Background

The main drive for the Amendment is to comply with the Constitutional Court’s ruling issued on 12 August 2022 (111年度憲判字第13號健保資料庫案判決), which mandates the establishment of an independent supervisory mechanism for personal data protection within three years.

The PDPA has been amended in May 2023 to add Article 1-1 (not effective yet), which provides that the competent authority of the PDPA will be the Personal Data Protection Commission (PDPC), the first dedicated authority for personal data protection. The Preparatory Office of the PDPC was established on 5 December 2023. The PDPC will be officially established after the Organizational Act of the PDPC (which was proposed along with the Amendment) is passed by the Legislative Yuan.

The Amendment also includes the following key changes.

Key points of the Amendment

Government agencies are now required to appoint DPO (Article 18)

Although the first draft of the Amendment proposed that the PDPC may designate certain non-government agencies to appoint DPO and personal data protection audit personnel, the Amendment does not include this requirement so only government agencies are required to do so.

Data breach notification/report (Article 12)

• Under the current PDPA, if there is a data breach, the non-government agency only needs to notify the data subject. Under the Amendment, the non-government agency may also need to report to the PDPC. The threshold, timeline and other requirements on report will be further determined by the PDPC in regulations.
• The Amendment requires the non-government agency to keep the documentation of the data incident for inspection by the PDPC. The record retention period will be determined by the PDPC in regulations.
• Violation of the new requirements above will be subject to an administrative fine ranging from NTD 20,000 (USD 625) to NTD 200,000 (USD 6,250), which may be imposed consecutively if the non‑government agency fails to rectify within the specified period of time. (new Paragraph 2, Article 48).
• The PDPC may delegate the acceptance and onward notification of the report to other agencies, administrative organizations, or public interest groups to handle the matter (Para 1, Article 52).

Administration inspection

• The first draft of the Amendment proposed that the PDPC may choose the industries and non-government agencies with higher risk of personal data infringement to prioritize administrative inspection against them (Article 27). The Amendment does not include this idea.
• That said, even if there is no indication of violation, under the Amendment the PDPC may still conduct proactive administrative inspection for reviewing the non-government agencies’ compliance with the PDPA. The PDPC will promulgate regulations for matters regarding proactive inspection (new para 2, Article 22).
• The non-government agencies cannot refuse the inspection unless there are “justifiable reasons” (Para 4, Article 22).

6-year transition period (Article 51-1)

• The PDPC will request the Executive Yuan to announce which of the non-government agencies (likely those that already have specific competent authorities) will remain to be regulated by the current central competent authorities or local governments up to six years after the PDPC is established.
• Every two years, the PDPC will discuss with the competent authorities in charge of the industry concerned and report to and request the Executive Yuan to reduce the scope of the non-government industries that remain to be supervised by the competent authorities.
• However, once the Amendment is in effect, the power under Article 21 of the PDPA to restrict cross‑border data transfer will be transferred from the competent authorities in charge of the industry concerned to the PDPC.

The PDPC will promulgate Regulations for Security and Maintenance of Personal Information Files (Article 20-1 and 51-1)

Under the Amendment, the PDPC will promulgate baseline Regulations for Security and Maintenance of Personal Information Files for non-government agencies. (Article 20-1) During the transition period, the relevant Regulations for Security and Maintenance of Personal Information Files promulgated by the competent authorities shall be based on the PDPC’s baseline version but can be stricter (Paragraphs 3 to 4, Article 51-1).

Administrative appeal (Article 53-1)

As the PDPC is an independent authority, the appeal against the rulings of the PDPC shall be filed with the Administrative Court directly.

However, during the transition period, the appeal against the rulings of the central competent authorities or local governments shall be filed with the PDPC.

Impact

The Amendment follows the decision of Constitutional Court’s ruling to establish an independent supervisory mechanism for personal data protection. Given the new regulatory requirements, companies are advised to assess if they have any gap between the Amendment and their current data protection practice, in particular the data breach response plan. If yes, companies shall immediately adjust the current policies and operations for compliance with these requirements. If you have any questions, please feel free to contact us.