TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
engage in specified misconduct involving personal data against other Taiwanese nationals outside Tai - wan, thereby subjecting such conduct to the regulato - ry and criminal enforcement mechanisms of the PDPA. Artificial Intelligence Fundamental Act and Interplay Between AI and Data Protection Regulations Taiwan’s government also acknowledges the rapid development of emerging technologies, such as AI, and the complex data-related challenges these inno - vations bring. As a result, the government is also con - tinuously revisiting and examining whether the current regulatory regime could duly catch all new relevant technologies. Under the AI trend, the Artificial Intelli - gence Fundamental Act was passed by Taiwan’s Leg - islative Yuan on 23 December 2025, and sets out a framework for the development and deployment of AI, guided by seven key principles: “Sustainable Devel - opment and Welfare”, “Human Autonomy”, “Privacy Protection and Data Governance”, “Cybersecurity and Safety”, “Transparency and Explainability”, “Fairness and Non-discrimination” and “Accountability”. These principles are designed to ensure that AI technologies are developed in a responsible and ethical manner, balancing innovation with public trust and societal well-being. Among these, the principle of Privacy Protection and Data Governance plays a critical role in safeguarding individuals’ rights in the face of rapidly advancing AI technologies. The Act specifically mandates that AI development must prioritise the protection of personal data privacy, reflecting a commitment to constitutional privacy rights. This includes a focus on minimising the collection and use of personal data, ensuring that only data which is necessary for AI purposes is gath - ered. By adopting the data minimisation principle, the law seeks to prevent unnecessary data collection that could increase the risk of privacy breaches or misuse. The interplay between AI and data protection regula - tions is critical in ensuring that AI technologies do not infringe on privacy rights or create unintended security risks. As AI relies heavily on large datasets to make predictions and decisions, there are significant con - cerns about how this data is managed. The Artificial Intelligence Fundamental Act seeks to ensure that AI
systems adhere to stringent data protection principles while also driving innovation. Following the enactment of the Artificial Intelligence Fundamental Act and the announcement of the core principles thereunder, it is anticipated that the Tai - wan authorities will further promulgate implementing regulations and establish a more comprehensive and structured regulatory regime in line with the continued development, deployment and utilisation of artificial intelligence technologies. 1.2 Rights and Obligations General Principles and Data Subject Rights Under the PDPA Principles and requirements for personal data pro - cessing include the following. • Lawfulness and purpose limitation – personal data should only be collected, processed and used for specific, legitimate purposes. In principle, data should only be processed within the defined scope and not retained longer than the period initially communicated to the data subject. Any further processing for new purposes requires additional consent or a lawful basis. • Ensure accuracy of personal data – the accuracy of personal data must be ensured, and it should be corrected or supplemented when necessary, either proactively or upon the request of the data subject. • Transparency – data subjects should be fully informed about the collection of their data. This includes, among others, detailing who is collecting the data, the purpose behind the collection, what types of data are being gathered and how it will be used. Additionally, data subjects should be made aware of their rights, such as access, correction and deletion of their personal data. • Security and confidentiality – appropriate secu - rity measures must be in place to prevent per - sonal data from being stolen, altered, damaged, destroyed or disclosed. • Respect for data subject rights – the rights of individuals to access, correct or erase their per - sonal data must be respected and facilitated by organisations. Data subjects should be able to eas - ily exercise their rights in a transparent and user- friendly manner.
479 CHAMBERS.COM
Powered by FlippingBook