0A4F4F9BD490A749D5437F821CF06DF1

Personal Information Protection Act

https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=I0050021

http://leaux.net/URLS/ConvertAPI Text Files/F3AA3B284C502374B7FD7381E4004D1F.en.txt

Examining the file media/Synopses/F3AA3B284C502374B7FD7381E4004D1F.html:

This file was generated: 2020-08-23 05:54:20

Indicators in focus are typically shown highlighted in yellow;

Peer Indicators (that share the same Vulnerability association) are shown highlighted in pink;

"Outside" Indicators (those that do NOT share the same Vulnerability association) are shown highlighted in green;

Trigger Words/Phrases are shown highlighted in gray.

Link to Orphaned Trigger Words (Appendix (Indicator List, Indicator Peers, Trigger Words, Type/Vulnerability/Indicator Overlay)

Applicable Type / Vulnerability / Indicator Overlay for this Input

Vulnerability Type	Vulnerability	Indicator	# Matches
Political	Illegal Activity	crime	1
Political	Illegal Activity	unlawful	4
Political	criminal	criminal	2
Political	political affiliation	party	4
Health	Motherhood/Family	family	1
Social	Occupation	occupation	1
Social	Property Ownership	home	1
Social	Property Ownership	property	2
Social	Religion	faith	1
Social	Soldier	military	1
Social	Victim of Abuse	victim	5
Social	education	education	1
General/Other	Public Emergency	emergency	1
General/Other	Relationship to Authority	authority	18

Political / Illegal Activity

Searching for indicator crime:

(return to top)
p.(None): 5. the right to erase his/her personal data.
p.(None):
p.(None): Article 4
p.(None): Whoever is commissioned by a government agency or non-government agency to collect, process or use personal data shall be
p.(None): deemed to be acting on behalf of the commissioning agency to the extent that the PDPA applies.
p.(None):
p.(None): Article 5
p.(None): The collection, processing and use of personal data shall be carried out in a way that respects the data subject's rights and interest,
p.(None): in an honest and good-faith manner, shall not exceed the necessary scope of specific purposes, and shall have legitimate and
p.(None): reasonable connections with the purposes of collection.
p.(None):
p.(None): Article 6
p.(None): Data pertaining to a natural person's medical records, healthcare, genetics, sex life, physical examination and criminal records shall
p.(None): not be collected, processed or used unless on any of the following bases:
p.(None): 1. where it is expressly required by law;
p.(None): 2. where it is within the necessary scope for a government agency to perform its statutory duties or for a non-government agency to
p.(None): fulfill its statutory obligation, provided that proper security and maintenance measures are adopted prior or subsequent to such
p.(None): collection, processing or use of personal data;
p.(None): 3. where the personal data has been disclosed to the public by the data subject or has been made public lawfully;
p.(None): 4. where it is necessary for statistics gathering or academic research by a government agency or an academic institution for the
p.(None): purpose of healthcare, public health, or crime prevention, provided that such data, as processed by the data provider or as disclosed
p.(None): by the data collector, may not lead to the identification of a specific data subject;
p.(None): 5. where it is necessary to assist a government agency in performing its statutory duties or a non-government agency in fulfilling its
p.(None): statutory obligations, provided that proper security and maintenance measures are adopted prior or subsequent to such collection,
p.(None): processing, or use of personal data; or
p.(None): 6. where the data subject has consented to the collection, processing and use of his/her personal data in writing, except where the
p.(None): collection, processing or use exceeds the necessary scope of the specific purpose, or where the collection, processing or use based
p.(None): solely on the consent of the data subject is otherwise prohibited by law, or where such consent is not given by the data subject out of
p.(None): his/her free will.
p.(None): Articles 8 and 9 shall apply mutatis mutandis to the collection, processing, or use of personal data in accordance with the preceding
p.(None): paragraph; Paragraphs 1, 2 and 4 of Article 7 shall apply mutatis mutandis to the consent required under Subparagraph 6 of the
p.(None): preceding paragraph.
p.(None):
p.(None): Article 7
p.(None): "Consent", as referred to in Subparagraph 2, Paragraph 1, Article 15 and Subparagraph 5, Paragraph 1, Article 19, means a
p.(None): declaration of agreement given by a data subject after he/she has been informed by the data collector of the information required
p.(None): under the PDPA.
...

Searching for indicator unlawful:

(return to top)
p.(None): enforce the corrective measures referred to in the preceding paragraph, such measures shall be within the scope that is necessary to
p.(None): prevent and remedy the violation of the PDPA and shall do the least harm to the rights and interests of the non-government agency
p.(None): concerned.
p.(None):
p.(None): Article 26
p.(None): The findings of the inspections conducted by the central government authorities in charge of the industries concerned or the
p.(None): municipality/city/county governments concerned in accordance with Article 22 may be disclosed to the public if the non-government
p.(None): agencies concerned are not in violation of the PDPA and agree to the public disclosure of such findings.
p.(None):
p.(None): Article 27
p.(None): A non-government agency in possession of personal data files shall implement proper security measures to prevent the personal
p.(None): data from being stolen, altered, damaged, destroyed or disclosed.
p.(None): The central government authorities in charge of the industries concerned may designate and order certain non-government agencies
p.(None): to establish a security and maintenance plan for the protection of personal data files and a guideline on disposing personal data
p.(None): following a business termination.
p.(None): Matters such as standards on setting forth the aforementioned plans and disposal regulations shall be expressly established by the
p.(None): central government authority of in charge of the industry concerned.
p.(None):
p.(None): Chapter IV Damages and Class Action
p.(None):
p.(None): Article 28
p.(None): A government agency shall be liable for the damages arising from injury caused by any unlawful collection, processing or use of
p.(None): personal data, or other infringement on the rights of data subjects due to such government agency's violation of the PDPA, unless
p.(None): such injury was caused by any natural disaster, emergency or other force majeure event.
p.(None): If an injury suffered by the victim is a non-pecuniary damage, he/she may request an appropriate amount of monetary compensation;
p.(None): if the injury suffered by the victim is damage to his/her reputation, the victim may request appropriate corrective measures to restore
p.(None): his/her reputation.
p.(None): Under the circumstances identified in the preceding two paragraphs, if it is difficult or impossible for the victim to prove the monetary
p.(None): value of the actual damage, he/she may ask the court to award the compensation in the amount of at least NT$500 but no more than
p.(None): NT$20,000 per incident, per person based on the severity of the damage.
p.(None): Where the rights of multiple data subjects have been infringed upon due to the same incident, the total amount of compensation
p.(None): awarded to such data subjects shall not exceed NT$200 million. However, if the interests involved in the incident exceed NT$200
p.(None): million, the compensation shall be up to the value of such interests.
p.(None): If the total amount of damages for the injuries attributable to the same incident exceeds the amount referred to in the preceding
p.(None): paragraph, the compensation payable to each victim shall not be limited to the lower end of damages, i.e. NT$500, per incident as
p.(None): set forth in Paragraph 3 of this Article.
p.(None): The right of claim referred to in Paragraph 2 above may not be transferred or inherited. However, this does not apply to the
p.(None): circumstances where monetary compensation has been agreed upon in a contract or a claim therefor has been filed with the court.
p.(None):
p.(None): Article 29
p.(None): A non-government agency shall be liable for the damages arising from any injury caused by any unlawful collection, processing or
p.(None): use of personal data, or other infringement on the rights of data subjects due to such non-government agency's violation of the
p.(None): PDPA, unless the non-government agency can prove that such injury is not caused by its willful act or negligence.
p.(None): Paragraphs 2 to 6 of the preceding article apply to the damage claims raised in accordance with the preceding paragraph.
p.(None):
p.(None): Article 30
p.(None): The right to claim damage compensation will be extinguished if the right-holder does not exercise such right within the two-year
p.(None): period after he/she becomes aware of his/her damage and the identity of the person(s) liable for the compensation, or the five-year
p.(None): period following the occurrence of the damage.
p.(None):
p.(None): Article 31
p.(None): With regard to matters pertaining to damages, aside from the provisions of the PDPA, the State Compensation Law may be applied
p.(None): to a government agency and the Civil Code may be applied to a non-government agency.
p.(None):
p.(None): Article 32
p.(None): An incorporated foundation or an incorporated charity that brings a case to the court in accordance with this Chapter shall fulfill the
p.(None): following criteria:
p.(None): 1. the total registered assets of an incorporated foundation shall be NT$10 million or more, or the total number of members of an
p.(None): incorporated charity shall be 100 or more;
p.(None): 2. the protection of personal data shall be set forth as one of its purposes in its charter; and
p.(None): 3. It shall have been established for more than three years following its receipt of the approval thereof.
p.(None):
p.(None): Article 33
p.(None): The lawsuit filed with the court for damages against a government agency in accordance with the PDPA shall be subject to the
...

