Statement | JRF's Recommendations on the Draft Amendment to the Enforcement Rules of the Personal Data Protection Act and the Draft Regulations on Notification, Reporting, and Response for Personal Data Incidents Proposed by the Preparatory Office of the Personal Data Protection Commission

Last edited: 2026-08-25

Judicial Reform Foundation

The Judicial Reform Foundation (hereinafter referred to as the "JRF") has long focused on digital governance and human rights and is committed to advancing the rule of law in the area of digital rights. In light of the growing trend toward large-scale collection and cross-referencing of individuals' personal data and behavioral data by both the public and private sectors, as well as the recurring occurrence of personal data breaches and other incidents, the JRF pays particular attention to the realization of people's rights to informational privacy and informational self-determination.

Regarding the draft partial amendments to the Enforcement Rules of the Personal Data Protection Act announced for public comment by the Preparatory Office of the Personal Data Protection Commission on January 22 of this year, and the draft Regulations for Personal Data Breach Notification, Reporting and Response announced on the same day, the JRF proposes the following suggestions for revising the drafts:

I. Regarding the draft partial amendments to the Enforcement Rules of the Personal Data Protection Act:

(I) The criteria for determining "making it impossible to identify a specific data subject" should incorporate trends in technological development

Regarding the proposed revision to the definition of "making it impossible to identify a specific data subject" in Article 17 of the draft amendments, further consideration should be given to the "temporal dimension" and "dynamic nature" of the assessment criteria. The current draft limits the assessment benchmark solely to technological methods "available at the time of processing." Such a static definition may fail to reflect the rapidly changing nature of information technology.

The JRF suggests drawing on the spirit of Recital 26 of the EU GDPR, under which determining whether data has been rendered anonymous should not be limited solely to the technological capabilities available at the time of processing, but should also take "technological developments" into account. It is recommended that the provision be amended to read: "'Making it impossible to identify a specific data subject' means that, taking into account the level of technology available at the time of data processing and trends in technological development, the data can no longer directly identify a specific natural person." This would ensure that, when assessing whether data qualifies for the special status of "making it impossible to identify a specific data subject"—for example, as a condition for a lawful exception or exemption—consideration can be given to realities such as rapidly increasing computing power, including the threat of "Harvest Now, Decrypt Later" (HNDL), large-scale data linkage, and the rapid development of new algorithms.

Note: GDPR Recital 26: "taking into consideration the available technology at the time of the processing and 'technological developments'."

II. Regarding the draft Regulations for Personal Data Breach Notification, Reporting and Response:

(I) A more time-sensitive tiered reporting and notification mechanism should be designed by taking into account the severity of the incident and the sensitivity of the personal data

Regarding the 72-hour time limit for incident notification and reporting provided in Articles 2 and 3 of the draft, it is recommended that a more time-sensitive tiered reporting and notification mechanism be established by taking into account the severity of the incident, such as the volume of data or number of data subjects involved, and the sensitivity of the personal data, such as household registration information including national identification numbers and addresses, or special categories of personal data.

For high-risk breach scenarios, the draft should include flexible provisions allowing shorter reporting and notification deadlines, requiring prompt reporting to the competent authority upon discovery and immediate measures to notify affected data subjects, thereby enabling affected individuals to take early precautions against identity theft or financial risks.

To balance the administrative burden on both public and private sectors, it is recommended that a complementary procedure be adopted under which an initial preliminary notification is submitted first and detailed information is supplemented later. Active cooperation with reporting and notification requirements at the earliest stage should also be taken into account as a mitigating factor in subsequent determinations of legal liability, thereby striking a balance between strengthening public information security and maintaining practical feasibility.

(II) Specific criteria for determining "disproportionate effort" should be clearly established to prevent abuse

Regarding Article 2, Paragraph 1, Subparagraph 3 of the proviso to the draft, which provides that where "the method adopted for individually notifying data subjects would involve disproportionate effort and affect the operations of the agency responsible for the incident," the obligation to individually notify data subjects may be exempted, the JRF recommends that specific criteria for determining such circumstances be formulated with caution.

The current definitions of "disproportionate effort" and "affecting operations" remain somewhat vague. This may lead public and private entities to overuse the provision after an incident in order to reduce administrative costs and thereby evade their legal obligation to individually notify data subjects.

To effectively prevent abuse, strict and specific substantive thresholds should therefore be added, and the burden of proof should rest with the agency invoking the exemption.

(III) The statutory period for public disclosure of incidents should be extended

Regarding the requirement in Article 2, Paragraph 1 that information be "publicly disclosed for at least 30 consecutive days," consideration should be given to the long-term and concealed nature of harm caused by personal data breaches.

A 30-day public disclosure period may not be sufficient to ensure that all affected data subjects become aware of the incident and are able to take appropriate risk-mitigation measures. It is therefore recommended that the statutory disclosure period be extended, or that a flexible adjustment mechanism be established based on the scale of the incident's impact and the sensitivity of the data involved.

(IV) Incident impact reports should account for the concealed and delayed nature of harm arising from personal data incidents

Regarding Article 6, Paragraph 1, Subparagraph 6 of the draft, which requires incident records to document "the impact caused by the personal data incident," it is recommended that a specific obligation to "update and track reports" be added in order to address the fact that harm arising from personal data incidents is often concealed and delayed.

Once personal data has been leaked, the threat of unlawful secondary use or derivative fraud may not become apparent until months or even years after the incident. A one-time incident investigation report is therefore unlikely to fully assess the actual harm.

Accordingly, the draft should require agencies responsible for an incident to undertake a continuing monitoring obligation rather than allowing their response responsibilities to terminate immediately after the initial report.