Article 1 |
|
Personal Information Protection Act(hereinafter “this Law”)is enacted to govern the collection, processing and use of personal information so as to prevent harm on personality rights, and to facilitate the proper use of personal information. |
|
Article 2 |
|
The terms used herein denote the following meanings:
5. Use: All methods of personal information use other than processing; 6. International transmission: The cross-border processing or use of personal information; 7. Government agency refers to a government agency or administrative juridical person at the central or local government level which is empowered to exercise sovereign power; 8. Non-government agency refers to the natural persons, juridical persons or groups other than those stated in the proceeding item; 9. The Party means an individual of whom the personal information has been collected, processed or used in accordance with this Law. |
|
Article 3 |
|
The following rights should be exercised by the Party with regard to his personal information and should not be waived in advance or limited by a specific agreement: |
|
Article 4 |
|
Whoever commissioned by a government agency or non-government agency to collect, process or use personal information should be considered the commissioning agency within the scope of this Law. |
|
Article 5 |
|
The rights and interests of the Party should be respected in collecting, processing or using personal information and the information should be handled in accordance with the principle of bona fide. It should not go beyond the purpose of collection and should be reasonable and fair. |
|
Article 6 |
|
Personal information of medical treatment, genetic information, sexual life, health examination and criminal record should not be collected, processed or used. However, the following situations are not subject to the limits set in the preceding sentence: |
|
Article 7 |
|
The written agreement mentioned in Item 2 of Article 15 and Item 5 of Article 19 means a written consent made by the Party after a notification given by the personal information collection based on this Law. |
|
Article 8 |
|
The following items should be told precisely to the Party by a government agency or non-government agency, in accordance with Article 15 or Article 19: |
|
Article 9 |
|
A government agency or non-government agency should notify the Party of the source of information and Item 1 to 5 of Paragraph 1 of the preceding Article, before processing or using personal information collected in accordance with Article 15 or 19 which was not provided by the Party.
2. When the Party has disclosed such information by himself or when the information has been publicized legally; 3. When the notification may not be made to the Party or his legal representative; 4. When it is necessary for public interests on statistics or the purpose of academic research. The information may not be used to identify a certain person after a treatment of the provider or the disclosure of the collector; 5. Personal information collected by the mass media for the purpose of news reporting on the basis of public interests; The notification mentioned in Paragraph 1 may be undertaken when the personal information is used against the Party for the first time. |
|
Article 10 |
|
Upon the request of the Party, the government agency or non-government agency should reply to the inquiry, offer for a review or provide duplications on the personal information collected, except the followings: |
|
Article 11 |
|
The government agency or the non government agency should ensure the accuracy of personal information, and correct or supplement it, ex officio or upon the request of the Party. |
|
Article 12 |
|
When the personal information is stolen, disclosed, altered or infringed in other ways due to the violation of this Law, the government agency or non-government agency should notify the Party after an inspection. |
|
Article 13 |
|
Where a request is made by the Party to the government agency or the non-government agency pursuant to Article 10, it should be determined within fifteen days. It may be extended to a time period of no longer than fifteen days when necessary and the Party should be notified of that in writing. |
|
Article 14 |
|
The government agency or the non-government agency may charge a fee to those who make an inquiry or request to review, or make duplications of the personal information. |
|
|
|||
Article 15 |
|
Except the information stated in Paragraph 1 of Article 6, the government agency should not collect or process personal information unless there is a specific purpose and should comply with one of the following conditions: |
|
Article 16 |
|
Except the information stated in Paragraph 1 of Article 6, the government agency should use the personal information in accordance with the scope of its job functions provided by laws and regulations, and in compliance with the specific purpose of collection. However, the information may be used outside the scope upon the occurrence of one of the following conditions: |
|
Article 17 |
|
The government agency may publicize the following items on the Internet or by other proper means for inquiries; the above provisions are applicable to amendment thereof: |
|
Article 18 |
|
The government agency which keeps personal information files should assign personnel(s) on security and maintenance of those files to prevent them from being stolen, altered, damaged, destroyed or disclosed. |
|
Chapter III Information Collection, Processing and Use by a Non-government Agency | |||
Article 19 |
|
Except the information stated in Paragraph 1 of Article 6, the non-government agency should not collect or process personal information unless there is a specific purpose and should comply with one of the following conditions: |
