TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
where the statutory requirements are met, may further appeal to the Supreme Court. In determining the sentence or fine in a criminal case, courts usually consider the nature and seriousness of the offence, the extent of harm or damage caused, the intent and level of fault of the defendant, any illegal benefit obtained, the defendant’s personal circum - stances, prior criminal record and whether there are mitigating or aggravating factors, so that the punish - ment is fair and proportionate. Civil Liability Under the PDPA, civil liability arises when a govern - ment agency or a non-government entity violates the PDPA and causes personal data to be unlawfully col - lected, processed, used or otherwise infringes upon an individual’s rights, resulting in damage. Govern - ment agencies are generally liable for damages unless the harm was caused by force majeure, while non- government entities are liable unless they can prove the absence of intent or negligence. Victims may claim compensation not only for property damage, but also for non-property damage, including harm to reputation, and may request appropriate measures to restore reputation. Where actual damages are difficult or impossible to prove, courts may award statutory damages ranging from TWD500 to TWD20,000 per person per incident, subject to an overall cap for mass claims, unless the total harm exceeds that cap. If the party disagrees with the judgment, they may file an appeal. When determining the amount of compensation in a civil case, courts generally consider the nature of the wrongful conduct, the extent of actual damage suf - fered by the victim, the degree of intent or negligence of the wrongdoer, and the economic circumstances of the parties. 1.9 Enforcement Trends Severe Administrative Fines Against Financial Institutions for Data Protection Violation Remains Unchanged On 9 December 2025, an employee of the CTBC Bank, acting without any business-related necessity, privately accessed and queried customers’ personal data through the bank’s internal systems. The Finan -
cial Supervisory Commission (FSC) determined that the CTBC Bank had deficiencies in its protection of customers’ personal data and had failed to properly implement its internal control system. On this basis, the FSC imposed an administrative fine of TWD2 mil - lion on the CTBC Bank. Severe Administrative Fines Against Non-Financial Institutions for Data Protection Violation On 19 June 2024, a chain fitness company, WorldGym, and its legal representative – ie, the Chairman of the company, were each fined TWD1.4 million by the authority for: • failing to implement appropriate security measures, which led to a personal data breach (TWD1.2 mil - lion); and • failing to notify the affected data subjects after the data breach (TWD0.2 million). The reasons that the fitness company and its legal representative were subject to the severe fines include that the company has been classified by the National Police Agency as a “high-risk business”, indicating a heightened vulnerability to personal data breaches that could be exploited by scam groups to carry out scams against the public, and, in this case, individuals were also reportedly defrauded by scam groups using the leaked personal data, resulting in actual financial damages/losses. Proactive Administrative Investigation Against High-Profile Data Incidents Since late 2024, the competent authorities have adopted a practice of proactively initiating investiga - tions into high-profile personal data incidents, regard - less of whether such incidents occur domestically or overseas. Where a reportedly serious data incident occurs outside Taiwan but involves, or may involve, personal data of individuals in Taiwan, the relevant Taiwan authority will proactively commence an inves - tigation against the related Taiwan entity. By way of example, a widely used social media plat - form across Taiwan, Japan, Korea and other Asian jurisdictions was reported to have suffered a seri - ous data incident involving approximately 440,000 personal data records, more than 100 of which were
483 CHAMBERS.COM
Powered by FlippingBook