TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
related to Taiwan individuals. In response, the compe - tent authority, the Ministry of Digital Affairs, proactively initiated an intensive investigation into the group’s Taiwan presence. Similarly, in 2025, certain systems of well-known luxury brands were reportedly hacked overseas, potentially affecting a substantial volume of Taiwan personal data, and the Ministry of Economic Affairs likewise launched investigations into such inci - dents to clarify the impact on Taiwan personal data as well as the data protection compliance of its relevant Taiwan presences. These developments demonstrate a shift in the authorities’ enforcement approach toward a more proactive and assertive stance in the enforcement of data protection laws. Practical Takeaways for Organisations In line with global data protection trends and efforts to prevent the unlawful use of leaked data, Taiwan authorities have adopted a more proactive and asser - tive approach to the enforcement of data protection laws. In addition, they have begun to conduct more intensive investigations and to impose more stringent sanctions where violations are identified in the end. In light of these developments, enterprises, regardless of acting as data collectors, processors and/or control - lers, are advised to strengthen their data protection governance, internal controls and overall compliance frameworks. Trends in Data Breach Litigation Related to Fraudsters Exploiting Leaked Personal Data In Taiwan, cases of fraudsters exploiting leaked personal data to scam data subjects have become increasingly prevalent. There is a growing trend of data subjects, who suffer both material and non-material damage, seeking compensation from the businesses responsible for the data breaches. The majority of courts held that the material damage suffered by the data subjects is a result of the fraudsters’ actions, not those of the business, and therefore, no causa - tion exists between the data breach and the material damage. However, some of them further held that the 2. Privacy Litigation 2.1 Privacy Litigation Overview
emotional distress suffered by the data subjects in the fraud event is linked to the business’s data breach, allowing data subjects to seek compensation for non-material damage. When claiming non-material damages, the claimant must substantiate the nature of the harm suffered. For example, in cases where the victim’s personal data is leaked, resulting in fraud by fraudsters, the courts have recognised that the data breach and subsequent fraud caused the claim - ant emotional distress, thus justifying compensation for non-material damages. Where such non-material damages are difficult or impossible to prove, the court may award statutory damages of up to TWD20,000 per data subject per incident. While this amount may appear modest on an individual basis, the aggregate exposure could be substantial in the context of mass A well-known case is one in which a former profes - sional baseball CEO claimed the right to be forgotten and requested Google Inc. to remove search results related to his match-fixing scandal. This case began in 2017, and has been heard by the district court, the High Court and the Supreme Court. The Supreme Court has twice remanded the case for re-examination by the High Court. In these judgments, the courts gen - erally recognise that the right to be forgotten falls with - in the scope of privacy rights and is protected under the Constitution. However, search engine operators’ provision of search results, although commercially driven or for profit, should still be protected under the freedom of speech protected by the Constitution. Such search results should not be arbitrarily restricted or deleted, as doing so would undermine the perfor - mance freedom and neutrality of search engine opera - tors which could, in turn, affect the public’s percep - tion and judgement, and even threaten the foundation of democratic constitutionalism. Therefore, when determining whether certain search results should be deleted, courts seek to strike a balance between public interest and privacy rights. The Supreme Court restated the foregoing view and opined that the data subject may also request the deletion of the collected or processed data if there is a more significant interest that needs to be protected. This includes many factors such as whether the data subject is a public figure, claims or class actions. 2.2 Recent Case Law Case Regarding Right to be Forgotten
484 CHAMBERS.COM
Powered by FlippingBook