TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
personal data protection authority to prevent unnec - essary collection, processing or use of personal data and to promote the integration of data protection measures by design and by default, thereby safe - guarding individual rights throughout the AI lifecycle. This provides specific guidance ensuring that data protection is embedded from the earliest stages of AI system development and deployment. The regulatory regime is explicitly risk based. A risk classification framework aligned with internation - al standards must be established, and competent authorities are tasked with issuing corresponding risk- based management regulations. High-risk AI applica - tions are subject to enhanced oversight, with certain uses restricted or prohibited under defined conditions. Clear assignment of responsibilities and accountabil - ity mechanisms, including remedies, compensation or insurance, are mandated for high-risk AI. Further - more, government use of AI requires risk assessments and internal control mechanisms proportionate to the nature of the application. Together, these measures ensure that AI deployment and operation uphold data protection obligations, embedding risk mitigation, transparency, human oversight and accountability across the AI lifecycle. 1.6 Data Breach Requirement In the event that a government or non-government entity becomes aware that personal data it retained has been stolen, altered, damaged, lost or disclosed, the entity is obligated to notify the data subjects con - cerned. Where the breach meets specific reporting thresh - olds, the entity must report the breach to the relevant authorities. The entity must take immediate and effec - tive measures to mitigate the breach, prevent further damage and document the facts, impacts and correc - tive actions taken. It is also required to retain relevant records for inspection by the supervisory authority. The specific details regarding the notification process, reporting timelines, scope of reporting, containment measures and record retention shall be subject to rules further established by the supervisory authority. Non-compliance with these obligations may result in the imposition of fines.
In the event of a significant and high-profile data breach, the competent authority is likely to initiate an investigation to determine the cause of the incident and assess whether further action is required, such as holding the responsible parties accountable, impos - ing fines or requiring the entity to submit corrective action plans. 1.7 Regulators The PDPC will be the dedicated competent authority of the PDPA. Upon its official launch, the PDPC will integrate those enforcement powers and responsibili - ties (stated below) spread among the Ministry of Jus - tice (MOJ), the National Development Council, central government authorities that supervise the business operation of non-government agencies, and local gov - ernment authorities. Further, the PDPC will prioritise the regulation of non-government agencies that do not have a clearly designated competent authority. As for non-government agencies that already have been governed by a competent authority due to the feature of business, transitional provisions will apply. During the transitional period, the supervision by their central or local competent authority will remain in effect tem - porarily, and the regulatory powers of each respective competent authority will be gradually migrated to the PDPC in phases. This approach aims to achieve the legislative policy goal of centralising and unifying per - sonal data protection oversight. Before the official launch of the PDPC, the relevant regulators and their authorities are as below. The MOJ is the main regulator for personal data pro - tection and is in charge of proposing the draft bill of the PDPA, and promulgating the Enforcement Rules of the PDPA (which will be migrated to the PDPC after it is official launched). The MOJ and the National Development Council are in charge of issuing vari - ous interpretations to answer questions in respect of compliance with the PDPA. The enforcement of the PDPA is administered by the central government authorities that supervise the business operation of non-government agencies, and local government authorities. Both central and local government authorities have the power to:
481 CHAMBERS.COM
Powered by FlippingBook