TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin Attorneys-at-Law
dal. This case began in 2017, and has been heard by the district court, the High Court and the Supreme Court. The Supreme Court has twice remanded the case for re-examination by the High Court. In these judgments, the courts generally recognise that the right to be forgot - ten falls within the scope of privacy rights and is protected under the Constitution. However, search engine operators’ provision of search results, although commercially driven or for prof - it, should still be protected under the freedom of speech protected by the Constitution. Such search results should not be arbitrarily restricted or deleted, as doing so would undermine the performance freedom and neutrality of search engine operators which could, in turn, affect the public’s perception and judgement, and even threaten the foundation of democratic constitu - tionalism. Therefore, when determining whether certain search results should be deleted, courts seek to strike a balance between public interest and privacy rights. The Supreme Court re-stated the foregoing view and opined that the data sub - ject may also request the deletion of the col - lected or processed data if there is a more sig - nificant interest that needs to be protected. This includes many factors such as whether the data subject is a public figure, and whether the data has been outdated or causes disproportionate negative privacy impacts on the data subject. The Supreme Court also considers whether the deletion would affect or hinder the public’s right to know. From the above, it is clear that the courts attempt to balance public interest with privacy rights. In deciding whether specific search results should be deleted, the High Court and the Supreme Court have reached different conclusions based on the consideration of those factors. The match-fixing scandal was 14 years ago. At the second review of the Supreme Court in 2024, it
dismissed the judgment of the High Court again and requested the High Court to re-consider and seek a balance between the right to be forgotten and the public’s right to know based on all the relevant factors. 2.3 Collective Redress Mechanisms Collective Redress Mechanisms – Class Action The PDPA provides a collective redress mecha - nism through class actions for data protection violations. For cases caused by the same cause and fact, and where multiple data subjects are infringed, the organisations regulated by the PDPA may – after obtaining a written authorisa - tion of litigation rights of 20 or more data sub - jects – represent such data subjects in bringing a lawsuit to the competent court in its own name. The First Data Breach Class Action The first personal data infringement class action was brought by the Consumers’ Foundation against a travel agency in March 2018, with the court rendering its decision in October 2019. In this case, the Consumers’ Foundation claimed TWD4,509,575 compensation on behalf of 25 consumers, on the grounds that a travel agency leaked the personal data collected and thus caused damages to the consumers. The trav - el agency countered that the data breach was caused by a malicious hacking attack, and that it had notified the data subjects of the data breach after the occurrence of such attack; therefore, it should not be held liable for the data breach. The court rendered a judgment in favour of the defendant, opining that the travel agency had established a security and maintenance plan for the protection of personal data files, and that it had conducted internal audits, education and training for cybersecurity personnel, and
450 CHAMBERS.COM
Powered by FlippingBook