TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
• the obligation for government agencies and non- government agencies to implement response measures, maintain records of incidents, and report personal data breaches, along with the revision of the conditions for notifying the affected parties; and • transition of supervisory authority – the amend - ments establish transitional arrangements for the gradual transfer of supervisory authority over non- governmental agencies’ personal data protection matters to the PDPC. During the transition period, designated central or local authorities will con - tinue to exercise supervisory powers, which will be progressively assumed by the PDPC. The relevant competent authorities will continue to administer industry-specific data protection regulations and may prescribe more stringent requirements. For clarity, unless otherwise referred to, the PDPA referred to herein will be the version amended and passed on 11 November 2025. The national system in respect of data protection adopts an “APEC-EU referential” approach. The meet - ing minutes of the Executive Yuan in connection with the approval to submit the draft bill of the PDPA to the Legislative Yuan addressed that the PDPA incor - porates certain provisions under Directive 95/46/EC. As one of APEC’s member economies, Taiwan has executed the APEC Privacy Framework, which indi - cates nine principles in respect of privacy protection; the PDPA also incorporates the principles guided by the APEC Privacy Framework. In 2011, APEC developed the Cross-Border Privacy Rules (CBPR) system, under which companies trad - ing within the member economies develop their own internal business rules consistent with the APEC pri - vacy principles to secure cross-border data privacy. Taiwan joined the CBPR system in December 2018, with the Institution for Information Industry applying to be the Accountability Agent under the system. In June 2021, the Institute for Information Industry was recognised by APEC as the Accountability Agent for CBPR verification in Taiwan for domestic enterprises. Taiwan also joined the EU-led Joint Declaration on Pri - vacy and the Protection of Personal Data in October
2022. The declaration is intended to foster interna - tional co-operation to promote high data protection and privacy standards. Taiwan’s inclusion will allow strengthening exchanges and co-operation with EU and Indo-Pacific countries. Furthermore, in seeking an “adequacy decision” from the European Commission, the Personal Data Protec - tion Office has filed the evaluation reports required for GDPR adequacy status; the application is still under review and discussion. All major laws regulating pri - vacy and personal data protection are at the national level. The relevant regulations at the sub-national lev - el are solely relevant to the implementation of those national laws and regulations by the different function - ing bureaus of local government. Additionally, certain competent authorities have established specific regu - lations requiring security and maintenance plans for the protection of personal data within the industries under their supervision. These regulations are appli - cable to each specific industry. The PDPA provides for extraterritorial application under defined circumstances. It applies to both gov - ernment agencies and non-government entities that, outside the territory of Taiwan, collect, process or use the personal data of Taiwanese nationals. Accordingly, the territorial scope of the PDPA is extended based on the nationality of the data subject, irrespective of the location where the data-related activities are con - ducted. Furthermore, criminal liability for intentional violations is established by specified provisions of the PDPA, including unlawful collection, processing, use, altera - tion or deletion of personal data, where such conduct is undertaken for the purpose of obtaining unlawful benefits for oneself or a third party, or of harming the interests of others, and where such conduct results in actual damage. The law expressly provides for extraterritorial criminal jurisdiction by stipulating that when Taiwanese nationals commit the aforementioned offences against other Taiwanese nationals outside the territory of Taiwan, the PDPA shall likewise apply. In conclusion, the PDPA has extraterritorial effect where personal data relating to Taiwanese nationals is handled abroad, and where Taiwanese nationals
478 CHAMBERS.COM
Powered by FlippingBook