TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
ing registration and termination of operators and other relevant matters. Accordingly, organisations acting as data altruistic operators should therefore assess their eligibility, establish the necessary technical and organisational capabilities, register with the competent authority, implement internal processes to manage authorisa - tions, and adopt measures to protect personal data in accordance with regulatory guidelines. As the detailed operational rules and protective measures have not yet been fully clarified, the precise obligations of organisations will become clearer once these provi - sions are established. 3.4 Regulators and Enforcement In general, the competent authority of the draft Data Innovation and Utilization Promotion Act is the Minis - try of Digital Affairs, which is responsible for oversee - ing the operation of the data altruistic mechanism, including registration, termination and related proce - dures of operators. For matters relating to the protec - tion of personal data, the competent authorities (eg, the PDPC) will be responsible for issuing guidelines to ensure that personal data involved is properly safe - guarded. The Ministry of Digital Affairs co-ordinates with the personal data protection authority to ensure compliance with the PDPA, and the draft law’s require - ments for non-exclusive and non-discriminatory data sharing reflect the need to avoid unfair practices and restrictions on competition. As this draft Act remains a draft and the related sub - ordinate regulations have not yet been established, the operational framework will be more clearly defined once these provisions are formally issued.
• providing certain information required by the PDPA, such as the name of the business, the types of personal data being collected, the rights of the data subjects, and the duration, location, recipients and methods of data use, and this information is usually provided in the form of a cookie policy or privacy notice; • obtaining informed consent from data subjects; • ensuring that data is used only for specified pur - poses within the scope of data subjects’ consent; • implementing appropriate security measures to protect personal data; and • respecting data subjects’ rights, such as to access, rectify, delete, or request a copy of their personal data, or demand the cessation of the collection, processing or use of their personal data. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised or Targeted Advertising Personalised or targeted advertising is not specifi - cally regulated under a separate legal framework in Taiwan, but it is governed by the general provisions of the PDPA. Since personalised or targeted advertising often involves the collection and analysis of personal data to target individuals with tailored ads by way of collecting and analysing the browser records and footprint and at least partial IP information, it must comply with the requirements set out in the PDPA (please refer to 4.1 Use of Cookies ). Therefore, busi - nesses engaging in personalised or targeted advertis - ing must adhere to the PDPA’s general data protection principles to ensure legal compliance. This includes adhering to the requirements when performing pro - filing and ensuring that, if sensitive data is involved, the collection, processing and use of such data fully comply with the legal requirements for handling sen - sitive data (please refer to 1.3 Special Categories of Personal Data ). Other Online Marketing Practices The PDPA regulates the collection and use of per - sonal data for marketing purposes. When a non-gov - ernmental agency uses personal information for the purpose of marketing but the data subject refused the marketing, such marketing must stop immediate - ly. Also, the non-governmental agency should offer ways for the data subject to express their refusal at
4. Sectoral Topics 4.1 Use of Cookies
The PDPA does not have specific provisions directly addressing cookies, SDKs and other device identi - fiers. Nevertheless, their use, which typically involves collecting personal data from users’ devices, must comply with the general principles of the PDPA. This includes:
487 CHAMBERS.COM
Powered by FlippingBook