TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin Attorneys-at-Law
5. International Considerations 5.1 Restrictions on International Data Transfers Under the PDPA, in general international data transfer is permitted, while the government authority in charge of the pertinent industry may, at its reasonable discretion, impose limitations on international data transfers if: • they involve important national interests; • a national treaty or agreement specifies other - wise; • the country receiving the personal information lacks proper regulations towards the protec - tion of personal information and it might harm the rights and interests of the data subject; or • international transfers of personal informa - tion are made through an indirect method in which the provisions of the PDPA may not be applicable. Pursuant to the above provision and relevant laws governing particular industries, certain authorities further promulgate and require cer - tain data residency/data localisation require - ments whose nature will impose certain restric - tions on international data transfer. For example, the FSC promulgates certain data residency requirements for financial institutions. In addition, certain authorities promulgate and impose restrictions in terms of which certain specific industries are prohibited from transfer - ring data to a specific territory. For example, communications enterprises, social worker offic - es or human resource agencies are prohibited by respective governmental authorities in charge of the pertinent industry from transferring their sub - scribers’ or their clients’ personal data to China.
investigation of their report within 20 days, they may urge the agency to take action. To protect whistle-blowers from retaliation and harm to their rights due to their whistle-blow - ing actions, the Act explicitly prohibits taking adverse actions against whistle-blowers for their reporting, including dismissal, removal from position, deprivation of benefits related to promotion, and unfavourable changes to their work location, job responsibilities, etc. Further, anyone who discloses a whistle-blower’s identity without justification may be sentenced to impris - onment and may also be fined. 4.4 Transfer of Personal Data in Asset Deals In asset deals involving the transfer of personal data, if the privacy notice provided by the origi - nal data collector adequately covers the trans - feree as a potential data processor or user and has been consented to by a data subject, it is not mandatory under Taiwanese law for the transfer - ee to issue a separate notice to the data subject and obtain a new consent upon processing or using the data. However, if the transferee is not explicitly includ - ed in the scope of potential processors or users in the original privacy notice to be consented to by the data subject, the transferee is obligated to inform the data subject and provide a new privacy notice before processing or using the data. The notice shall include, among others, the name of the transferee, the purpose of the col - lection, the retention period, the data subjects’ rights and the source of the data. Additionally, in practice, the data subject will be given opt-in/ opt-out options upon receiving such notice from the transferee.
455 CHAMBERS.COM
Powered by FlippingBook