Keeping track of the new Personal Data Protection Act

With technological advancements, information may be collected, processed, and analysed more efficiently than ever before and it is increasingly becoming one of the most important assets of companies. Privacy concerns are raised, however, when information obtained and used relates to the personal information of individuals. Governments worldwide have promulgated legislation to protect individual privacy. On April 27 2010, the Legislative Yuan of Taiwan passed the Personal Data Protection Act (the Act), amending and renaming the Computer-Processed Data Protection Act (the CPDPA), the primary regulation currently in place governing personal data protection in Taiwan. The legislative intent behind the Act is to expand the protection afforded under the CPDPA to cover not only the collection and processing of personal data by government agencies and the “eight major industries” (including telecommunications, financial, securities, insurance, mass media, schools, hospitals and/or any other enterprises, groups or individuals designated by the Ministry of Justice of Taiwan) but to all persons, such as government agencies, individuals, legal entities, and other groups (collectively, the “Persons” or respectively, the “Personal Data Controller”). In addition, the Act aims to protect not only personal data that is processed by computers as in the CPDPA, but also personal data processed by any means.

Although the Administrative Yuan has not announced the effective date of the Act, the Act has raised the concerns of enterprises across all industries given the broadened and uncertain scope of the Act. In the paragraphs below, we examine the influence the Act will have on personal data collection, processing, and use from the following three aspects.