Press Conference | Results of the "Taiwan Data Privacy Policy Congressional Intention Survey" Released

Between December 20, 2022, and January 9, 2023, the Judicial Reform Foundation commissioned Sanshui Public Opinion Research Co., Ltd. to conduct a survey on the attitudes of the current Legislative Yuan regarding data protection, privacy, and digital human rights issues. During the survey period, responses were received from 55 legislators. Statistics show that legislators across Taiwan's ruling and opposition parties share a high cross-partisan consensus on issues such as personal data leaks, the need to strengthen personal data protection, due process for facial recognition systems, prohibitions on public sector procurement of China-made surveillance equipment, and cybersecurity enhancement. This indicates that the current legislature views the reinforcement of cybersecurity, personal data protection, and digital human rights safeguards as a positive necessity. However, the majority of members also believe that Taiwan's digital human rights protections lag behind most democratic countries, and expressed deep concern regarding issues such as cyberattacks, data breaches, and illegal activities in the online environment.

In response to questions regarding concerns over cloud storage data leaks, whether Chinese software may pose a hazard to Taiwan's information security, and whether personal data protection should be strengthened to prevent fraud, Open Culture Foundation Executive Director Li Hsin-ying noted:

1. Although cybersecurity and privacy are distinct aspects, both are equally important. The survey results show that a majority of members are concerned about personal and work data being targeted by hackers or leaked, demonstrating that "cybersecurity" is a matter of significant concern to the legislators. On December 28, 2021, the Financial Supervisory Commission amended Article 9-1 of the "Regulations Governing the Establishment of Internal Control Systems by Public Companies" and issued related rulings requiring companies to establish cybersecurity units and dedicated personnel by the end of 2023. This shows that under the slogan "cybersecurity is national security," the government and the legislature have implemented certain policies that continue to be promoted. In reality, however, when the media extensively reports on past data breach incidents, the government's response remains slow or evasive. Because these leaked datasets are sufficiently authentic, they have led to an endless stream of fraudulent schemes. Although most members indicated that personal data protection can help reduce fraud and the spread of disinformation, our government still underestimates the severe impact of data leaks on the public's privacy.

2. Furthermore, apart from the risk of illegal theft, personal data also faces the risk of improper collection and utilization by companies. For example, most legislators believe that using Chinese software entails significant risks to the personal privacy data of Taiwanese citizens. This view is also accepted internationally. In recent years, foreign countries have successively banned the use of Chinese communication software out of concern that our personal privacy information might be improperly collected and utilized beyond privacy terms. Moreover, since both cybersecurity and privacy are critically important, while guarding against Chinese software, Taiwan must also find ways to address the domestic tendency to overlook and undervalue personal information privacy.

 
Additionally, regarding facial recognition systems, the prohibition of public sector procurement of Chinese surveillance equipment, and how there should be ex-post judicial review or accountability mechanisms when the government retrieves people's data, Taiwan Association for Human Rights Digital Human Rights Officer Chou Kuan-ju stated:

1. Legislators share a high consensus on the legalization of facial recognition systems and the prohibition of public sector procurement of Chinese surveillance equipment. During last year's review of international conventions, international reviewers also noted that Taiwan lacks a legal basis when using facial recognition systems. In this regard, the European Data Protection Board holds that the use of automated recognition of biometric features such as faces and voices in public spaces, as well as AI-inferred emotions for purposes other than medical ones, should be prohibited. Given the high consensus among legislators, the Taiwan government should truly accelerate the inventory of current application uses and regulations, and initiate further discussions to prevent the abuse of facial recognition systems. Beyond facial recognition systems, attention must also be paid to the cybersecurity issues of IoT connected devices, as well as past incidents involving white-label Chinese surveillance cameras and the cybersecurity issues of telecommunications operators selling white-label Chinese mobile phones.

2. Regarding government data governance, in addition to establishing regulatory checkpoints for government retrieval of public data, the government and enterprises must pay special attention to the privacy risks of "large-scale databases." Risks and protection measures should be clarified before, during, and after the creation of a database. Personal data is like eggs; before putting them into a basket, one must evaluate whether putting all the eggs in the same basket creates an excessively high risk. Has the government established a clear legal basis requiring everyone's eggs to be concentrated together, and has it established protective measures to spread the risk and reduce infringement? Last year's National Health Insurance Database unconstitutionality case saw the Constitutional Court point out that the mandatory secondary use of the National Health Insurance Database lacked a legal basis, and that disallowing data subjects from opting out were unconstitutional acts.

Finally, regarding the infringement of digital human rights through illegal acts, Judicial Reform Foundation Digital Law Working Group Convenor Attorney Lin Chun-hung expressed:

1. This survey reveals that the concerns of legislators do not differ much from those of the public, encompassing online fraud, sexual exploitation of children and juveniles, and the non-consensual distribution of sexual private imagery. The essence of these illegal acts stems from the improper utilization of citizens' personal data. Recent news frequently reports on leaks from government or private databases, and these leaks imply that subsequent criminal activities may arise because the circulating information could be arbitrarily exploited by bad actors.

2. When concerning itself with digital issues in the past, the JRF has always hoped that our government agencies would face up to our overall digital legal system. In particular, the collection, processing, and utilization of digital information should all be protected. Concepts of basic human rights and rule of law like these should be gradually constructed within our entire legal framework system.

3. However, at present, we observe that the government's approach to related issues resembles treating the head when the head aches and the foot when the foot aches (piecemeal approaches). There has been no broader, more extensive discussion regarding the overarching conceptual framework of digital human rights and the foundational mindset of digital human rights laws. This opinion poll has already highlighted that legislators are paying close attention to this matter. I believe that since legislators have noticed this, they should all the more initiate discussions across various aspects regarding how to construct Taiwan's digital human rights system. This is also a long-standing concern of the JRF, which happens to align with the results of this opinion poll. Therefore, we hope to call upon our legislators here to initiate discussions on digital construction, and we also hope that the general public will begin to care about such issues.

 In view of the high consensus among legislators on digital issues, the Open Culture Foundation, the Taiwan Association for Human Rights, and the Judicial Reform Foundation jointly call upon the Congress and the government to seize the upcoming, most crucial final two sessions of the Legislative Yuan. They should promptly propose relevant countermeasures regarding the issues of cybersecurity, personal data protection, and digital human rights—which this survey shows enjoy high cross-partisan importance—strengthen relevant legal norms, and implement policies to effectively protect the public's personal data and digital human rights, thereby ensuring that "cybersecurity is national security" is more than just a slogan.

Attachments

1. Taiwan Data Privacy Policy Congressional Intention Survey Questionnaire
2. Taiwan Data Privacy Policy Congressional Intention Survey Final Report

Attending Representatives

Taiwan Association for Human Rights Digital Human Rights Officer Chou Kuan-ju
Open Culture Foundation Executive Director Li Hsin-ying
Judicial Reform Foundation Digital Law Working Group Convenor Attorney Lin Chun-hung

Organizers

Taiwan Association for Human Rights
Open Culture Foundation
Judicial Reform Foundation

Press Contact

Judicial Reform Foundation Staff Attorney Chiao Cheng-hsiang