p.(None): The restrictions set by one of the data subjects referred to in the preceding paragraph have no effect on the other data subjects.
p.(None): The restrictions referred to in Paragraph 1 shall be specified in the documents identified in Paragraph 1 of Article 34, or shall be
p.(None): submitted to the court in writing.
p.(None):
p.(None): Article 38
p.(None): In the event that a data subject is not satisfied with the judgment of the lawsuit filed pursuant to Article 34, he/she may withdraw
p.(None): his/her delegation of litigation rights before the deadline for filing an appeal by such incorporated foundation or incorporated charity,
p.(None): and then file the appeal himself/herself.
p.(None): After receiving the original copy of the judgment, the incorporated foundation or the incorporated charity shall notify the data subjects
p.(None): of the outcome and also notify the data subjects in writing within seven days as to whether or not an appeal will be filed.
p.(None): Article 39
p.(None): The incorporated foundation or the incorporated charity shall deduct the necessary litigation fees from the compensation awarded in
p.(None): accordance with the result of the lawsuit filed pursuant to Article 34, and deliver the remaining amount to the data subjects that
p.(None): delegate the litigation rights.
p.(None): The incorporated foundation or the incorporated charity may not ask for remuneration for the lawsuit filed in accordance with
p.(None): Paragraph 1 of Article 34.
p.(None):
p.(None): Article 40
p.(None): The incorporated foundation or the incorporate charity that filed a lawsuit in accordance with the provisions of this Chapter shall
p.(None): engage an attorney as its agent ad litem for the lawsuit.
p.(None):
p.(None): Chapter V Penalties
p.(None):
p.(None): Article 41
p.(None): If a person, with the intention of obtaining unlawful gains for himself/herself or a third party, or with the intention of impairing another
p.(None): person's interests, is in violation of Paragraph 1, Article 6, Articles 15, 16, 19, and Paragraph 1, Article 20, or an order or decision
p.(None): relating to the restrictions on cross-border transfers made by the central government authority in charge of the industry concerned in
p.(None): accordance with Article 21 of the PDPA, thereby causing damage to others, the person shall be sentenced to imprisonment for no
p.(None): more than five years; in addition thereto, a fine of no more than NT$1million may be imposed.
p.(None):
p.(None): Article 42
p.(None): If a person, with the intention of obtaining unlawful gains for himself/herself or for a third party, or infringing upon the interests of
p.(None): others, illegally changes or erases personal data files, or otherwise compromises the accuracy of another's personal data files,
p.(None): thereby causing damages to others, the person shall be sentenced to imprisonment for no more than five years or detention, and/or a
p.(None): fine of no more than NT$1 million.
p.(None):
p.(None): Article 43
p.(None): The preceding two articles also apply to nationals of the Republic of China if they commit any offense specified therein outside of the
p.(None): Republic of China against any other national of the Republic of China.
p.(None):
p.(None): Article 44
p.(None): A government official who abuses the power, opportunity or means available to him/her to commit any of the offenses described in
p.(None): this Chapter shall be subject to a more severe punishment which is up to 50% more than that prescribed above.
p.(None):
p.(None): Article 45
p.(None): A person who committed any of the offenses identified in this Chapter shall be indicted only upon a complaint, except for the offenses
p.(None): specified in Article 41 and those identified in Article 42 against a government agency.
p.(None):
p.(None): Article 46
p.(None): If a more severe punishment is provided for under other laws with respect to the offenses identified in this Chapter, the more severe
p.(None): punishment shall take precedence.
p.(None):
p.(None): Article 47
p.(None): If a non-government agency violates any of the following provisions, the central government authority in charge of the industry
p.(None): concerned or the municipality/city/county government concerned shall impose an administrative fine between NT$50,000 and
...

Political / criminal

Searching for indicator criminal:

(return to top)
p.(None): Search SEARCH
p.(None):
p.(None): : Location Home > Law > Article Content
p.(None): P
p.(None):
p.(None): Article Content
p.(None):
p.(None):
p.(None):
p.(None): Title Personal Data Protection Act CH
p.(None): Amended Date 2015-12-30
p.(None): Category National Development Council
p.(None):
p.(None):
p.(None): Article Content Chapter Article No Search Content Search Legislative History
p.(None):
p.(None):
p.(None):
p.(None):
p.(None): Chapter I General Provisions
p.(None):
p.(None): Article 1
p.(None): The Personal Data Protection Act hereinafter, the "PDPA" is enacted to regulate the collection, processing and use of personal data
p.(None): so as to prevent harm on personality rights, and to facilitate the proper use of personal data.
p.(None):
p.(None): Article 2
p.(None): The terms used herein denote the following meanings:
p.(None): 1. "personal data" refers to a natural person's name, date of birth, ID Card number, passport number, features, fingerprints, marital
p.(None): status, family information, education background, occupation, medical records, healthcare data, genetic data, data concerning a
p.(None): person's sex life, records of physical examination, criminal records, contact information, financial conditions, data concerning a
p.(None): person's social activities and any other information that may be used to directly or indirectly identify a natural person;
p.(None): 2. a "personal data file" refers to a collection of personal data structured to facilitate data retrieval and management by automated or
p.(None): non-automated means;
p.(None): 3. "collection" refers to the act of collecting personal data in any way;
p.(None): 4. "processing" refers to the act of recording, inputting, storing, compiling/editing, correcting, duplicating, retrieving, deleting,
p.(None): outputting, connecting or internally transferring data for the purpose of establishing or using a personal data file;
p.(None): 5. "use" refers to the act of using personal data via any methods other than processing;
p.(None): 6. "cross-border transfer" refers to the cross-border processing or use of personal data;
p.(None): 7. "government agency" refers to a central or local government agency or administrative entity authorized to exercise public authority;
p.(None): 8. "non-government agency" refers to a natural person, legal person or group other than those stated in the preceding subparagraph;
p.(None): and
p.(None): 9. "data subject" refers to an individual whose personal data is collected, processed or used.
p.(None):
p.(None): Article 3
p.(None): A data subject shall be able to exercise the following rights with regard to his/her personal data and such rights shall not be waived or
p.(None): limited contractually in advance:
p.(None): 1. the right to make an inquiry of and to review his/her personal data;
p.(None): 2. the right to request a copy of his/her personal data;
p.(None): 3. the right to supplement or correct his/her personal data;
p.(None): 4. the right to demand the cessation of the collection, processing or use of his/her personal data; and
p.(None): 5. the right to erase his/her personal data.
p.(None):
p.(None): Article 4
p.(None): Whoever is commissioned by a government agency or non-government agency to collect, process or use personal data shall be
p.(None): deemed to be acting on behalf of the commissioning agency to the extent that the PDPA applies.
p.(None):
p.(None): Article 5
p.(None): The collection, processing and use of personal data shall be carried out in a way that respects the data subject's rights and interest,
p.(None): in an honest and good-faith manner, shall not exceed the necessary scope of specific purposes, and shall have legitimate and
p.(None): reasonable connections with the purposes of collection.
p.(None):
p.(None): Article 6
p.(None): Data pertaining to a natural person's medical records, healthcare, genetics, sex life, physical examination and criminal records shall
p.(None): not be collected, processed or used unless on any of the following bases:
p.(None): 1. where it is expressly required by law;
p.(None): 2. where it is within the necessary scope for a government agency to perform its statutory duties or for a non-government agency to
p.(None): fulfill its statutory obligation, provided that proper security and maintenance measures are adopted prior or subsequent to such
p.(None): collection, processing or use of personal data;
p.(None): 3. where the personal data has been disclosed to the public by the data subject or has been made public lawfully;
p.(None): 4. where it is necessary for statistics gathering or academic research by a government agency or an academic institution for the
p.(None): purpose of healthcare, public health, or crime prevention, provided that such data, as processed by the data provider or as disclosed
p.(None): by the data collector, may not lead to the identification of a specific data subject;
p.(None): 5. where it is necessary to assist a government agency in performing its statutory duties or a non-government agency in fulfilling its
p.(None): statutory obligations, provided that proper security and maintenance measures are adopted prior or subsequent to such collection,
p.(None): processing, or use of personal data; or
p.(None): 6. where the data subject has consented to the collection, processing and use of his/her personal data in writing, except where the
p.(None): collection, processing or use exceeds the necessary scope of the specific purpose, or where the collection, processing or use based
p.(None): solely on the consent of the data subject is otherwise prohibited by law, or where such consent is not given by the data subject out of
...

