TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
tion Promotion Act has been proposed and is pres - ently under deliberation by the Legislative Yuan. The draft bill aims to facilitate the circulation and utilisa - tion of data, enhance national competitiveness in the digital domain and promote data-driven innovation by encouraging the opening and sharing of data. Under the draft, data may be classified and made available as “open data” or “shared data” in accordance with applicable licensing and usage conditions for the purpose of promoting data innovation and utilisation. Nevertheless, where such data involves personal data, it still must be governed by and processed in compliance with the PDPA. Government agencies, with respect to the government data under their control, are required to promote data innovation and utilisation within the scope of their respective statu - tory functions pursuant to the draft legislation, and to periodically review their implementation to ensure compliance with the PDPA, the Cyber Security Man - agement Act, the Trade Secrets Act, the Copyright Act and other relevant laws. In addition, the draft empowers government agencies to encourage inter- industry co-operation to establish secure, accessible and interoperable data-sharing mechanisms, and to promote the voluntary sharing of industry-held data under fair, reasonable and non-discriminatory data- sharing terms. The draft Data Innovation and Utilization Promotion Act is currently under legislative review, and its final provisions and regulatory framework have not yet been determined. Upon enactment, the Act is expect - ed to establish a legal foundation for data sharing and utilisation while ensuring compliance with personal data protection, cybersecurity and other applicable legal requirements. 3.2 Interaction of Data Regulation and Data Protection Pursuant to the draft Data Innovation and Utilization Promotion Act, the promotion of data sharing and utilisation is intended to facilitate innovation and sup - port applications such as AI; however, such activi - ties remain subject to the continued applicability of existing legal regimes. The processing of personal data must adhere to the requirements of the PDPA, including the establishment of a lawful basis, obser - vance of purpose limitation and the implementation
of appropriate security measures. Similarly, non-per - sonal data, including information potentially protected under intellectual property or trade secret laws, must be managed in accordance with all relevant legal obli - gations, so as to prevent infringement of proprietary rights. In this manner, the draft legislation seeks to enable the circulation and innovative use of data while ensuring ongoing compliance with established statu - tory protections governing privacy, cybersecurity and intellectual property. 3.3 Rights and Obligations Under Applicable Data Regulation Under the draft Data Innovation and Utilization Pro - motion Act, government agencies may provide open data (ie, data that is licensed for use without limita - tion as to purpose, geographic region or duration, and is provided in a machine-readable, widely accepted format) in accordance with principles of searchabil - ity, accessibility, interoperability and reusability, and must provide metadata or explanatory information to facilitate interpretation. They are also required to maintain the integrity, accuracy, usability and timeli - ness of open data, and may encourage inter-industry co-operation to establish secure, accessible and inter - operable data-sharing mechanisms. Shared govern - ment data (ie, government data that is shared and licensed for use under specific conditions, including the right of the licensor to withdraw the authorisation) must be provided on a non-exclusive basis under fair, reasonable and non-discriminatory conditions, unless justified by public interest. Personal data may only be shared or utilised in com - pliance with the PDPA, with appropriate safeguards to ensure security and lawful processing. In the con - text of the data altruistic mechanism, only govern - ment agencies or non-profit entities are permitted to act as operators, and such operators must pos - sess adequate technical and organisational capacity in information security and personal data protection to safeguard individuals’ personal data and main - tain cybersecurity. Any sharing or use of personal data must be accompanied by appropriate protec - tion mechanisms, in accordance with guidelines to be issued by the competent personal data protection authority. The competent authority shall also prescribe the operational procedures of the mechanism, includ -
486 CHAMBERS.COM
Powered by FlippingBook