Statement | JRF's Comments on the Executive Yuan's December 2024 Draft Amendment to the Personal Data Protection Act

Amid Taiwan's currently barren digital rights landscape, the Personal Data Protection Act (hereinafter the "PDPA") serves as a small oasis in this rights desert. Although its scope is clearly insufficient to address today's multifaceted digital human rights issues, it remains the only "narrow corridor" available to the Taiwanese people through judicial avenues. The shortcomings and areas for improvement in the current PDPA have been discussed by the public and academia for many years. Now, owing to Constitutional Court Judgment No. 13 of 2022 (hereinafter the "Constitutional Judgment"), which requires the Executive Yuan to enact specific legislative amendments—particularly demanding the establishment of an external oversight body to regulate the collection and use of personal data by both the public and private sectors—our PDPA finally has the opportunity to move in a better direction.

However, the draft amendment to the PDPA promulgated by the Executive Yuan on December 20, 2024, has once again dashed the hopes that the public has cherished for years. In response, the Judicial Reform Foundation (hereinafter the "JRF") issues the following statement:

The Draft Fails to Establish an Effective Accountability Mechanism for Public Agencies in Accordance with the Intent of the Constitutional Judgment, Making It Impossible to Practically Prevent and Handle Government Personal Data Incidents

For a long time, a major flaw in our PDPA has been the absence of concrete accountability mechanisms constructed for public agencies. In other words, the problem with the current PDPA lies not only in whether an independent regulatory body exists under organizational law, but also in whether operable and effective accountability mechanisms exist under the legal system. This is precisely one of the purposes for which civil society organizations pooled their efforts to pursue strategic litigation, ultimately securing a favorable Constitutional Judgment along the way. The obligation and direction of amending the law imposed upon the Executive Yuan by Paragraph 2 of the Main Text of the Constitutional Judgment are by no means merely a requirement to establish an empty shell resembling an independent agency, but rather a demand to create an independent agency with "teeth" and concrete accountability mechanisms.¹ If the draft fails to meet this fundamental requirement, it will likely remain unconstitutional.

Since the rendition of the Constitutional Judgment, several more data leakage incidents involving government agencies have occurred, notably the 2022 leak of over 23 million household registration records nationwide known as the "All-People Lottery" incident. This posed a systemic and severe violation of citizens' right to privacy, serving as a vivid lesson that brooks no delay in perfecting the rule of law. When the Executive Yuan released its previous draft amendment in May 2023, the JRF already pointed out the fundamental problem that the Executive Yuan's draft was "lenient toward itself, as the government failed to shoulder responsibility for personal data leaked from official databases." Unexpectedly, the Executive Yuan's current draft amendment to the PDPA still fails to display sufficient sincerity and resolve to patch the severe loophole of the PDPA's failure to effectively hold public agencies accountable, and fails to reflect seriously and squarely confront the necessity of an independent agency for effective accountability.

In this draft amendment, nominally, the Executive Yuan has added "Chapter 3-1: Administrative Supervision" and acknowledged in the legislative reasoning that the Constitutional Judgment requires amendments to strengthen oversight over the legality and credibility of the government's collection and use of personal data.² However, the design of the draft provisions, both conceptually and operationally, appears vastly distant from the accountability mechanisms that the public and the Constitutional Court hope to see.

Specifically, the so-called "Chapter 3-1: Administrative Supervision" actually contains only 4 articles, the first 3 of which merely write out the most basic management processes that the public administration system ought to have in the first place (such as internal audits within the public administration system; submitting improvement reports for deficiencies; demanding regulated agencies to provide explanations or adjustments; and requesting data, explanations, or on-site inspections when violations are suspected).³ Furthermore, throughout the entire draft, there is surprisingly only one single article (Article 21-4 of the Draft) that slightly touches upon the adverse consequences government agencies may face when violating the PDPA (Paragraph 1 limits the publication of the agency's name and violation circumstances to cases of "serious violations"; Paragraph 2 disciplines or punishes personnel belonging to the public agency according to the severity of the circumstances). It is hard to imagine that such low-density regulation has fulfilled the Constitutional Judgment's requirement for the Executive Yuan to "strengthen" oversight over the legality and credibility of public agencies' collection and use of personal data.

Using "Risk of Serious Harm" as a Prerequisite for Notifying Data Subjects and Reporting to Competent Authorities Impairs the Protection of People's Rights

Paragraph 2 of Article 12 of the Draft adds "risk of serious harm to the rights and interests of the data subject" as a prerequisite for the obligations to "notify the data subject" and "report to the competent authority." First of all, regarding this type of prerequisite setting, whether "harm is serious or not" is a highly uncertain legal concept, leaving obligors of reporting and notification free to determine by themselves that an incident carries no serious harm and thus avoid reporting and notification. Furthermore, when a personal data breach occurs, the responsible agency—facing the dual negative consequences of claims for damages by data subjects and penalties from competent authorities—evidently has a high incentive to avoid reporting and notifying as much as possible. This draft design of "players acting as referees" will render the regulations on reporting and notification obligations practically toothless.

