Statement on the Executive Yuan's Amendment Draft to the Personal Data Protection Act: Merely Modifying the Competent Authority and Strengthening Penalties is Insufficient to Ensure Personal Data Protection

On April 13, 2023, the Executive Yuan announced amendments to the Personal Data Protection Act pursuant to Constitutional Judgment No. 13 of 2022 (hereinafter referred to as the Constitutional Judgment) rendered by the Constitutional Court of the Judicial Yuan on August 12, 2022. According to the press release, the primary amendments include "establishing the Personal Data Protection Commission" and "adjusting the penalty mechanisms for non-government agencies."

Although these amendments improve the Personal Data Protection Act to a certain extent, aside from establishing a specialized agency, the draft fails to explicitly regulate important matters such as the composition of the Commission's members, the inclusion of external participating commissioners, the scope of responsibilities, and the personal data protection and supervision that the Commission should assist various agencies in handling.

1. Lenient on Itself: The Government Fails to Bear Responsibility for Leaks of Official Databases

   Furthermore, while this amendment draft increases penalties for "personal data leaks by non-government agencies," it does not address institutional regulations such as how to establish ex-ante preventive mechanisms and government audit procedures. Moreover, the problem is not limited to private companies; several personal data leak incidents that erupted last year involved the leakage of "official" databases, such as household registration and labor insurance data.

   However, to date, the government has yet to provide a complete explanation to the public, has not made the investigation report on this incident public, and has failed to propose measures on how to strengthen data protection. In this amendment, issues such as the liability of public agencies and data transmission remain unrevised, which obviously fails to meet public expectations for personal data protection.
   Faced with the challenges of today's global digital wave, merely amending the specialized agency for data protection is clearly insufficient for a rapid response. The Legislative Yuan should seize this opportunity to comprehensively amend the Personal Data Protection Act to ensure it can cope with the ever-changing digital world.

2. Do Not Repeat the Controversies and Errors Caused by the "Digital ID" Policy

   Yesterday (May 11), the Taipei High Administrative Court rendered its judgment on the "Digital ID Litigation Case" (press release). The court held that the digital ID policy has a profound impact on people's private sphere and the right to autonomous control over personal information, and relying on the Household Registration Act as the basis to compel citizens to replace their IDs with "Digital IDs" clearly violates the "principle of legal reservation."

   Meanwhile, earlier (May 8), the United Daily News ran a front-page headline titled: "Digital ID Suspended, 1 Billion NTD Cost Footed by the Public," pointing out that the policy originally scheduled by the Ministry of the Interior in 2020 to launch the replacement of digital IDs was subsequently suspended by the Executive Yuan in January 2021. However, aside from the 524 million NTD required to maintain personnel operations and machine maintenance, relevant vendors have submitted compensation claims totaling 526 million NTD to the government. This once again demonstrates that the government should not act hastily in formulating digital policies or establishing personal data protection systems; instead, it should fully consider opinions from all sectors and complete the relevant legal revisions. Otherwise, even if a Personal Data Protection Commission is established in the future, it will only repeat the mistakes of implementing the digital ID policy.

3. Safeguarding Public Privacy and Personal Data: The Legislative Yuan Has an Indispensable Duty

   Therefore, this Foundation recommends that, in addition to the Executive Yuan simultaneously submitting the draft organic act for the Personal Data Protection Commission, the Legislative Yuan should fully consider opinions from various professional fields during this amendment process, with the expectation that our country can form a more robust personal data protection mechanism following this legal revision. Furthermore, the government should strengthen data security education and advocacy, raise public awareness of personal data protection, and encourage enterprises to independently establish rigorous data protection systems.

   Meanwhile, regarding data management in public agencies, the government should strengthen information security measures and formulate clear assignments of responsibility and accountability mechanisms to reduce the occurrence of similar incidents in the future. For personal data leak incidents that have already occurred, the government should conduct thorough investigations, clarify the causes, and hold relevant personnel accountable to demonstrate the government's emphasis on data protection.

   In summary, addressing only the establishment of a specialized agency and the increase of penalties is clearly insufficient to remedy the loopholes in the current personal data protection system. This Foundation calls upon the Executive Yuan and the Legislative Yuan to comprehensively review the inadequacies of the current Personal Data Protection Act, draw upon foreign experiences, and carry out comprehensive amendments across various aspects such as institutional organization, data protection measures, and supervision and management. This will ensure that after this legal revision, the personal data security and privacy rights of our citizens are fully protected, rather than waiting until the Personal Data Protection Commission is established for the Commission itself to propose amendment drafts.

Press Contact

Ch'iao Cheng-hsi, Staff Attorney, Judicial Reform Foundation