TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
and whether the data has been outdated or causes disproportionate negative privacy impacts on the data subject. The Supreme Court also considers whether the deletion would affect or hinder the public’s right to know. From the above, it is clear that the courts attempt to balance public interest with privacy rights. In decid - ing whether specific search results should be deleted, the High Court and the Supreme Court have reached different conclusions based on the consideration of those factors. The match-fixing scandal was 14 years ago. At the second review of the Supreme Court in 2024, it dismissed the judgment of the High Court again and requested the High Court to reconsider and seek a balance between the right to be forgotten and the public’s right to know based on all the relevant factors. Taken together, these judgments have significantly shaped the framework for privacy-related litigation in Taiwan, particularly with respect to the right to be for - gotten. The courts apply a contextual balancing test between privacy rights and competing constitutional interests, notably freedom of speech and the pub - lic’s right to know. Rejecting any automatic right to deletion, the courts assess factors such as the data subject’s public status, the passage of time, ongoing relevance, proportionality of the privacy impact and the effect of deletion on public discourse. Accordingly, the right to be forgotten is subject to judicial scrutiny rather than automatic enforcement. 2.3 Collective Redress Mechanisms Collective Redress Mechanisms – Class Action The PDPA provides a collective redress mechanism through class actions for data protection violations. For cases caused by the same cause and fact, and where multiple data subjects are infringed, the organi - sations regulated by the PDPA may – after obtain - ing a written authorisation of litigation rights of 20 or more data subjects – represent such data subjects in bringing a lawsuit to the competent court in its own name. Regarding class action, the legislation does not provide a specific timeline for the completion of judicial proceedings. However, in the first data breach class action case (please see below for details), the court took approximately eight months to render a
first-instance judgment, after which the parties settled during the appellate proceedings. The First Data Breach Class Action The first personal data infringement class action was brought by the Consumers’ Foundation against a travel agency in March 2018, with the court rendering its decision in October 2019. In this case, the Consumers’ Foundation claimed TWD4,509,575 compensation on behalf of 25 con - sumers, on the grounds that a travel agency leaked the personal data collected and thus caused damages to the consumers. The travel agency countered that the data breach was caused by a malicious hacking attack, and that it had notified the data subjects of the data breach after the occurrence of such attack; there - fore, it should not be held liable for the data breach. The court rendered a judgment in favour of the defend - ant, opining that the travel agency had established a security and maintenance plan for the protection of personal data files, and that it had conducted internal audits, education and training for cybersecurity per - sonnel, and changed the passwords for the computer system periodically. Therefore, although there was a data breach caused by a hacking attack, the court held that the travel agency was not in violation of the PDPA and thus should not be held liable for the data breach. The Consumer Foundation has filed an appeal against this judgment. During the procedure in the court of second instance, the Consumers’ Foundation and the travel agency reached a settlement. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation In Taiwan, there is currently no unified law specifically governing cross-sector data access and data-sharing frameworks in the context of emerging technologies such as the Internet of Things and cloud computing. Nevertheless, in response to the rapid development of AI and the indispensable role of data in AI training and applications, a draft Data Innovation and Utiliza -
485 CHAMBERS.COM
Powered by FlippingBook