Political / political affiliation

Searching for indicator party:

(return to top)
p.(None): delegate their litigation rights to the incorporated foundation or the incorporated charity referred to in the preceding paragraph within a
p.(None): specified period of time. The incorporated foundation or the incorporated charity may expand demand for the relief sought before the
p.(None): conclusion of the oral argument.
p.(None): If other data subjects that suffer damages due to the same incident chose not to delegate their litigation rights pursuant to the
p.(None): preceding paragraph, they may still bring the case to the court within the timeframe specified in the public notice for the court to
p.(None): combine the cases.
p.(None): Other data subjects that have suffered damages due to the same incident may also file a petition, requesting the court to issue the
p.(None): public notice referred to in the preceding paragraph.
p.(None): The notice referred to in the preceding two paragraphs may be posted on the bulletin boards of the court, on the Internet or at other
p.(None): proper locations. Should the court consider it necessary, it may make such notice in a government gazette or newspaper, or through
p.(None): other means, and the fees therefrom shall be paid by the National Treasury.
p.(None): For the incorporated foundation or the incorporated charity that brings a case to the court in accordance with Paragraph 1, if the claim
p.(None): value of the case exceeds NT$600,000, the court fee attributable to the excess portion of the claim value shall be waived.
p.(None):
p.(None): Article 35
p.(None): If a data subject withdraws his/her delegation of the litigation rights in accordance with Paragraph 1 of the preceding article, the part
p.(None): of the court proceedings relating to such data subject shall automatically be suspended, and such data subject shall make a
p.(None): declaration to become a party to the suit. The court may also, on its own initiative, order such data subject to become a party to the
p.(None): suit.
p.(None): After the incorporated foundation or the incorporated charity files a lawsuit with the court in accordance with the preceding article, if
p.(None): the withdrawal of litigation rights by some data subjects causes the number of remaining data subjects in the lawsuit to drop to less
p.(None): than 20, the court proceedings for the remaining data subjects may still continue.
p.(None):
p.(None): Article 36
p.(None): The statute of limitation for each data subject to exercise the right to claim damages under Paragraphs 1 and 2 of Article 34 shall be
p.(None): calculated separately.
p.(None):
p.(None): Article 37
p.(None): An incorporated foundation or an incorporated charity that has been delegated litigation rights by data subjects shall be entitled to
p.(None): implement any and all acts pertaining to the lawsuit. However, the data subjects may set restrictions on the abandonment,
p.(None): withdrawal, or settlement relating to such lawsuit.
p.(None): The restrictions set by one of the data subjects referred to in the preceding paragraph have no effect on the other data subjects.
p.(None): The restrictions referred to in Paragraph 1 shall be specified in the documents identified in Paragraph 1 of Article 34, or shall be
p.(None): submitted to the court in writing.
p.(None):
p.(None): Article 38
p.(None): In the event that a data subject is not satisfied with the judgment of the lawsuit filed pursuant to Article 34, he/she may withdraw
p.(None): his/her delegation of litigation rights before the deadline for filing an appeal by such incorporated foundation or incorporated charity,
p.(None): and then file the appeal himself/herself.
p.(None): After receiving the original copy of the judgment, the incorporated foundation or the incorporated charity shall notify the data subjects
p.(None): of the outcome and also notify the data subjects in writing within seven days as to whether or not an appeal will be filed.
p.(None): Article 39
p.(None): The incorporated foundation or the incorporated charity shall deduct the necessary litigation fees from the compensation awarded in
p.(None): accordance with the result of the lawsuit filed pursuant to Article 34, and deliver the remaining amount to the data subjects that
p.(None): delegate the litigation rights.
p.(None): The incorporated foundation or the incorporated charity may not ask for remuneration for the lawsuit filed in accordance with
p.(None): Paragraph 1 of Article 34.
p.(None):
p.(None): Article 40
p.(None): The incorporated foundation or the incorporate charity that filed a lawsuit in accordance with the provisions of this Chapter shall
p.(None): engage an attorney as its agent ad litem for the lawsuit.
p.(None):
p.(None): Chapter V Penalties
p.(None):
p.(None): Article 41
p.(None): If a person, with the intention of obtaining unlawful gains for himself/herself or a third party, or with the intention of impairing another
p.(None): person's interests, is in violation of Paragraph 1, Article 6, Articles 15, 16, 19, and Paragraph 1, Article 20, or an order or decision
p.(None): relating to the restrictions on cross-border transfers made by the central government authority in charge of the industry concerned in
p.(None): accordance with Article 21 of the PDPA, thereby causing damage to others, the person shall be sentenced to imprisonment for no
p.(None): more than five years; in addition thereto, a fine of no more than NT$1million may be imposed.
p.(None):
p.(None): Article 42
p.(None): If a person, with the intention of obtaining unlawful gains for himself/herself or for a third party, or infringing upon the interests of
p.(None): others, illegally changes or erases personal data files, or otherwise compromises the accuracy of another's personal data files,
p.(None): thereby causing damages to others, the person shall be sentenced to imprisonment for no more than five years or detention, and/or a
p.(None): fine of no more than NT$1 million.
p.(None):
p.(None): Article 43
p.(None): The preceding two articles also apply to nationals of the Republic of China if they commit any offense specified therein outside of the
p.(None): Republic of China against any other national of the Republic of China.
p.(None):
p.(None): Article 44
p.(None): A government official who abuses the power, opportunity or means available to him/her to commit any of the offenses described in
p.(None): this Chapter shall be subject to a more severe punishment which is up to 50% more than that prescribed above.
p.(None):
p.(None): Article 45
p.(None): A person who committed any of the offenses identified in this Chapter shall be indicted only upon a complaint, except for the offenses
p.(None): specified in Article 41 and those identified in Article 42 against a government agency.
p.(None):
p.(None): Article 46
p.(None): If a more severe punishment is provided for under other laws with respect to the offenses identified in this Chapter, the more severe
p.(None): punishment shall take precedence.
p.(None):
p.(None): Article 47
p.(None): If a non-government agency violates any of the following provisions, the central government authority in charge of the industry
p.(None): concerned or the municipality/city/county government concerned shall impose an administrative fine between NT$50,000 and
p.(None): NT$500,000 on the non-government agency and shall order the non-government agency to implement corrective measures within a
...

Health / Motherhood/Family

Searching for indicator family:

Searching for indicator occupation:

Searching for indicator home:

Searching for indicator property:

(return to top)
p.(None): Where a request is made by a data subject to a government or non-government agency pursuant to Article 11, the agency shall
p.(None): determine whether to accept or reject such request within thirty days; such deadline may be extended by up to thirty days if
p.(None): necessary, and the data subject shall be notified in writing of the reason for the extension.
p.(None):
p.(None): Article 14
p.(None): A government or non-government agency may charge a fee to cover necessary costs from those who make an inquiry or request to
p.(None): review or obtain copies of the personal data.
p.(None):
p.(None): Chapter II Data Collection, Processing and Use by a Government Agency
p.(None):
p.(None): Article 15
p.(None): Except for the personal data specified under Paragraph 1, Article 6, the collection or processing of personal data by a government
p.(None): agency shall be for specific purposes and on one of the following bases:
p.(None): 1. where it is within the necessary scope to perform its statutory duties;
p.(None): 2. where consent has been given by the data subject; or
p.(None): 3. where the rights and interests of the data subject will not be infringed upon.
p.(None):
p.(None): Article 16
p.(None): Except for the personal data specified under Paragraph 1, Article 6, a government agency shall use personal data only within the
p.(None): necessary scope of its statutory duties and for the specific purpose of collection; the use of personal data for another purpose shall
p.(None): be only on any of the following bases:
p.(None): 1. where it is expressly required by law;
p.(None): 2. where it is necessary for ensuring national security or furthering public interest;
p.(None): 3. where it is to prevent harm on life, body, freedom, or property of the data subject;
p.(None): 4. where it is to prevent material harm on the rights and interests of others;
p.(None): 5. where it is necessary for statistics gathering or academic research by a government agency or an academic institution for public
p.(None): interests; provided that such data, as processed by the data provider or as disclosed by the data collector, may not lead to the
p.(None): identification of a specific data subject;
p.(None): 6. where it is for the data subject's rights and interests; or
p.(None): 7. where consent has been given by the data subject.
p.(None):
p.(None): Article 17
p.(None): The government agency shall make public the following information online or allow the public to make inquiries thereof via other
p.(None): appropriate means; the foregoing also applies when any changes are made to the following information:
p.(None): 1. the names of the personal data files;
p.(None): 2. the name and contact information of the agency that is in possession of the personal data files;
p.(None): 3. the legal basis and purpose of keeping the personal data files; and
p.(None): 4. the category of the personal data.
p.(None):
p.(None): Article 18
p.(None): The government agency in possession of personal data files shall assign dedicated personnel to implement security and
p.(None): maintenance measures to prevent the personal data from being stolen, altered, damaged, destroyed or disclosed.
p.(None):
p.(None): Chapter III Data Collection, Processing and Use by a Non-government Agency
p.(None):
p.(None): Article 19
p.(None): Except for the personal data specified under Paragraph 1, Article 6, the collection or processing of personal data by a non-
p.(None): government agency shall be for specific purposes and on one of the following bases:
...