Although the legislative reasoning states that this prerequisite regulation references the personal data protection laws of Japan and South Korea, thereby adding "risk of serious harm to the rights and interests of the data subject" as a precondition for reporting, in reality, neither Japanese nor South Korean legal systems have ever used the degree of severity of rights infringement as a threshold for reporting and notification obligations.

Although the legislative reasoning explains that "uniformly requiring the agency involved in an incident to report may crowd out truly serious and urgent incidents," "notifying data subjects" and "reporting to competent authorities" are inherently legal obligations of different meanings and functions. Notifying data subjects is the most basic notification obligation of the responsible agency, enabling the public to clearly understand their overall personal data and privacy risks;⁴ whereas reporting to competent authorities enables competent authorities to examine the causes of the incident, demand remedial or rectification plans from the responsible agency when necessary, and even issue warnings to other institutions. The administrative capacity consumed by notifying data subjects should be far lower than reporting to competent authorities. Solely using administrative capacity as a reason to uniformly adopt a higher threshold for triggering obligations—thereby restricting the fundamental right of individuals to be informed when a personal data incident occurs involving their data—can hardly be deemed reasonable. As for the legal obligation of "reporting to competent authorities," there are also numerous legislative design methods; if the Executive Yuan wishes to regulate the types of incidents that must be reported to competent authorities, it should provide more precise definitions for those incident types. Currently, the Draft using merely "risk of serious harm" as the requirement for reporting is indeed inappropriate.

Hoping the Executive Yuan Pulls Back from the Brink to Ensure the Personal Data Protection Act Truly Protects People's Rights

Although the Constitutional Judgment granted the Executive Yuan a full three years to amend the law, the Executive Yuan delayed until December 20, 2024, to release its draft version, and drastically shortened the statutory 60-day announcement period, setting only 21 days for open comments (which reduces to a mere 14 days if national holidays are deducted). This constitutes a serious procedural flaw and denies the public and civic groups concerned with personal data protection sufficient time to thoroughly examine the draft and express their views.

In recent years, the JRF has actively focused on changes in power structures—such as citizens' rights and the boundaries of public authority—brought about by the rapid digitalization of both public and private sectors. Looking at Taiwan's current digital legal environment, there is a severe lack of systematic and comprehensive legislation, especially lacking operable laws and governance mechanisms that equip citizens with the most basic rights assertions, enabling them to use the legal framework to achieve prior prevention and ex post relief against infringements by the government or private sector. (Note: Regarding this type of comprehensive legislative draft, please refer to the Draft Digital Rights Act jointly formulated by the JRF after inviting legal and information technology experts, which is dedicated to establishing citizen rights and government obligations in the digital environment, the boundaries of public authority, and due process and relief mechanisms for government restrictions on people's rights.)

The JRF urges the Executive Yuan to timely face up to the constitutional obligations imposed by the Constitutional Judgment, refrain from allowing the unconstitutional state of affairs to persist, and avoid a sustained vacuum in mechanisms for protecting people's rights and ensuring accountability.

---

¹ "Among the aforementioned necessary organizational and procedural protective measures, an independent oversight mechanism for personal data protection is a vital key institution. The purpose of this independent oversight mechanism is to ensure that the collection and use of personal data by data collectors comply with relevant laws and regulations, thereby enhancing the legality and credibility of personal data collection and use. In particular, since personal health insurance data has escaped the control of individuals, avoiding its abuse or improper leakage relies heavily on the oversight of an independent mechanism."
² Legislative reasoning for Chapter 3-1: "In view of the fact that Constitutional Court Judgment No. 13 of 2022 has required strengthening oversight over the legality and credibility of the collection and use of personal data by public agencies, ..., provisions related to the supervision of public agencies are added in Section 1."
³ Among these 3 articles, 2 are almost entirely copied and pasted from the yet-to-be-passed Executive Yuan draft amendment to the "Cyber Security Management Act," with only minor semantic adjustments. (Article 21-1 corresponds to Articles 14 to 16 of the Executive Yuan's draft Cyber Security Management Act; Article 21-2 corresponds to Paragraphs 3 to 5 of Article 21-1 of the Executive Yuan's draft Cyber Security Management Act).
⁴ In a personal data breach incident, timely notification to data subjects can give them the opportunity to promptly take corresponding damage control measures, such as changing passwords and deleting sensitive information stored on web pages (such as identification document data, date of birth, telephone number, or financial information such as credit card information that can identify a person).

Contact Persons

Judicial Reform Foundation, International Affairs and Digital Human Rights Project Manager: Attorney Huang
Email: grace.huang@jrf.org.tw