government agency to make corrections within the specified time period. |
Chapter V Penalties
|
| Article 33 | A person who intends to make profits for himself by violating the provisions of Articles 7, 8, 18, 19 Paragraphs 1 & 2, and 23 hereinabove or the injunction order make in accordance with Article 24 hereinabove and cause injury to another shall be punished with an imprisonment of less than two years, detention or, in lieu thereof or in additional thereto, a criminal fine of less than NT$40,000. |
| Article 34 | A person who intends to make unlawful gains for himself or for a third party or intends to infringe upon the interests of another by illegally outputting, interfering, changing, deleting personal data file or by other illegal means to impede the accuracy of personal data file thus causing damages to another shall be punished with an imprisonment for less than three years, or detention, or a fine of less than NT$50,000. |
| Article 35 | A government official who takes advantage of his position, or opportunity or means available to him to commit the offenses prescribed in the two preceding articles shall be subject to punishments half as severe as those enumerated above. |
| Article 36 | The offenses referred to in this Chapter may be instituted only upon complaint. |
| Article 37 | In the event a more severe punishment is provided for in other laws with respect to the offenses outlined in this Chapter, the more severe punishment shall apply. |
| Article 38 | Upon occurrence of any of the following, the government authority in charge of the industry shall impose an administrative fine of not less than NT$20,000 but not more than NT$100,000 on the responsible person, and order the said responsible person to take corrective measures within a specified time period. In the event the responsible person fails to take corrective measures within the specified time period after having been ordered to do so, the government authority in charge of the industry may continue to impose a fine each time a violation of any of the following occurs:
1.a violation of the provisions of Article 18 hereinabove;
2.a violation of the provisions of Article 19 Paragraph 1 or Paragraph 2 hereinabove;
3.a violation of the provisions of Article 23 hereinabove; and
4.a violation of the injunction order imposed in accordance with the provisions of Article 24 hereinabove.
In the event the degree of violations referred to in Item 1, 3 or 4 above is serious, an order to revoke the special permit or registration granted in accordance with this Law may be issued. |
| Article 39 | Upon occurrence of any of the following, the government authority in charge of the industry may order the responsible person to take corrective measures within a specified time period. If corrective measures are not taken within the specified time period, an administrative fine of not less than NT$10,000 but not more than NT$50,000 may be imposed upon the responsible person each time a violation of any of the following occurs:
1. A violation of the provisions of Article 20 Paragraph 2 hereinabove;
2. A failure to place an announcement in the local newspaper which would cause a violation of the provisions of Article 21 hereinabove;
3. A violation of the provisions of Article 22 hereinabove;
4. A violation of the provisions of Article 12, 13, 15 and 17 in accordance with the provisions of Article 26 Paragraph 1 hereinabove; and
5. A violation of the criteria for fee charge provided for under Article 26 Paragraph 2 hereinabove.
In case the degree of violations referred to in Items 1, 2, 3, or 4 of the preceding Paragraph is serious, an order to revoke the special permit or registration granted in accordance with this Law may be issued. |
| Article 40 | Upon occurrence of any of the following, the government authority in charge of the industry may impose an administrative fine of not less than NT$10,000 but not more than NT$50,000 on the responsible person each time a violation of any of the following occurs:
1.a failure to handle personal data pursuant to the means approved by the government authority in charge of the industry in accordance with Article 20 Paragraph 3 hereinabove;
2.a violation of the provisions of Article 25 Paragraph 2 hereinabove; and
3.a failure to comply with an order to take corrective measures issued in accordance with Article 32 Paragraph 2 hereinabove.
In the case the degree of violation referred to in Item 2 or 3 of the preceding Paragraph is serious, an order to revoke the special permit or registration granted in accordance with this Law may be issued. |
| Article 41 | Failure to pay administrative fines imposed according to this Law shall cause the case to be referred to court for compulsory execution if fines are still not paid within the specified time period even upon due notice. |
Chapter VI Supplementary Provisions |
| Article 42 | The Ministry of Justice shall be responsible for coordinating and contacting matters relevant to the enforcement of this Law. Rules governing said coordination and contact shall be prescribed by the Ministry of Justice.
With regard to matters which are prescribed to be handled by the government authority in charge of the industry, if there is no such government authority in charge of the industry to handled the same, they shall be handled by the Ministry of Justice.
The administration governing the collection, computer processing, utilization of personal data, and registration, public announcement or other matters by non-government agency may be handled by public interests group designated by the Ministry of Justice or the government authority in charge of the industry when deemed necessary. |
| Article 43 | Those who are already engaged in the collection or computer processing of personal data before promulgation and enforcement of this Law and are required to process registration or special permit pursuant to the provisions of this Law shall process the same within one year after enforcement of this Law.
Enterprises, groups or individuals designated by the Ministry of Justice in conjunction with the government authority in charge of the industry pursuant to the provisions of Article 3 Item 7 Sub-item 3 shall process registration or special permit within six months after designation.
Those who fail to process registration prescribed in the two preceding paragraphs or those whose applications are disapproved shall be considered as un-registered or without a special permit and shall be punished accordingly. |
| Article 44 | The enforcement rules of this Law shall be prescribed by the Ministry of Justice. |
| Article 45 | This Law shall become effective upon promulgation. |