p.(None): 4. where it is necessary for statistics gathering or academic research by an academic institution in pursuit of public interests, provided
p.(None): that such data, as processed by the data provider or as disclosed by the data collector, may not lead to the identification of a specific
p.(None): data subject;
p.(None): 5. where consent has been given by the data subject;
p.(None): 6. where it is necessary for furthering public interest;
p.(None): 7. where the personal data is obtained from publicly available sources unless the data subject has an overriding interest in prohibiting
p.(None): the processing or use of such personal data; or
p.(None): 8. where the rights and interests of the data subject will not be infringed upon.
p.(None): A data collector or processor shall, on its own initiative or upon the request of the data subject, erase or cease processing or using
p.(None): the personal data when it becomes aware of, or upon being notified by the data subject, that the processing or use of the personal
p.(None): data should be prohibited pursuant to the proviso to Subparagraph 7 of the preceding paragraph.
p.(None):
p.(None): Article 20
p.(None): Except for the personal data specified in Paragraph 1, Article 6, a non-government agency shall use personal data only within the
p.(None): necessary scope of the specific purpose of collection; the use of personal data for another purpose shall be only on any of the
p.(None): following bases:
p.(None): 1. where it is expressly required by law;
p.(None): 2. where it is necessary for furthering public interests;
p.(None): 3. where it is to prevent harm on life, body, freedom, or property of the data subject;
p.(None): 4. where it is to prevent material harm on the rights and interests of others;
p.(None): 5. where it is necessary for statistics gathering or academic research by a government agency or an academic institution for public
p.(None): interests; provided that such data, as provided by the data provider or disclosed by the data collector, may not lead to the
p.(None): identification of a specific data subject;
p.(None): 6. where consent has been given by the data subject; or
p.(None): 7. where it is for the data subject's rights and interests.
p.(None): When a non-government agency uses personal data for marketing purpose pursuant to the preceding paragraph, upon the data
p.(None): subject's objection to such use, the agency shall cease using the data subject's personal data for marketing.
p.(None): A non-government agency, when using the data subject’s personal data for marketing purpose for the first time, shall provide the data
p.(None): subject of the ways that he/she can object to such use, and the agency shall pay for the fees therefrom.
p.(None):
p.(None): Article 21
p.(None): If a cross-border transfer of personal data is carried out by a non-government agency under any of the following circumstances, the
p.(None): central government authority in charge of the industry concerned may impose restrictions on such transfer:
p.(None): 1. where major national interests are involved;
p.(None): 2. where an international treaty or agreement so stipulates;
p.(None): 3. where the country receiving the personal data lacks proper regulations on protection of personal data and the data subjects' rights
p.(None): and interests may consequently be harmed; or
...

Searching for indicator faith:

(return to top)
p.(None): outputting, connecting or internally transferring data for the purpose of establishing or using a personal data file;
p.(None): 5. "use" refers to the act of using personal data via any methods other than processing;
p.(None): 6. "cross-border transfer" refers to the cross-border processing or use of personal data;
p.(None): 7. "government agency" refers to a central or local government agency or administrative entity authorized to exercise public authority;
p.(None): 8. "non-government agency" refers to a natural person, legal person or group other than those stated in the preceding subparagraph;
p.(None): and
p.(None): 9. "data subject" refers to an individual whose personal data is collected, processed or used.
p.(None):
p.(None): Article 3
p.(None): A data subject shall be able to exercise the following rights with regard to his/her personal data and such rights shall not be waived or
p.(None): limited contractually in advance:
p.(None): 1. the right to make an inquiry of and to review his/her personal data;
p.(None): 2. the right to request a copy of his/her personal data;
p.(None): 3. the right to supplement or correct his/her personal data;
p.(None): 4. the right to demand the cessation of the collection, processing or use of his/her personal data; and
p.(None): 5. the right to erase his/her personal data.
p.(None):
p.(None): Article 4
p.(None): Whoever is commissioned by a government agency or non-government agency to collect, process or use personal data shall be
p.(None): deemed to be acting on behalf of the commissioning agency to the extent that the PDPA applies.
p.(None):
p.(None): Article 5
p.(None): The collection, processing and use of personal data shall be carried out in a way that respects the data subject's rights and interest,
p.(None): in an honest and good-faith manner, shall not exceed the necessary scope of specific purposes, and shall have legitimate and
p.(None): reasonable connections with the purposes of collection.
p.(None):
p.(None): Article 6
p.(None): Data pertaining to a natural person's medical records, healthcare, genetics, sex life, physical examination and criminal records shall
p.(None): not be collected, processed or used unless on any of the following bases:
p.(None): 1. where it is expressly required by law;
p.(None): 2. where it is within the necessary scope for a government agency to perform its statutory duties or for a non-government agency to
p.(None): fulfill its statutory obligation, provided that proper security and maintenance measures are adopted prior or subsequent to such
p.(None): collection, processing or use of personal data;
p.(None): 3. where the personal data has been disclosed to the public by the data subject or has been made public lawfully;
p.(None): 4. where it is necessary for statistics gathering or academic research by a government agency or an academic institution for the
p.(None): purpose of healthcare, public health, or crime prevention, provided that such data, as processed by the data provider or as disclosed
p.(None): by the data collector, may not lead to the identification of a specific data subject;
p.(None): 5. where it is necessary to assist a government agency in performing its statutory duties or a non-government agency in fulfilling its
p.(None): statutory obligations, provided that proper security and maintenance measures are adopted prior or subsequent to such collection,
p.(None): processing, or use of personal data; or
p.(None): 6. where the data subject has consented to the collection, processing and use of his/her personal data in writing, except where the
...

Searching for indicator military:

(return to top)
p.(None):
p.(None): Article 9
p.(None): A government or non-government agency shall, before processing or using the personal data collected in accordance with Article 15
p.(None): or 19 which was not provided by the data subject, inform the data subject of its source of data and other information specified in
p.(None): Subparagraphs 1 to 5, Paragraph 1 of the preceding article.
p.(None): The obligation to inform as prescribed in the preceding paragraph may be exempt under any of the following circumstances:
p.(None): 1. under any of the circumstances provided in Paragraph 2 of the preceding article;
p.(None): 2. where the personal data has been disclosed to the public by the data subject or has been made public lawfully;
p.(None): 3. where it is unable to inform the data subject or his/her statutory representative;
p.(None): 4. where it is necessary for statistics gathering or academic research in pursuit of public interests, provided that such data, as
p.(None): processed by the data provider or as disclosed by the data collector, may not lead to the identification of a specific data subject; or
p.(None): 5. where the personal data is collected by mass communication enterprises for the purpose of news reporting for the benefit of public
p.(None): interests.
p.(None): The obligation to inform as prescribed in Paragraph 1 may be performed at the time of the first use of the personal data towards the
p.(None): data subject.
p.(None):
p.(None): Article 10
p.(None): Upon the request of a data subject, the government or non-government agency shall reply to the data subject's inquiry, allow the data
p.(None): subject to review the personal data collected, or provide the data subject with a copy thereof except under any of the following
p.(None): circumstances:
p.(None): 1. where national security, diplomatic or military secrets, overall economic interests or other material national interests may be
p.(None): harmed;
p.(None): 2. where a government agency may be prevented from performing its statutory duties; or
p.(None): 3. where the material interests of the data collectors or any third parties may be adversely affected.
p.(None):
p.(None): Article 11
p.(None): A government or non-government agency shall ensure the accuracy of personal data in its possession and correct or supplement
p.(None): such data on its own initiative or upon the request of data subjects.
p.(None): In the event of a dispute regarding the accuracy of the personal data, the government or non-government agency shall, on its own
p.(None): initiative or upon the request of the data subject, cease processing or using the personal data, unless the processing or use is either
p.(None): necessary for the performance of an official or business duty, or has been agreed to by the data subject in writing, and the dispute
p.(None): has been recorded.
p.(None): When the specific purpose of data collection no longer exists, or upon expiration of the relevant time period, the government or non-
p.(None): government agency shall, on its own initiative or upon the request of the data subject, erase or cease processing or using the
p.(None): personal data, unless the processing or use is either necessary for the performance of an official or business duty, or has been
p.(None): agreed to by the data subject in writing.
p.(None): A government or non-government agency shall, on its own initiative or upon the request of the data subject, erase the personal data
p.(None): collected or cease collecting, processing or using the personal data in the event where the collection, processing or use of the
p.(None): personal data is in violation of the PDPA.
...

