TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
• carry out audits and inspections on non-govern - ment agencies; • request information; • demand rectification; and • impose administrative penalties against non- government agencies for non-compliance with the PDPA. The official establishment of the PDPC is still pend - ing, and it is therefore not yet able to fully exercise the above functions and powers, as the relevant organic law governing its organisation remains under review and discussion. Notwithstanding the foregoing, the PDPC’s preparatory office has, in practice, begun to provide certain advisory input on data protection mat - ters to other relevant authorities. For the typical investigative workflow, please see 1.8 Enforcement Proceedings and Fines . 1.8 Enforcement Proceedings and Fines Administrative Investigations and Enforcement In the event that a competent authority considers a non-government entity may have violated relevant reg - ulations or deems it necessary to assess the entity’s compliance, the authority may initiate an investigation. This investigation typically involves notifying the entity or its personnel to provide necessary explanations, submit required documents, or take other actions for co-operation. The authority may also send personnel to inspect the premises, request explanations from relevant personnel or collect evidence. During such inspections, the competent authority has the right to seize or duplicate any personal data or files that are relevant to the investigation. Following the investigation, if the competent authority finds no violation, the entity may agree to the publi - cation of such investigation results. If the entity disa - grees with the authorities’ actions, the entity may file an objection. Where the objection is deemed justi - fied, the authority must modify or suspend the action; otherwise, the authority may proceed with enforce - ment measures. Should the entity remain dissatisfied with the decision, it may further file an administrative appeal or initiate administrative litigation.
Administrative sanctions for violations of the law include fines, orders to cease the collection, pro - cessing or use of personal data, mandatory deletion of personal data files, confiscation or destruction of unlawfully collected data, and public disclosure of the violation and the name of the entity and its responsible persons. Further, administrative fines for violations of the PDPA range from TWD20,000 to TWD15 million. There are no further explicit unified standards for pen - alties regarding violation of the PDPA. Nevertheless, as a general rule for administrative control, the fines imposed by administrative authorities shall be in pro - portion to the degree of violation, and must not involve abuse of discretion or violate the principle of propor - tionality. The authorities may consider factors such as the circumstances of the violation and frequency of violations when determining the amount of the fine. Based on the limited publicly available informa - tion, enforcement of data protection requirements by the Financial Supervisory Commission (FSC), as the competent authority for financial institutions, appears to be relatively more aggressive compared to that of other governmental authorities. With respect to non- financial sector data protection enforcement, where the data breach is serious, involves a substantial volume of personal data, reflects inadequate or sub - standard protective measures, and results in individu - als being subject to fraud or scams, the applicable administrative fines are likely to be higher and may exceed TWD1 million. Criminal Liability Under the PDPA, a violating person bears criminal liability if they intentionally seek unlawful benefits for themselves or a third party, or intend to harm oth - ers, and illegally collect, process, use, alter, delete or otherwise interfere with personal data, including violating statutory obligations or restrictions on inter - national data transfers, thereby causing damage to others. Such conduct may result in imprisonment of up to five years, detention and/or a criminal fine of up to TWD1 million. Where the offender is a public official who commits the offence by abusing their offi - cial authority, opportunity or means, the penalty may be increased by up to one-half. The defendant may appeal against the judgment to the High Court, and,
482 CHAMBERS.COM
Powered by FlippingBook