Draft of the amendments to the Computer-Processed Personal Data Protection Law; maximum compensation for illegal collection and use of personal data will be NT$50,000,000
E030410Y9 May. 2003（E44）
The Ministry of Justice yesterday accomplished the preliminary draft of the amendments to the Computer-Processed Personal Data Protection Law (the “Law”). According to the draft, the maximum compensation payable by official and non-official organizations illegally collecting and using personal data will be raised from NT$20,000,000 to NT$50,000,000. Therefore, a victim may immediately claim compensation without the need to produce proof of damage if he suffers non-property damage. This amendment will make a great stride in protecting people’s privacy.
According to the above draft, mobile phone communications companies and credit information centers must pay compensation of higher amount if they illegally leak out person data. Besides, if a cram school directly collects family data from children without their parents’ consent, the cram school must assume its liability of compensation for such illegal act. Even a school needs to obtain parents’ consent if it wants students to fill in personal or family data; otherwise, the school will violate the Law.
The recent amendments to the Law have made the widest range since legislation of the Law in 1995. The lines of businesses that may apply the Law will not be limited to the current statutory eight lines of business such as official agencies and credit services but also will include conduct of process personal data by computer. A person will not be subject to the regulations of the Law only when he processes personal data by computer for his or family’s activities (e.g. contact information about friends or relatives).
The key points of the amendments to the Law are as follows:
In addition to exceptional circumstances such as legal collection, the concerned party should be clearly informed of the purpose of collection and the method of use while collecting data from such party. If the concerned party’s data is collected indirectly though a third person, the source of the concerned party’s data, the purpose of collection and the method of use must be informed in principle. The competent authority will first order a violator of the aforementioned provisions to rectify within a time limit, and may punish the doer or the company’s responsible person a fine of NT$10,000-NT$50,000 based on the times of failure to rectify.
Provisions prohibiting collection of sensitive data are added to the amendments. A violator will be subject to a fine of NT$20,000-NT$100,000 based on the times of violation. Sensitive data refers to personal data about criminal records, health, medical treatment or genes.
Meanwhile, the amendments add the basis to establish a public welfare corporate organization for protecting personal data. Such organization’s function is like Consumers’ Foundation so that the organization can accept the public’s appointment when their personal data is infringed, check their claims, correct the right to data, or initiate an action to claim compensation, etc. To encourage the public to exercise their rights collectively, the cost of action for the trail at the court of 1st instance and the cost on the part of the object which exceeds NT$600,000 for the trial at the court of 2nd instance can be exempted if the Foundation is appointed to initiate a civil action on behalf of more than twenty persons.
Any person who interferes, deletes or changes personal data for his or another’s illegal benefits, or to harm another’s benefits, shall be punished with a prison term increased from not more than three years to not more than five years. Public officials (such as from motor vehicles offices, household registration offices or police offices) who collect or use personal data in violation of the provisions shall be punished with a fine of NT$20,000-NT$100,000.
