After Personal Data Leaks

Recently, investigation authorities have uncovered multiple cases of official-business collusion and the illegal sale of citizens' personal data. While public discussion has largely focused on consumer rights and human rights violations, the Ministry of Justice recently proposed raising the total compensation cap for a single incident of violating the Computer-Processed Personal Data Protection Act (hereinafter the Personal Data Protection Act) from NT$20 million to NT$50 million. From the perspective of legislative policy, this article examines the rationality of this legislative amendment direction.

Although the current Personal Data Protection Act stipulates that the amount of damages per person per incident shall, in principle, range from NT$20,000 to NT$100,000, the Act simultaneously provides that the maximum total compensation for the same factual cause shall not exceed NT$20 million (see Articles 27 and 28). Such legislation not only runs counter to the legal principles of damages, but in actual operation, it very easily gives rise to absurd situations. For example, according to newspaper reports, an individual's telecommunications data is valued at a "market price" of about NT$500 per record. If a telecommunications operator sells the personal data of its one million users, the operator can not only easily reap "extra-business" income of NT$500 million, but even if the matter eventually comes to light and it compensates the victimized users NT$20 million in accordance with the law, it can still "net" NT$480 million, making the return on investment astonishing! More seriously, this kind of "incentive to commit crimes" will not disappear because the Ministry of Justice intends to raise the total compensation cap to NT$50 million (at most, illegal gains are reduced); instead, the one million victimized users will actually only be able to split a compensation amount of NT$20 or NT$50 each, rendering the provision that "compensation per person per incident is NT$20,000 to NT$100,000" a dead letter.

Of course, the purpose of the above discussion is not to encourage crime, but if such absurd deductive results emerge, the legislative approach of the Personal Data Protection Act in "setting a total cap on damages" is probably most responsible. In fact, from the perspective of "law and economics," this regulatory means of the Personal Data Protection Act is indeed highly problematic, because it allows government agencies or enterprises—which are most capable of controlling risks and preventing damages from occurring—to neglect strengthening internal control and tiered gatekeeping mechanisms (so as to avoid excessively high compensation amounts in the future), and instead potentially encourages them to leak data to reap exorbitant profits. Furthermore, from the legal philosophical thought of "egalitarian liberalism," it also raises high doubts as to whether the government or legislators, when formulating relevant statutory clauses, referred to the methodology advocated by J. Rawls: when formulating a social contract, everyone stands behind the veil of ignorance, setting aside their original status, position, wealth, ability, etc., to ensure the fairness of the discussion (refer to Chu Ching-yi and Li Nien-tsu, Basic Human Rights, Linking Publishing, 2003). Otherwise, how could a law be formulated where enterprises face no limits in charging consumers, yet consumers face a total cap when seeking damages from enterprises?

Whether "law and economics" or "egalitarian liberalism," both can be considered highly valued tools in contemporary legal academia that can be used to examine the quality of legal design. Today, the legislative approach of the Personal Data Protection Act regarding the "setting of a total cap on damages" seems unable to pass the test of these two methodologies. Therefore, we cannot help but ask: what kind of legislative philosophy did the Ministry of Justice or the Executive Yuan follow in this amendment? Or was it merely based on the will of those in power, legislators, or specific interest groups, without truly considering the mandate of the majority of the people?

"Law" is a practical social science, so it is virtually inevitable that initial legislative designs are inadequately conceived, necessitating future review and amendment. However, the controversies sparked by "Article 17 of the Referendum Act and the March 20 Referendum" and the "failure of the Presidential and Vice Presidential Election and Recall Act to incorporate an administrative ballot-recounting mechanism while mutatis mutandis applying civil litigation procedures" are lessons not far past. We truly hope that the government and legislators will not rush legislation or draft it carelessly after the leakage of citizens' personal data, allowing statutory clauses devoid of legal philosophy, human rights concerns, and even regulatory efficacy to flood our society.

※ Published in: China Times