Searching for indicator victim:

(return to top)
p.(None): municipality/city/county governments concerned in accordance with Article 22 may be disclosed to the public if the non-government
p.(None): agencies concerned are not in violation of the PDPA and agree to the public disclosure of such findings.
p.(None):
p.(None): Article 27
p.(None): A non-government agency in possession of personal data files shall implement proper security measures to prevent the personal
p.(None): data from being stolen, altered, damaged, destroyed or disclosed.
p.(None): The central government authorities in charge of the industries concerned may designate and order certain non-government agencies
p.(None): to establish a security and maintenance plan for the protection of personal data files and a guideline on disposing personal data
p.(None): following a business termination.
p.(None): Matters such as standards on setting forth the aforementioned plans and disposal regulations shall be expressly established by the
p.(None): central government authority of in charge of the industry concerned.
p.(None):
p.(None): Chapter IV Damages and Class Action
p.(None):
p.(None): Article 28
p.(None): A government agency shall be liable for the damages arising from injury caused by any unlawful collection, processing or use of
p.(None): personal data, or other infringement on the rights of data subjects due to such government agency's violation of the PDPA, unless
p.(None): such injury was caused by any natural disaster, emergency or other force majeure event.
p.(None): If an injury suffered by the victim is a non-pecuniary damage, he/she may request an appropriate amount of monetary compensation;
p.(None): if the injury suffered by the victim is damage to his/her reputation, the victim may request appropriate corrective measures to restore
p.(None): his/her reputation.
p.(None): Under the circumstances identified in the preceding two paragraphs, if it is difficult or impossible for the victim to prove the monetary
p.(None): value of the actual damage, he/she may ask the court to award the compensation in the amount of at least NT$500 but no more than
p.(None): NT$20,000 per incident, per person based on the severity of the damage.
p.(None): Where the rights of multiple data subjects have been infringed upon due to the same incident, the total amount of compensation
p.(None): awarded to such data subjects shall not exceed NT$200 million. However, if the interests involved in the incident exceed NT$200
p.(None): million, the compensation shall be up to the value of such interests.
p.(None): If the total amount of damages for the injuries attributable to the same incident exceeds the amount referred to in the preceding
p.(None): paragraph, the compensation payable to each victim shall not be limited to the lower end of damages, i.e. NT$500, per incident as
p.(None): set forth in Paragraph 3 of this Article.
p.(None): The right of claim referred to in Paragraph 2 above may not be transferred or inherited. However, this does not apply to the
p.(None): circumstances where monetary compensation has been agreed upon in a contract or a claim therefor has been filed with the court.
p.(None):
p.(None): Article 29
p.(None): A non-government agency shall be liable for the damages arising from any injury caused by any unlawful collection, processing or
p.(None): use of personal data, or other infringement on the rights of data subjects due to such non-government agency's violation of the
p.(None): PDPA, unless the non-government agency can prove that such injury is not caused by its willful act or negligence.
p.(None): Paragraphs 2 to 6 of the preceding article apply to the damage claims raised in accordance with the preceding paragraph.
p.(None):
p.(None): Article 30
p.(None): The right to claim damage compensation will be extinguished if the right-holder does not exercise such right within the two-year
p.(None): period after he/she becomes aware of his/her damage and the identity of the person(s) liable for the compensation, or the five-year
p.(None): period following the occurrence of the damage.
p.(None):
p.(None): Article 31
p.(None): With regard to matters pertaining to damages, aside from the provisions of the PDPA, the State Compensation Law may be applied
p.(None): to a government agency and the Civil Code may be applied to a non-government agency.
p.(None):
p.(None): Article 32
p.(None): An incorporated foundation or an incorporated charity that brings a case to the court in accordance with this Chapter shall fulfill the
p.(None): following criteria:
...

Searching for indicator education:

General/Other / Public Emergency

Searching for indicator emergency:

(return to top)
p.(None): concerned.
p.(None):
p.(None): Article 26
p.(None): The findings of the inspections conducted by the central government authorities in charge of the industries concerned or the
p.(None): municipality/city/county governments concerned in accordance with Article 22 may be disclosed to the public if the non-government
p.(None): agencies concerned are not in violation of the PDPA and agree to the public disclosure of such findings.
p.(None):
p.(None): Article 27
p.(None): A non-government agency in possession of personal data files shall implement proper security measures to prevent the personal
p.(None): data from being stolen, altered, damaged, destroyed or disclosed.
p.(None): The central government authorities in charge of the industries concerned may designate and order certain non-government agencies
p.(None): to establish a security and maintenance plan for the protection of personal data files and a guideline on disposing personal data
p.(None): following a business termination.
p.(None): Matters such as standards on setting forth the aforementioned plans and disposal regulations shall be expressly established by the
p.(None): central government authority of in charge of the industry concerned.
p.(None):
p.(None): Chapter IV Damages and Class Action
p.(None):
p.(None): Article 28
p.(None): A government agency shall be liable for the damages arising from injury caused by any unlawful collection, processing or use of
p.(None): personal data, or other infringement on the rights of data subjects due to such government agency's violation of the PDPA, unless
p.(None): such injury was caused by any natural disaster, emergency or other force majeure event.
p.(None): If an injury suffered by the victim is a non-pecuniary damage, he/she may request an appropriate amount of monetary compensation;
p.(None): if the injury suffered by the victim is damage to his/her reputation, the victim may request appropriate corrective measures to restore
p.(None): his/her reputation.
p.(None): Under the circumstances identified in the preceding two paragraphs, if it is difficult or impossible for the victim to prove the monetary
p.(None): value of the actual damage, he/she may ask the court to award the compensation in the amount of at least NT$500 but no more than
p.(None): NT$20,000 per incident, per person based on the severity of the damage.
p.(None): Where the rights of multiple data subjects have been infringed upon due to the same incident, the total amount of compensation
p.(None): awarded to such data subjects shall not exceed NT$200 million. However, if the interests involved in the incident exceed NT$200
p.(None): million, the compensation shall be up to the value of such interests.
p.(None): If the total amount of damages for the injuries attributable to the same incident exceeds the amount referred to in the preceding
p.(None): paragraph, the compensation payable to each victim shall not be limited to the lower end of damages, i.e. NT$500, per incident as
p.(None): set forth in Paragraph 3 of this Article.
p.(None): The right of claim referred to in Paragraph 2 above may not be transferred or inherited. However, this does not apply to the
...

General/Other / Relationship to Authority

Searching for indicator authority:

(return to top)
p.(None):
p.(None): Article 2
p.(None): The terms used herein denote the following meanings:
p.(None): 1. "personal data" refers to a natural person's name, date of birth, ID Card number, passport number, features, fingerprints, marital
p.(None): status, family information, education background, occupation, medical records, healthcare data, genetic data, data concerning a
p.(None): person's sex life, records of physical examination, criminal records, contact information, financial conditions, data concerning a
p.(None): person's social activities and any other information that may be used to directly or indirectly identify a natural person;
p.(None): 2. a "personal data file" refers to a collection of personal data structured to facilitate data retrieval and management by automated or
p.(None): non-automated means;
p.(None): 3. "collection" refers to the act of collecting personal data in any way;
p.(None): 4. "processing" refers to the act of recording, inputting, storing, compiling/editing, correcting, duplicating, retrieving, deleting,
p.(None): outputting, connecting or internally transferring data for the purpose of establishing or using a personal data file;
p.(None): 5. "use" refers to the act of using personal data via any methods other than processing;
p.(None): 6. "cross-border transfer" refers to the cross-border processing or use of personal data;
p.(None): 7. "government agency" refers to a central or local government agency or administrative entity authorized to exercise public authority;
p.(None): 8. "non-government agency" refers to a natural person, legal person or group other than those stated in the preceding subparagraph;
p.(None): and
p.(None): 9. "data subject" refers to an individual whose personal data is collected, processed or used.
p.(None):
p.(None): Article 3
p.(None): A data subject shall be able to exercise the following rights with regard to his/her personal data and such rights shall not be waived or
p.(None): limited contractually in advance:
p.(None): 1. the right to make an inquiry of and to review his/her personal data;
p.(None): 2. the right to request a copy of his/her personal data;
p.(None): 3. the right to supplement or correct his/her personal data;
p.(None): 4. the right to demand the cessation of the collection, processing or use of his/her personal data; and
p.(None): 5. the right to erase his/her personal data.
p.(None):
p.(None): Article 4
p.(None): Whoever is commissioned by a government agency or non-government agency to collect, process or use personal data shall be
p.(None): deemed to be acting on behalf of the commissioning agency to the extent that the PDPA applies.
p.(None):
p.(None): Article 5
p.(None): The collection, processing and use of personal data shall be carried out in a way that respects the data subject's rights and interest,
p.(None): in an honest and good-faith manner, shall not exceed the necessary scope of specific purposes, and shall have legitimate and
p.(None): reasonable connections with the purposes of collection.
p.(None):
p.(None): Article 6
p.(None): Data pertaining to a natural person's medical records, healthcare, genetics, sex life, physical examination and criminal records shall
p.(None): not be collected, processed or used unless on any of the following bases:
...

