Joint Statement｜Digital Human Rights Cannot Wait: Civil Society Organizations Propose 9 Demands to the Taiwan Government

1. Regarding Digital Rights

Initiate digital rights legislation to establish enforceable civil rights, government obligations, and the boundaries of public authority.

Digital legal reform should be launched immediately. Please refer to the civil society version of the draft "Digital Bill of Rights" to establish citizens' rights, government obligations, the boundaries of public authority, due process for restricting citizens' rights, and remedy mechanisms.

Description:
The government should establish, through explicit legislation, the citizens' rights, corresponding government obligations, boundaries of public authority, due process for restricting citizens' rights, and remedy mechanisms that a digital free society ought to have. In addition to guiding and structural regulations such as a basic law, the aforementioned legislative efforts should also swiftly draft and adopt specific, actionable regulations so that people can make requests to administrative agencies in accordance with the law and seek judicial remedies when their rights are violated.
The types of digital rights that should be established include, but are not limited to: the right to be informed derived from informational self-determination (including the ability to fully know and control the ways personal digital data and digital footprints are utilized), the right to confidentiality and anonymity, the right to request non-digital / non-personalized / non-automated decision-making, and the right to feasible and user-friendly alternatives.
Regarding this type of legislative direction and provisions, please refer to the civil society version of the draft "Digital Bill of Rights".

Footnote:
Please refer to JRF Digital Bill of Rights v1.1

2. Regarding Personal Data Protection

Call upon the government to fully implement the personal data protection system and adhere to clear and sound privacy protection laws.

Description:
Call upon the government to improve the personal data protection system, ensuring that its implementation follows clear and sound privacy protection rules. We expect the government to:

1. Fulfill the government's promise to establish the Personal Data Protection Commission by August 2025 and initiate the second phase of amendments to the Personal Data Protection Act. We request the government to incorporate civil society participation during the regulatory deliberation process.
2. Ensure the independent personal data protection authority possesses the functions and resources of a substantive second-tier agency, sufficient to oversee the collection and utilization of data by both the public and private sectors simultaneously. The government should also actively supervise and hold public agencies substantively accountable.

Footnote:
Please refer to the CSO statements on the amendment of the Personal Data Protection Act:

• [TAHR]
• [JRF]

3. Regarding Personal Data Breaches

Establish and implement concrete mechanisms for accountability and emergency response remedies regarding personal data breaches in public agencies.

Description:
The government should actively implement accountability and response mechanisms for personal data breaches in public agencies. These mechanisms should include standard operating procedures and timelines for preventing the expansion of harm, remedial measures, and preventing similar incidents from recurring. Especially regarding the 2022 breach of household registration data for over 23 million citizens, the government should immediately prevent further harm, carry out a concrete remediation plan, complete an independent investigation into the breach incident, and formally explain the background and remediation plan to the general public.

4. Regarding Personal Health Data

Respect consent and control over personal health data.

Description:
The government should at least establish clear regulations protecting personal data regarding the utilization of health data such as health and welfare data, health insurance data, hospital medical records, and medical test results. This is to fulfill autonomous informed consent, post-utilization control (cessation of use and deletion), and the right to withdraw consent, in compliance with medical research ethics such as the Taipei Declaration, as well as the protection of patient dignity and informational autonomy guaranteed by Constitutional Court Judgment No. 13 of 2022.

5. Regarding Restrictions on Internet Access

The government must prevent executive power from being mistakenly or abusedly used to restrict internet access.

Description:
Public authorities have a duty to ensure network neutrality and openness. When intervening in online content (such as requesting the removal or blocking of websites), it must be predicated on clear legal authorization and compliance with the principle of proportionality, and independent monitoring and remedy mechanisms must be established. The government's law enforcement process should also be transparent, public, and fully documented, such as regularly publishing statistics on requests to restrict online content or access.

Footnote:
Please refer to Article 7 of JRF Digital Bill of Rights v1.1

6. Regarding Digital Platforms

The government and enterprises should promote governing digital platforms in accordance with international human rights standards, establishing accountability mechanisms to prevent human rights violations and negative impacts.

Description:
The government and enterprises need to actively shape an online environment conducive to the physical and mental health, internet privacy, and safety of relatively vulnerable or disadvantaged groups, including but not limited to preventing cyberbullying, child sexual exploitation, digital sexual violence, content enticing self-harm or addiction among children and youths, and hate speech.
Regarding digital platforms and various aspects of digital services, promote and pass legislation governing various aspects in accordance with international human rights standards, imposing responsibilities and obligations on digital service providers. Particularly, internet platform providers meeting a certain scale should establish human rights governance mechanisms subject to independent third-party accountability and rights violation remedies, in order to prevent various human rights violation issues and negative impacts, build a safe online environment free from cyber violence and hate speech, establish providers of very large online platforms, and protect freedom of speech.
In addition, require operators to take active measures to govern related information, and establish prevention mechanisms and transparent review systems for situations where algorithms might amplify negative content.

