TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
the time such marketing first appears in public, and should compensate any necessary cost and expense for expressing such refusal. Moreover, the Financial Holding Company Act pro - vides that financial holding companies’ subsidiaries engaging in co-selling activities among themselves should apply to the FSC for prior approval and ensure that such activities will not harm the interests of cus - tomers. The subsidiaries of the financial holding com - pany should comply with the provisions of the PDPA with regard to the joint collection, processing and use of the basic personal data and dealing or transaction records of customers. In Taiwan, there are no general and primary rules regulating all types of online marketing. Neverthe - less, for electronic marketing, the Consumer Protec - tion Committee has promulgated guidance advising that enterprises collect and use consumers’ personal information in accordance with the law, and provide In addition to the PDPA, which plays a primary role in data privacy, in employment relationships, the relevant labour laws provide further rules. Accord - ing to the Employment Service Act and its enforce - ment rules, when recruiting or hiring employees, an employer may only request “privacy data” that is nec - essary and related to the employment relationship, while respecting the employee’s rights. The informa - tion requested must be legitimate, necessary and rea - sonably related to specific economic needs or public interests. “Privacy data” includes physiological data (such as genetic testing, drug testing, HIV testing, etc), psychological data (such as psychological tests, lie detector tests, etc), and personal life information (such as credit records, criminal records, background checks, etc). However, the employer is prohibited from requesting personal information that is not relevant to employment, as well as from retaining the employee’s ID, work certificates or other documents not required for employment purposes. In other words, all requests must be strictly limited to information necessary for the employment process and aligned with legitimate economic purposes. reasonable protective measures. 4.3 Employment Privacy Law
In practice, for the employment privacy issues (such as email monitoring, installing surveillance cameras in the workplace, recording employees’ activities within the office, or capturing their computer screen activities), Taiwan courts use the following standards to determine whether the measure is in violation of employees’ privacy rights: • necessity of the purpose – whether the measure is implemented for a legitimate business purpose; • proportionality of the method – whether the meth - od used is appropriate and does not exceed what is necessary to achieve the legitimate business goal; and • balancing of interests – using the least intrusive means to achieve the business objective. By way of example, in cases involving email monitor - ing, certain court rulings have indicated that where a company has implemented an email policy clearly stating that employees’ emails may be monitored, or where employees have provided written consent to such monitoring, it is difficult to conclude that employ - ees retain a reasonable expectation of privacy in those emails. 4.4 Data Protection in M&A In M&A and asset transactions, privacy and data pro - tection are critical considerations throughout the entire transaction lifecycle, from due diligence to post-clos - ing integration. During the due diligence phase, exist - ing privacy and data protection compliance should be reviewed regardless of whether the target operates in a data-rich industry, although data-intensive busi - nesses are typically subject to heightened scrutiny due to more stringent and complex regulatory require - ments. In certain industries, such as big data, data analytics or other emerging data-driven businesses, it is often fundamental to assess whether the relevant datasets constitute personal data and to evaluate how such data is collected, processed and utilised. In this context, it is also necessary to precisely identify the role played by the target, including whether it acts as a data collector, processor and/or controller, so as to precisely clarify the compliance status in all material aspects. Such assessments typically require close and co-ordinated collaboration between technical and legal teams.
488 CHAMBERS.COM
Powered by FlippingBook