p.(None): necessary scope of the specific purpose of collection; the use of personal data for another purpose shall be only on any of the
p.(None): following bases:
p.(None): 1. where it is expressly required by law;
p.(None): 2. where it is necessary for furthering public interests;
p.(None): 3. where it is to prevent harm on life, body, freedom, or property of the data subject;
p.(None): 4. where it is to prevent material harm on the rights and interests of others;
p.(None): 5. where it is necessary for statistics gathering or academic research by a government agency or an academic institution for public
p.(None): interests; provided that such data, as provided by the data provider or disclosed by the data collector, may not lead to the
p.(None): identification of a specific data subject;
p.(None): 6. where consent has been given by the data subject; or
p.(None): 7. where it is for the data subject's rights and interests.
p.(None): When a non-government agency uses personal data for marketing purpose pursuant to the preceding paragraph, upon the data
p.(None): subject's objection to such use, the agency shall cease using the data subject's personal data for marketing.
p.(None): A non-government agency, when using the data subject’s personal data for marketing purpose for the first time, shall provide the data
p.(None): subject of the ways that he/she can object to such use, and the agency shall pay for the fees therefrom.
p.(None):
p.(None): Article 21
p.(None): If a cross-border transfer of personal data is carried out by a non-government agency under any of the following circumstances, the
p.(None): central government authority in charge of the industry concerned may impose restrictions on such transfer:
p.(None): 1. where major national interests are involved;
p.(None): 2. where an international treaty or agreement so stipulates;
p.(None): 3. where the country receiving the personal data lacks proper regulations on protection of personal data and the data subjects' rights
p.(None): and interests may consequently be harmed; or
p.(None): 4. where the cross-border transfer of the personal data to a third country (territory) is carried out to circumvent the PDPA.
p.(None):
p.(None): Article 22
p.(None): The central government authorities in charge of the industries concerned or the municipality/city/county governments concerned may,
p.(None): when they deem necessary or suspect any possible violation of the PDPA, inspect compliance with the security control measures, the
p.(None): guidelines on disposing personal data upon business termination, and the restrictions on cross-border transfers, or conduct any other
p.(None): routine inspections by having their staff enter non-government agencies' premises upon presentation of their official identification
p.(None): documents and order relevant personnel at the non-government agencies to provide necessary explanations, cooperate on adopting
p.(None): relevant measures, or provide supporting documents.
p.(None): When the central government authorities in charge of the industries concerned or the municipality/city/county governments concerned
p.(None): conduct the inspections described in the preceding Paragraph, they may retain or make duplications of the personal data or the files
p.(None): thereof that can be confiscated or be admitted as evidence. The owner, holder or keeper of such data or files that shall be confiscated
p.(None): or copied shall submit them to the authorities upon request. If the non-government agency refuses to submit or deliver the requested
p.(None): data or files or rejects the confiscation or duplication thereof without any legitimate reason, a compulsory enforcement that will do the
p.(None): least harm to the rights and interests of the non-government agency may be applied.
p.(None): When the central government authorities in charge of the industries concerned or the municipality/city/county governments concerned
p.(None): conduct the inspections described in Paragraph 1, professionals in the field of information technology, telecommunications or law
p.(None): may accompany the inspectors during the inspections.
p.(None): Non-government agencies and their personnel may not evade such inspections, obstruct the investigators from accessing the
p.(None): premises or data, or refuse to comply with the inspections or decisions referred to in Paragraphs 1 and 2.
p.(None): All personnel who take part in the inspections shall keep in confidence all the personal data that they become aware of due to the
p.(None): inspections.
p.(None):
p.(None): Article 23
p.(None): The confiscated files or duplicates referred to in Paragraph 2 of the preceding article shall be sealed or tagged and properly handled;
p.(None): if it is unfeasible to move or take possession of such files, the authority shall assign personnel to guard such files or order the owner
p.(None): of such files or an appropriate person to take possession of the files.
p.(None): If it is no longer necessary to keep the confiscated files or the duplicates, or the authority has decided not to impose any penalties or
p.(None): confiscate any files, the confiscated files and duplicates shall be returned except for the files or duplicates that shall be confiscated or
p.(None): kept for the investigation of other cases.
p.(None):
p.(None): Article 24
p.(None): The non-government agency, owner, holder, keeper or interested persons of those confiscated files or duplicates may raise an
p.(None): objection with the central government authority in charge of the industry concerned or the municipality/city/county government
p.(None): concerned against the acts of demand, compulsory enforcement, detention, or duplication mentioned in the preceding two Articles.
p.(None): Upon receiving the objection mentioned in the preceding paragraph, the central government authority in charge of the industry
p.(None): concerned or the municipality/city/county government concerned shall immediately cease or rectify such acts if the objection is
p.(None): considered reasonable; otherwise, it may continue such acts. Upon the request of the person who raises the objection, a record of
p.(None): the objection reasons shall be prepared and delivered to such person.
p.(None): An appeal against the decision made by the central government authority in charge of the industry concerned or the
p.(None): municipality/city/county government concerned under the preceding paragraph may only be filed jointly with the appeal against the
p.(None): substantive decision of the case. However, if the persons identified in Paragraph 1 do not have the rights to appeal against the
p.(None): substantive decision of the case under the law, such persons may file an administrative lawsuit solely against the acts identified in the
p.(None): same Paragraph1.
p.(None):
p.(None): Article 25
p.(None): In the event that a non-government agency has violated the PDPA, the central government authority in charge of the industry
p.(None): concerned or the municipality/city/county government concerned may impose fines on the non-government agency in accordance
p.(None): with the PDPA and may also enforce the following corrective measures:
p.(None): 1. prohibit the collection, processing or use of the personal data;
p.(None): 2. order the erasure of the processed personal data and personal data files;
p.(None): 3. confiscate or order the destruction of the unlawfully collected personal data; and/or
p.(None): 4. disclose to the public the violation of the non-government agency, the name of the non-government agency and its responsible
p.(None): person/representative.
p.(None): Where the central government authority in charge of the industry concerned or the municipality/city/county government concerned
p.(None): enforce the corrective measures referred to in the preceding paragraph, such measures shall be within the scope that is necessary to
p.(None): prevent and remedy the violation of the PDPA and shall do the least harm to the rights and interests of the non-government agency
p.(None): concerned.
p.(None):
p.(None): Article 26
p.(None): The findings of the inspections conducted by the central government authorities in charge of the industries concerned or the
p.(None): municipality/city/county governments concerned in accordance with Article 22 may be disclosed to the public if the non-government
p.(None): agencies concerned are not in violation of the PDPA and agree to the public disclosure of such findings.
p.(None):
p.(None): Article 27
p.(None): A non-government agency in possession of personal data files shall implement proper security measures to prevent the personal
p.(None): data from being stolen, altered, damaged, destroyed or disclosed.
p.(None): The central government authorities in charge of the industries concerned may designate and order certain non-government agencies
p.(None): to establish a security and maintenance plan for the protection of personal data files and a guideline on disposing personal data
p.(None): following a business termination.
p.(None): Matters such as standards on setting forth the aforementioned plans and disposal regulations shall be expressly established by the
p.(None): central government authority of in charge of the industry concerned.
p.(None):
p.(None): Chapter IV Damages and Class Action
p.(None):
p.(None): Article 28
p.(None): A government agency shall be liable for the damages arising from injury caused by any unlawful collection, processing or use of
p.(None): personal data, or other infringement on the rights of data subjects due to such government agency's violation of the PDPA, unless
p.(None): such injury was caused by any natural disaster, emergency or other force majeure event.
p.(None): If an injury suffered by the victim is a non-pecuniary damage, he/she may request an appropriate amount of monetary compensation;
p.(None): if the injury suffered by the victim is damage to his/her reputation, the victim may request appropriate corrective measures to restore
p.(None): his/her reputation.
p.(None): Under the circumstances identified in the preceding two paragraphs, if it is difficult or impossible for the victim to prove the monetary
p.(None): value of the actual damage, he/she may ask the court to award the compensation in the amount of at least NT$500 but no more than
p.(None): NT$20,000 per incident, per person based on the severity of the damage.
p.(None): Where the rights of multiple data subjects have been infringed upon due to the same incident, the total amount of compensation
p.(None): awarded to such data subjects shall not exceed NT$200 million. However, if the interests involved in the incident exceed NT$200
p.(None): million, the compensation shall be up to the value of such interests.
...