7. Regarding UNGPs and the Human Rights Due Diligence Act

The government should promote compliance by digital technology enterprises with the UNGPs and the Human Rights Due Diligence Act to reduce the risk of human rights violations.

Take into consideration the potential risks of human rights violations directly caused or indirectly facilitated by digital technology enterprises such as digital surveillance companies or related equipment and software companies, data brokers or intermediaries, telecommunications companies, and large internet platform companies.

This includes, but is not limited to, promoting a mandatory "Corporate Human Rights and Environmental Due Diligence Act", requiring them to comply with the United Nations Guiding Principles on Business and Human Rights (UNGPs) requiring enterprises to integrate internal functions and procedures, take appropriate actions, and utilize internal or independent external human rights expertise to adhere to international human rights standards.

8. Regarding Artificial Intelligence

Complete legislation on artificial intelligence or computer-aided decision-making, ensuring related research, development, and use comply with human rights standards.

Description:
Complete legislation related to artificial intelligence or other computer-aided decision-making, ensuring that all related research and development, products, and uses comply with international human rights standards, implement transparency and interpretability, establish accountability and independent regulatory mechanisms with sufficient enforcement power, prohibit technologies with high risks of human rights violations that cannot meet standards, and establish relevant rights assertion channels, remedy avenues, and corresponding agencies for individuals and groups. Public agencies should, prior to using any artificial intelligence-related technologies or other computer-aided decision-making systems they develop or use, publicly announce the legal basis for using each technology, the model training process, the types and sources of training data, the scope of application, the degree of impact on decisions, and the process and conclusions of human rights impact assessments. The aforementioned human rights impact assessments must incorporate civil society participation.

9. Regarding Open Source

Integrate open source and civic technology promotion into law and policymaking as a core strategy for public services and digital development.

Description:
Promote the development of open technologies (open source code, open data, open government) and civic technology to enhance the transparency, monitorability, and resilience of public services and digital development. Free and open-source software (FLOSS), in particular, can promote the sustainability, local innovation, and civic empowerment of digital development. The government should formulate policies and incorporate them into law to make open source a core strategy for public services and digital development.

1. About Digital Rights

Establish practical legal mechanisms regarding digital rights and freedoms.

It is high time to establish practical legal mechanisms regarding digital rights and freedoms to ensure democracy and rule of law continues to strive in the digital age. We urge your attention on the “Digital Bill of Rights” drafted by civil society, which focuses on the individual and the people’s rights, government obligations and constraint of power, as well as establishing the due process and remedy mechanism for when the individual and the people’s rights are to be restricted by the government.

Description:
It is high time to establish practical legal mechanisms regarding digital rights and freedoms to ensure democracy and rule of law continues to strive in the digital age. We urge your attention on the “Digital Bill of Rights” drafted by civil society, which focuses on the individual and the people’s rights, government obligations and constraint of power, as well as establishing the due process and remedy mechanism for when the individual and the people’s rights are to be restricted by the government.
The government should establish digital rights including, but not limited to, the public and the individual’s right to be informed, as an extension of the right to digital autonomy (including the ability to be fully aware and control the utilization of personal and behavioral data and footprints), the right to secrecy, the right to anonymity, the right to request non-digital/non-personal/non-automatic decision-making, and the right to meaningful alternatives,etc.
We urge your attention on the “Digital Bill of Rights,” by which a bottom-up approach is taken up by volunteering lawyers, tech experts, and human rights activists.

Footnote:
Please see Digital Bill of Rights v1.1 (drafted by JRF network)

2. About Personal Data Protection

Call upon the government to improve regulation on personal data protection, and follow clear and sound privacy protection principles.

Description:
We respectfully call upon the government to improve the regulation for personal data protection, ensuring the implementation of such regulation can align with clear and sound laws in privacy protection.
Specifically, we hope the government will:

1. Fulfill its promise and finish establishing the Personal Data Protection Commission before August 2025, as well as initiating further amendments to the Personal Data Protection Act for assuring data protection authoritys power and duties. We request the government to involve civil society engagement in the regulation deliberation process.
2. Ensure the independent agency protecting personal data has substantive power and resources equivalent to those of a second-tier agency and sufficient to monitor data collection and utilization in public and private sectors. The government should also actively and substantially supervise public departments and ensure accountability.

Footnote:
Please see CSO's Statement regarding the government's recent Proposed Amendment to the Personal Data Protection Act:

• Taiwan Association for Human Rights
• Judicial Reform Foundation

3. About Personal Data Breaches

Establish and implement substantive mechanisms for accountability and remedy in the event of personal data breaches in public offices.

