Legal Opinion | Civil Society Draft Amendments to the Personal Data Protection Act

On May 29, 2025, in response to the draft amendments to the "Personal Data Protection Act" announced by the Executive Yuan on March 27, 2025, the Judicial Reform Foundation proposed an NGO version of the amendments to the Personal Data Protection Act for public reference.

To establish an independent oversight mechanism for personal data protection in Taiwan and to deepen the implementation of personal data protection, the Executive Yuan proposed the draft Organic Act of the Personal Data Protection Commission and draft amendments to certain provisions of the Personal Data Protection Act on March 27, 2025. This initiative intends to establish the Personal Data Protection Commission as an independent regulatory authority and empower it with necessary supervisory functions, such as uniformly accepting data breach notifications, in alignment with international trends in regulatory models for personal data protection adopted by advanced nations. Looking at the draft amendments to certain provisions of the "Personal Data Protection Act" proposed by the Executive Yuan this time, although they represent an improvement over the current regulations, the contents appear to have shortcomings such as ineffective response efficiency and inadequate protection of the rights and interests of data subjects. These are explained as follows:

1. Addition and amendment of sensitive data categories: Regarding Article 6 of the draft amendments, this Foundation believes that four categories of data—"racial or ethnic origin," "political opinions," "religious beliefs," and "trade union membership"—should be added to strengthen the protection of personal data belonging to specific sensitive categories. Furthermore, since such data are sensitive enough to seriously affect rights and interests, they should be included within the scope of protection.

2. Notification methods and public disclosure of personal data breach incidents: Regarding Article 12 of the draft amendments, this Foundation believes that government agencies and non-government agencies should notify the victims of the "specific content" of a personal data breach incident "promptly and in an appropriate manner," and report it to the competent authority. When necessary, the competent authority may also require such agencies to "publicly disclose" the personal data breach incident and its content so that all sectors can take responsive measures in a timely manner.

3. Regarding Article 15 of the draft amendments, this Foundation believes that subparagraph 3 concerning "no infringement upon the rights and interests of the data subject" should be deleted for the following reasons:

• This exception provision is far removed from today's world of frequent information circulation; its application can neither ensure that there is absolutely no impact on any individual's rights and interests, and subparagraphs 1 and 2 are already sufficient for government agencies to complete the collection of personal data;
  
• In addition, retaining this exception provision may enable government agencies, after illegally collecting or processing personal data, to argue on this basis that there is no infringement upon the data subject, thereby causing severe harm to the privacy of the people.
  
  

4. Regarding Article 16 of the draft amendments, this Foundation believes that paragraph 1, subparagraph 6 concerning "favorable to the rights and interests of the data subject" should be deleted, for the same reasons stated in "3." above.

5. Regarding Article 18 of the draft amendments, this Foundation believes that when the competent authority formulates relevant measures pursuant to paragraph 5, it should include the professional knowledge, experience, and qualification certification thresholds required for personnel such as data protection officers, and explicitly stipulate detailed restrictions on "qualification acquisition, concurrent holding of posts, and concurrent employment," thereby using institutional safeguards to guarantee the independence of such personnel in exercising their official powers and avoiding conflicts of interest.

6. Regarding Article 19 of the draft amendments, this Foundation believes that paragraph 1, subparagraph 8 concerning "no infringement upon the rights and interests of the data subject" should be deleted, for the same reasons stated in "3." above.

7. Regarding Article 20 of the draft amendments, this Foundation believes that paragraph 1, subparagraph 7 concerning "favorable to the rights and interests of the data subject" should be deleted, for the same reasons stated in "3." above.

8. Regarding Article 21-1 of the draft amendments, since current regulations only provide for an internal audit system where superior agencies audit subordinate agencies, this Foundation believes that an "external audit" provision should be added. Specifically, the competent authority should "regularly commission external independent institutions to conduct sampling and audits" and "establish a public disclosure mechanism" to ensure that audit results are objective and neutral, and to avoid issues such as internal formalistic auditing and negligence of risks.

9. Regarding Article 21-2 of the draft amendments, this Foundation believes that the results of the competent authority's audits on government agencies' implementation of personal data protection management matters should be "actively made public at least once every two years" for public review of implementation effectiveness.

10. Regarding Article 21-4 of the draft amendments, since current regulations only impose relevant penalties when non-government agencies violate this Act, this Foundation believes there is a lacuna in this regard. Therefore, a provision should be added stating that personnel belonging to government agencies who fail to handle matters in accordance with the provisions of this Act shall be disciplined pursuant to the "Regulations on Disciplinary Matters Formulated by the Competent Authority," so as to clarify the legal basis for relevant disciplinary actions.

11. Addition of Article 48-1: This Foundation believes that it is inappropriate for this Act to have lacked clear penalties for government agencies violating relevant provisions of this Act over the years. Therefore, mirroring the penalty regulations for non-government agencies, penalties should be added for government agencies violating Article 21-4 thereof.

12. Regarding Article 51-1 of the draft amendments, the current provision grants the competent authority a period of up to six years for establishment. However, this Foundation believes that given substantial practical experience in personal data protection and the need in this information-explosion era for the government to provide prompt protection for citizens' personal data, the establishment of the relevant unified regulatory system should be completed "within two years" from the date of the establishment of the competent authority, in order to meet societal expectations.