p.(None): his/her delegation of litigation rights before the deadline for filing an appeal by such incorporated foundation or incorporated charity,
p.(None): and then file the appeal himself/herself.
p.(None): After receiving the original copy of the judgment, the incorporated foundation or the incorporated charity shall notify the data subjects
p.(None): of the outcome and also notify the data subjects in writing within seven days as to whether or not an appeal will be filed.
p.(None): Article 39
p.(None): The incorporated foundation or the incorporated charity shall deduct the necessary litigation fees from the compensation awarded in
p.(None): accordance with the result of the lawsuit filed pursuant to Article 34, and deliver the remaining amount to the data subjects that
p.(None): delegate the litigation rights.
p.(None): The incorporated foundation or the incorporated charity may not ask for remuneration for the lawsuit filed in accordance with
p.(None): Paragraph 1 of Article 34.
p.(None):
p.(None): Article 40
p.(None): The incorporated foundation or the incorporate charity that filed a lawsuit in accordance with the provisions of this Chapter shall
p.(None): engage an attorney as its agent ad litem for the lawsuit.
p.(None):
p.(None): Chapter V Penalties
p.(None):
p.(None): Article 41
p.(None): If a person, with the intention of obtaining unlawful gains for himself/herself or a third party, or with the intention of impairing another
p.(None): person's interests, is in violation of Paragraph 1, Article 6, Articles 15, 16, 19, and Paragraph 1, Article 20, or an order or decision
p.(None): relating to the restrictions on cross-border transfers made by the central government authority in charge of the industry concerned in
p.(None): accordance with Article 21 of the PDPA, thereby causing damage to others, the person shall be sentenced to imprisonment for no
p.(None): more than five years; in addition thereto, a fine of no more than NT$1million may be imposed.
p.(None):
p.(None): Article 42
p.(None): If a person, with the intention of obtaining unlawful gains for himself/herself or for a third party, or infringing upon the interests of
p.(None): others, illegally changes or erases personal data files, or otherwise compromises the accuracy of another's personal data files,
p.(None): thereby causing damages to others, the person shall be sentenced to imprisonment for no more than five years or detention, and/or a
p.(None): fine of no more than NT$1 million.
p.(None):
p.(None): Article 43
p.(None): The preceding two articles also apply to nationals of the Republic of China if they commit any offense specified therein outside of the
p.(None): Republic of China against any other national of the Republic of China.
p.(None):
p.(None): Article 44
p.(None): A government official who abuses the power, opportunity or means available to him/her to commit any of the offenses described in
p.(None): this Chapter shall be subject to a more severe punishment which is up to 50% more than that prescribed above.
p.(None):
p.(None): Article 45
p.(None): A person who committed any of the offenses identified in this Chapter shall be indicted only upon a complaint, except for the offenses
p.(None): specified in Article 41 and those identified in Article 42 against a government agency.
p.(None):
p.(None): Article 46
p.(None): If a more severe punishment is provided for under other laws with respect to the offenses identified in this Chapter, the more severe
p.(None): punishment shall take precedence.
p.(None):
p.(None): Article 47
p.(None): If a non-government agency violates any of the following provisions, the central government authority in charge of the industry
p.(None): concerned or the municipality/city/county government concerned shall impose an administrative fine between NT$50,000 and
p.(None): NT$500,000 on the non-government agency and shall order the non-government agency to implement corrective measures within a
p.(None): specified period of time; if the non-government agency fails to do so, a fine shall be imposed each time the violation occurs:
p.(None): 1. Paragraph 1, Article 6;
p.(None): 2. Article 19;
p.(None): 3. Paragraph 1, Article 20; and/or
p.(None): 4. an order or decision relating to the restrictions on cross-border transfers made by the central government authority in charge of the
p.(None): industry concerned under Article 21.
p.(None):
p.(None): Article 48
p.(None): If a non-government agency violates any of the following provisions, the central government authority in charge of the industry
p.(None): concerned or the municipality/city/county government concerned may order the non-government agency to rectify the violation within
p.(None): a specified period of time; if the non-government agency fails to rectify the violation in time, a fine between NT$20,000 and
p.(None): NT$200,000 shall be imposed on the non-government agency for each occurrence of the violation:
p.(None): 1. Article 8 or Article 9;
p.(None): 2. Article 10, Article 11, Article 12, or Article 13;
p.(None): 3. Paragraph 2 or Paragraph 3, Article 20; and/or
p.(None): 4. Paragraph 1, Article 27, or failure to establish a security and maintenance plan for the protection of personal data files or a
p.(None): guideline on disposing personal data following a business termination under Paragraph 2, Article 27.
p.(None):
p.(None): Article 49
p.(None): If a non-government agency is in violation of Paragraph 4, Article 22 without any legitimate reason, the central government authority
p.(None): in charge of the industry concerned or the municipality/city/county government concerned shall impose an administrative fine between
p.(None): NT$20,000 and NT$200,000 on the non-government agency.
p.(None):
p.(None): Article 50
p.(None): The representative, manager, or any other authorized representative of a non-government agency shall be fined the same amount
p.(None): imposed on the non-government agency for a violation of any of the preceding three articles, unless said person proves that he/she
p.(None): has exercised due care to prevent such violation.
p.(None):
p.(None): Chapter VI Supplementary Provisions
p.(None):
p.(None): Article 51
p.(None): The PDPA does not apply to the following circumstances:
p.(None): 1. where personal data is being collected, processed, or used by a natural person purely for purposes of personal or household
p.(None): activities; or
p.(None): 2. where audio-visual data is collected, processed, or used in public places or public activities and not connected to other personal
p.(None): data.
p.(None): The PDPA also applies to the government and the non-government agencies outside the territory of the Republic of China (R.O.C)
p.(None): when they collect, process or use the personal data of the R.O.C. nationals.
p.(None):
p.(None): Article 52
p.(None): The duties of the central government authorities in charge of the industries concerned or the municipality/city/county governments
p.(None): concerned under Articles 22 to 26 may be delegated to their subordinate agencies, other agencies or public interest groups. The
p.(None): personnel of such agencies or public interest groups shall be obligated to keep confidential all the data they become aware of during
p.(None): the performance of the duties so delegated or commissioned.
...

p.(None): specific purposes and categories of personal data, and provide the same to government and non-government agencies for reference
p.(None): and use.
p.(None):
p.(None): Article 54
p.(None): After the enactment of the amendments to the PDPA on December 15, 2015, if any personal data was furnished before the
p.(None): amendments to the PDPA on May 26, 2010, not by the data subject, the data subject shall be provided with the information required
p.(None): under Article 9 before such personal data is processed or used,.
p.(None): The obligation to inform as prescribed in the preceding paragraph may be given at the time when such personal data is used for the
p.(None): first time after the enactment of the amendments to the PDPA on December 15, 2015.
p.(None): Any use of personal data without the information provided in accordance with the preceding two paragraphs shall be deemed and
p.(None): punished as a violation of Article 9.
p.(None):
p.(None): Article 55
p.(None): The Enforcement Rule of the PDPA shall be prescribed by the Ministry of Justice.
p.(None):
p.(None): Article 56
p.(None): The enforcement date of the PDPA shall be set by the Executive Yuan.
p.(None): The deletion of Articles 19 to 22 and Article 43 under the pre-amendment PDPA becomes effective on the date of promulgation.
p.(None): If the date of promulgation as referred to in the preceding paragraph falls within the six month period within which the enterprises,
p.(None): groups or individuals designated in Paragraph 2 of Article 43 under the pre-amended PDPA are required to complete the registration
p.(None): or obtain the permit, such designated enterprises, groups or individuals may file an application to terminate the registration process.
p.(None): Upon the termination, the government authority in charge of the industry concerned shall refund the fees that have been paid. Those
p.(None): who have completed the registration may also apply for the refund.
p.(None): The fees referred to in the preceding paragraph shall be refunded together with the total daily interest incurred from the date of
p.(None): payment by the applicant to the date of the termination by the government authority based on the fixed annual interest rate for a one-
p.(None): year time deposit announced by the Department of Savings and Remittances, Chunghwa Post Co., Ltd. on the date of the payment.
p.(None): The same applies to the refund where the registration process has been completed. The interest thereon shall be incurred from the
p.(None): date of payment of the fee to the date when the government authority in charge of the industry concerned approves the registration.
p.(None):
p.(None):
p.(None):
p.(None): News Law Convention
p.(None): Searching Justices of the Constitutional Court
p.(None):
p.(None):
p.(None): E-PAPER
p.(None): enter your email address
p.(None):
p.(None):
p.(None): Subscribe
p.(None):
p.(None):
p.(None): Unsubscribe
p.(None):
p.(None):
p.(None):
p.(None): This website does not provide legal counseling service, please contact with related public offices for more information.
p.(None): In case of any discrepancy between the English version and the Chinese version, the latter shall prevail.
p.(None):
p.(None):
p.(None): │ Government Website Open Information Announcement │ Declaration on Privacy Right Protection │ Information Security Policy │ EMail │
p.(None): OPERATING BY THE WORKING GROUP OF THE R.O.C LAWS & REGULATIONS DATABASE, MINISTRY OF JUSTICE.
p.(None): NO. 130, Sec. 1, Chongqing S. Rd., Taipei, 10048, Taiwan(R.O.C.)
p.(None): Service Phone-Call: +886-2-2191-0189
...