|
Article 20 |
|
Except the information stated in Paragraph 1 of Article 6, the non-government agency should use the personal information in accordance with the scope of the specific purpose of collection provided. However, the information may be used outside the scope upon the occurrence of one of the following conditions: |
|
Article 21 |
|
If one of the followings has occurred when the non-government agency transmits personal information internationally, the government authority in charge of subject industry may limit its action: |
|
Article 22 |
|
The government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government may perform an inspection by its staff workers who carry badges, if it is necessary for the protection of personal information, the disposal after termination of business, the limitation of international transmission, other routine examinations, or if this Law may be violated. Those who perform the inspection should illustrate the action, take necessary measures and provide relating documents. |
|
Article 23 |
|
The objects detained or duplicated in accordance with Paragraph 2 of the preceding Article should be sealed or tagged, and properly located. Those may not be carried or kept may be guarded by a designated personnel, or be kept by the owner or suitable persons. If it is no more necessary to keep the detained or duplicated objects, or when a punishment is not applied or a confiscation is not applied, those objects should be returned. However, it does not apply to objects that should be confiscated or kept for other cases. |
|
Article 24 |
|
The non-government agency, owner, holder, keeper or interested persons of those detained or duplicated objects may raise an objection to the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government for the demand, compulsory enforcement, detention, or duplication mentioned in the preceding two Articles. |
|
Article 25 |
|
For the non-government agency that violates the provisions of this Law, one of the following actions may be ordered jointly with a fine as regulated by the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government: |
|
Article 26 |
|
After performing the inspection mentioned in Article 22, the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government may publicize the result of that after the consent of the non-government agency, if there is no violation found. |
|
Article 27 |
|
The non-government agency which keeps personal information files should adopt proper security measures to prevent them from being stolen, altered, damaged, destroyed or disclosed. |
|
|
|||
Article 28 |
|
A government agency should be liable for damages and compensation caused by illegal collection, processing and using of personal information, or other ways of infringement on the rights of the Party due to violation of this Law. However, it does not apply to damages caused by natural disaster, incident or other force majeure. |
|
Article 29 |
|
A non-government agency should be liable for damages and compensation caused by illegal collection, processing and using of personal information, or other ways of infringement on the rights of the Party due to violation of this Law. However, it does not apply to the situation where the non-government agency can be proved to be unintentional or non-negligent. |
|
Article 30 |
|
The right to claim for damage compensation will be terminated two years since the claimant has been aware of the damages and the person(s) who is liable for the compensation, or five years since the date the damage actually occurred. |
|
Article 31 |
|
Aside from the provisions of this Law, the provisions of the State Compensation Law may be applied to a government agency, while the Civil Code may be applied to a non-government agency. |
|
Article 32 |
|
A business juridical person or a charitable juridical person that brings a case to the court in accordance with this Chapter should fulfill the following conditions: |
|
Article 33 |
|
The litigation brought to the court against a government agency in accordance with this Law should be subject to the exclusive jurisdiction of the district court where the agency is located. The litigation against a non-government agency is subject to the exclusive jurisdiction of the district court where its headquarters, main office of operation or domicile is located. |
|
Article 34 |
|
For cases caused by the same cause and fact and there are multi Parties infringed, the business juridical person or charitable juridical person may bring a lawsuit to the court by its own name, after obtaining a written authorization of litigation rights of 20 or more Parties. The Parties may withdraw their authorization by writing before the closure of the oral debate and the court should be notified of it. |
|
Article 35 |
|
The court proceedings should be discontinued partly if the Party withdraws his authorization of litigation right according to the first Paragraph of the preceding Article. The Party should resume the proceeding or the court may request the Party to do so, ex officio. |
|
Article 36 |
|
The extinctive prescription for the right to claim for damage compensation for each Party in accordance with Paragraph 1 and 2 of Article 34 should be calculated separately. |
|
Article 37 |
|
The business juridical person or charitable juridical person should act as the representative of litigation right authorized by the Party. However, the Party may set a limit on abandonment, withdrawal or reconciliation. |
|
Article 38 |
|