Description:
The government should actively implement accountability and remedy mechanisms for personal data breaches in public sectors. The mechanism should include measures for damage control and remedial action, as well as standard operating procedures and a stringent timeline to prevent similar events from happening again. Specifically, for the incident in 2022 where over 23 million people’s household registration data were leaked, the government should immediately prevent further damage, implement substantive remedial plans, complete an independent investigation into the leak, and officially report the full details of the incident and the corresponding remedial plan to the public.

4. About Personal Medical Data

Call upon the government to respect the rights to consent and personal medical data control.

Description:
The government should lay down rules for explicit medical data protection, which should, at the minimum, include data related to health conditions, health insurance, medical records, and medical examination records. The government should respect the people’s right to informed consent, right to control data after provision, and right to withdraw consent, top ensure compliance with the medical ethics protected by the WMA Declaration of Taipei and others, as well as the patients’ right to dignity and informational autonomy, as guaranteed by the Constitutional Court Judgment No. 13 of 2022.

5. About Restricting Internet Access

The government should prevent the misuse and abuse of executive power in restricting internet access.

Description:
When interfering with online content (such as requiring taking down the content or banning the website), the government must premise itself under the principle of legal reservation and ensure the process is transparent and thoroughly documented. We also call upon the government to periodically publish statistics on internet content and access limitation demands.
Public authorities have a duty to ensure the neutrality and openness of the internet. When intervening in internet content (such as requesting the removal or blocking of websites), it must be based on clear legal authorization and in accordance with the principle of proportionality. Additionally, an independent oversight and remedy mechanism should be established. The government's enforcement process should also be transparent and fully documented, with regular publication of statistics on requests to restrict internet content or access.

Footnote:
Please see Article 7 of the Digital Bill of Rights v1.1 (drafted by JRF network)

6. About Digital Platforms

The government and enterprises should promote governing digital platforms under international human rights standards and establish accountability mechanisms to prevent human rights violations and negative impacts.

Description:
The government should promote and adopt legislation for digital platforms and other digital services that align with international human rights standards. The legislation should require responsibilities and obligations for digital service providers. Especially for internet platform providers above a certain scale, the government should establish human rights governing mechanisms that can handle third-party accountability and remedy for rights violations, to prevent various human rights violations and negative impacts. These measures should foster a safe network environment free from online violence and hate speech in collaboration with major digital platform providers and protecting freedom of speech.
Both Government and enterprises should actively promote a network environment favorable for mental health, internet privacy, and network safety for relatively marginalized communities. This includes, but is not limited to, preventing cyberbullying, child and youth sexual exploitation, gender-based online violence, hate speech, and content that encourages self-harm or addiction from children and youth.
Additionally, the government should require enterprises to adopt active measures in governing relevant content. Enterprises should establish prevention mechanisms and transparent censorship regulations for situations where algorithms may amplify negative material.

7. About UNGPs and human rights diligence law

The government should promote digital enterprises to follow UNGPs and human rights diligence laws, lowering risks for human rights violations.

Description:
The government should take into consideration the potential risks of human rights violations by digital technology enterprises such as digital monitoring and surveillance companies, relevant hardware, software, information sellers or agents, as well as telecom providers and large digital platform companies.
This includes, but is not limited to, promoting mandatory law on corporate human rights and environmental due diligence, requiring enterprises to operate in accordance with United Nations Guiding Principles on Business and Human Rights (UNGPs), requiring enterprises to coordinate internal capacities and procedures to take appropriate measures, and ensuring compliance with international human rights standards with the assistance of internal or external human rights experts.

8. About AI

Complete legislation on Artificial Intelligence or Computer-Aided Decision-Making to ensure that all related development and applications comply with human rights standards.

Description:
The government should complete legislation on Artificial Intelligence or Computer-Aided Decision-Making technology to ensure that all related development, products, and applications adhere to international human rights standards. This includes implementing transparency and interpretability, establishing accountability and independent oversight mechanisms with sufficient enforcement power , prohibiting technologies with high risk of human rights violations that cannot meet these standards, and establishing channels for individuals and groups to assert their rights and seek remedies, as well as identifying the responsible institutions for these purposes. Before developing or deploying Artificial Intelligence or Computer-Aided Decision-Making technologies, public authorities must disclose the legal basis for their use, the model training processes, the types and sources of training data, the scope of application, the degree of impact such systems will have on decisions, and the process and outcomes of human rights impact assessments. These human rights impact assessments must include the participation of civil society.

9. About Open Source

Include Open-Source and Civic Technology into the legislation process as the core strategy for public service and digital development.

Description:
Promote the development of open-source (open source code, open data, and open government), information commons and civic technology to advance the transparency, monitorability, and tenacity of public service and digital development. Particularly, free and open-source software (FLOSS) can advance sustainability, local innovation, and civic empowerment in digital development. The government should formulate policies and laws that include open source as the core strategy for public service and digital development.