Orphaned Trigger Words

p.(None): processing, or use of personal data; or
p.(None): 6. where the data subject has consented to the collection, processing and use of his/her personal data in writing, except where the
p.(None): collection, processing or use exceeds the necessary scope of the specific purpose, or where the collection, processing or use based
p.(None): solely on the consent of the data subject is otherwise prohibited by law, or where such consent is not given by the data subject out of
p.(None): his/her free will.
p.(None): Articles 8 and 9 shall apply mutatis mutandis to the collection, processing, or use of personal data in accordance with the preceding
p.(None): paragraph; Paragraphs 1, 2 and 4 of Article 7 shall apply mutatis mutandis to the consent required under Subparagraph 6 of the
p.(None): preceding paragraph.
p.(None):
p.(None): Article 7
p.(None): "Consent", as referred to in Subparagraph 2, Paragraph 1, Article 15 and Subparagraph 5, Paragraph 1, Article 19, means a
p.(None): declaration of agreement given by a data subject after he/she has been informed by the data collector of the information required
p.(None): under the PDPA.
p.(None): "Consent", as referred to in Subparagraph 7, Paragraph 1, Article 16 and Subparagraph 6, Paragraph 1, Article 20, means a separate
p.(None): declaration of agreement given by a data subject after he/she has been informed by the data collector of any of the purposes other
p.(None): than that originally specified, the scope of other use, and the impact of giving or not giving consent on the rights and interests of the
p.(None): data subject.
p.(None): The data subject's consent may be presumed given pursuant to Subparagraph 2, Paragraph 1, Article 15 and Subparagraph 5,
p.(None): Paragraph 1, Article 19 if the data subject does not indicate his/her objection and affirmatively provides his/her personal data after the
p.(None): government or non-government agency has informed the data subject of the relevant information specified in Paragraph 1, Article 8 of
p.(None): the PDPA.
p.(None): Data collector shall bear the burden of proof regarding the fact that data subject has given the consent prescribed under the PDPA.
p.(None):
p.(None): Article 8
p.(None): A government or non-government agency shall expressly inform the data subject of the following information when colleting their
p.(None): personal data in accordance with Article 15 or 19 of the PDPA:
p.(None): 1. the name of the government or non-government agency;
p.(None): 2. the purpose of the collection;
p.(None): 3. the categories of the personal data to be collected;
p.(None): 4. the time period, territory, recipients, and methods of which the personal data is used;
p.(None): 5. the data subject's rights under Article 3 and the methods for exercising such rights; and
p.(None): 6. the data subject's rights and interests that will be affected if he/she elects not to provide his/her personal data.
p.(None): The obligation to inform as prescribed in the preceding paragraph may be waived under any of the following circumstances:
p.(None): 1. where notification may be waived in accordance with the law;
p.(None): 2. where the collection of personal data is necessary for the government agency to perform its statutory duties or the non-government
p.(None): agency to fulfill its statutory obligation;
p.(None): 3. where giving notice will prevent the government agency from performing its statutory duties;
p.(None): 4. where giving notice will harm public interests;
p.(None): 5. where the data subject has already known the content of the notification; or
p.(None): 6. where the collection of personal data is for non-profit purposes and clearly has no adverse effect on the data subject.
p.(None):
p.(None): Article 9
p.(None): A government or non-government agency shall, before processing or using the personal data collected in accordance with Article 15
p.(None): or 19 which was not provided by the data subject, inform the data subject of its source of data and other information specified in
p.(None): Subparagraphs 1 to 5, Paragraph 1 of the preceding article.
p.(None): The obligation to inform as prescribed in the preceding paragraph may be exempt under any of the following circumstances:
p.(None): 1. under any of the circumstances provided in Paragraph 2 of the preceding article;
p.(None): 2. where the personal data has been disclosed to the public by the data subject or has been made public lawfully;
p.(None): 3. where it is unable to inform the data subject or his/her statutory representative;
p.(None): 4. where it is necessary for statistics gathering or academic research in pursuit of public interests, provided that such data, as
p.(None): processed by the data provider or as disclosed by the data collector, may not lead to the identification of a specific data subject; or
p.(None): 5. where the personal data is collected by mass communication enterprises for the purpose of news reporting for the benefit of public
p.(None): interests.
p.(None): The obligation to inform as prescribed in Paragraph 1 may be performed at the time of the first use of the personal data towards the
p.(None): data subject.
p.(None):
p.(None): Article 10
p.(None): Upon the request of a data subject, the government or non-government agency shall reply to the data subject's inquiry, allow the data ...

p.(None):
p.(None): Article 50
p.(None): The representative, manager, or any other authorized representative of a non-government agency shall be fined the same amount
p.(None): imposed on the non-government agency for a violation of any of the preceding three articles, unless said person proves that he/she
p.(None): has exercised due care to prevent such violation.
p.(None):
p.(None): Chapter VI Supplementary Provisions
p.(None):
p.(None): Article 51
p.(None): The PDPA does not apply to the following circumstances:
p.(None): 1. where personal data is being collected, processed, or used by a natural person purely for purposes of personal or household
p.(None): activities; or
p.(None): 2. where audio-visual data is collected, processed, or used in public places or public activities and not connected to other personal
p.(None): data.
p.(None): The PDPA also applies to the government and the non-government agencies outside the territory of the Republic of China (R.O.C)
p.(None): when they collect, process or use the personal data of the R.O.C. nationals.
p.(None):
p.(None): Article 52
p.(None): The duties of the central government authorities in charge of the industries concerned or the municipality/city/county governments
p.(None): concerned under Articles 22 to 26 may be delegated to their subordinate agencies, other agencies or public interest groups. The
p.(None): personnel of such agencies or public interest groups shall be obligated to keep confidential all the data they become aware of during
p.(None): the performance of the duties so delegated or commissioned.
p.(None): The public interest groups referred to in the preceding paragraph shall not receive any data subject's delegation of litigation rights to
p.(None): file a lawsuit for damages in their names in accordance with Paragraph 1 of Article 34.
p.(None):
p.(None): Article 53
p.(None): The Ministry of Justice shall, in conjunction with the central government authorities in charge of the industries concerned, set forth the
p.(None): specific purposes and categories of personal data, and provide the same to government and non-government agencies for reference
p.(None): and use.
p.(None):
p.(None): Article 54
p.(None): After the enactment of the amendments to the PDPA on December 15, 2015, if any personal data was furnished before the
p.(None): amendments to the PDPA on May 26, 2010, not by the data subject, the data subject shall be provided with the information required
p.(None): under Article 9 before such personal data is processed or used,.
p.(None): The obligation to inform as prescribed in the preceding paragraph may be given at the time when such personal data is used for the
p.(None): first time after the enactment of the amendments to the PDPA on December 15, 2015.
p.(None): Any use of personal data without the information provided in accordance with the preceding two paragraphs shall be deemed and
p.(None): punished as a violation of Article 9.
p.(None):
p.(None): Article 55
p.(None): The Enforcement Rule of the PDPA shall be prescribed by the Ministry of Justice.
p.(None):
p.(None): Article 56
p.(None): The enforcement date of the PDPA shall be set by the Executive Yuan.
p.(None): The deletion of Articles 19 to 22 and Article 43 under the pre-amendment PDPA becomes effective on the date of promulgation.
p.(None): If the date of promulgation as referred to in the preceding paragraph falls within the six month period within which the enterprises,
p.(None): groups or individuals designated in Paragraph 2 of Article 43 under the pre-amended PDPA are required to complete the registration
p.(None): or obtain the permit, such designated enterprises, groups or individuals may file an application to terminate the registration process. ...

Appendix

Indicator List

Indicator	Vulnerability
authority	Relationship to Authority
crime	Illegal Activity
criminal	criminal
education	education
emergency	Public Emergency
faith	Religion
family	Motherhood/Family
home	Property Ownership
military	Soldier
occupation	Occupation
party	political affiliation
property	Property Ownership
unlawful	Illegal Activity
victim	Victim of Abuse

Indicator Peers (Indicators in Same Vulnerability)

Indicator	Peers
crime	['unlawful']
home	['property']
property	['home']
unlawful	['crime']

Trigger Words

consent

harm

justice

protection

Applicable Type / Vulnerability / Indicator Overlay for this Input

Vulnerability Type	Vulnerability	Indicator	# Matches
Political	Illegal Activity	crime	1
Political	Illegal Activity	unlawful	4
Political	criminal	criminal	2
Political	political affiliation	party	4
Health	Motherhood/Family	family	1
Social	Occupation	occupation	1
Social	Property Ownership	home	1
Social	Property Ownership	property	2
Social	Religion	faith	1
Social	Soldier	military	1
Social	Victim of Abuse	victim	5
Social	education	education	1
General/Other	Public Emergency	emergency	1
General/Other	Relationship to Authority	authority	18

Personal Information Protection Act

Applicable Type / Vulnerability / Indicator Overlay for this Input

Political / Illegal Activity

Political / criminal

Political / political affiliation

Health / Motherhood/Family

Social / Occupation

Social / Property Ownership

Social / Religion

Social / Soldier

Social / Victim of Abuse

Social / education

General/Other / Public Emergency

General/Other / Relationship to Authority

Orphaned Trigger Words

Appendix

Indicator List

Indicator Peers (Indicators in Same Vulnerability)

Trigger Words

Applicable Type / Vulnerability / Indicator Overlay for this Input