In the event the Party is object to the decision pursuant to Article 34, he may withdraw the authorization given to the business juridical person or charitable juridical person before the expiration of the period of an appeal and then file an appeal himself. |
|
Article 39 |
|
The business juridical person or charitable juridical person should deduct necessary litigation fees from the compensation received in accordance with the result of the case in Article 34 and deliver the remaining amount to the authorizing Parties. |
|
Article 40 |
|
The business juridical person or charitable juridical person should authorize its litigation right to an attorney while bringing out a lawsuit to the court in accordance with the provisions of this Chapter. |
|
|
|||
Article 41 |
|
A violation to Paragraph 1 of Article 6, Articles 15, 16, 17, 19 and Paragraph 1 of Article 20, or an order or disciplinary action of the limitation on international transmission made by the government authority in charge of subject industry at the central government level in accordance with Article 21 which may harm other people’s rights should be imposed of a sentence or custody of no more than 2 years, or a fine of no more than NT$200,000, or both. |
|
Article 42 |
|
A person who intends to make unlawful profits for himself or for a third party, or intends to infringe upon the interests of others by illegally changing or deleting personal information files, or by other illegal means and has impeded the accuracy of other people’s personal information files and caused damages to others should be imposed of an imprisonment or custody of no more than 5 years, or a fine of no more than NT$1,000,000, or both. |
|
Article 43 |
|
The above two Articles may be applicable to a citizen of the Republic of China who commits those crimes to citizens of the Republic of China outside the territory of the Country. |
|
Article 44 |
|
A government official who takes advantage of his position, or opportunity or means available to him to commit the offenses prescribed in this Chapter should be subject to punishments half as severe as those enumerated above. |
|
Article 45 |
|
The offenses referred to in this Chapter should be instituted only upon a complaint. However, the commission of the crime provided for pursuant to Paragraph 2 of Article 41, or the crime against the government agency pursuant to Article 42 is excluded from that. |
|
Article 46 |
|
In the event where a more severe punishment is provided for in other laws with respect to the offenses outlined in this Chapter, the more severe one should be applied. |
|
Article 47 |
|
Upon occurrence of any of the followings, the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government should impose an administrative fine of no less than NT$50,000 but no more than NT$500,000 on the non-government agency and should order the said agency to take corrective measures within a specified time period. In the event when the agency fails to do so, a fine should be imposed each time the violation occurs: |
|
Article 48 |
|
Upon occurrence of any of the following, the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government should order the non-government agency to take corrective measures within a specified time period. If they are not taken within that period, an administrative fine of no less than NT$20,000 but no more than NT$200,000 should be imposed upon the agency each time a violation of any of the followings occurs: |
|
Article 49 |
|
A non-government agency violates the provisions of Paragraph 4 of Article 22 without proper reasons should be imposed of an administrative fine of no less than NT$20,000 by the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government. |
|
Article 50 |
|
The main representative, manager or other representative of a non-government agency who should be imposed of an administrative fine due to the violation of the preceding three Articles of the agency should be subject to the same amount of the fine, unless the obligation of the representative has been proved to be fulfilled. |
|
Chapter VI Supplementary Provisions |
|||
Article 51 |
|
The provisions of this Law are not applicable to the following situations: |
|
Article 52 |
|
The competencies prescribed to the government authority in charge of subject industry at the central government level, municipality directly under the central government, or county or city government may be appointed to the subordinate agencies, other agencies or charitable groups. The personnel of such agencies should fulfill the obligation of confidentiality for all the information obtained during the job-undertaking.
The charitable groups prescribed in the preceding Paragraph should not be authorized by the Party in accordance with Paragraph 1 of Article 34 for litigation rights and should proceed to the action for damages in its own name. |
|
Article 53 |
|
The specific purpose and the classification of personal information stipulated in this Law should be prescribed by the Ministry of Justice in conjunction with the government authority in charge of subject industry at the central government level. |
|
Article 54 |
|
For the personal information which is not provided by the Party before the amendment of this Law and is subject to a notice to the Party prior to processing or use in accordance with Article 9, the personal information controller should fulfill its notice duty within one year after the effective date of this Law Amendment. Any processing or use of the personal information without notification in the overdue period of time is regarded as violation of Article 9. |
|
Article 55 |
|
The Enforcement Rule of this Act shall be prescribed by the Ministry of Justice. |
|
Article 56 |
|
The date for enforcement of this Act shall be set by the Executive Yuan. |