In order to strengthen the protection of personal data, Taiwan's Computer Processed Personal Data Protection Act was amended in May 2010. The new Act extends to all persons, natural or juristic, and all personal data directly or indirectly leading to a living natural person. In particular, sensitive personal data, including medical treatment, gene, sexual life, health check and criminal records, are in principle not allowed to be collected.
Given the breadth of the new Act, the effective date of the new Act will be announced by the Executive Yuan (instead of coming into force after the promulgation) in order to allow affected parties plenty of time to prepare. The target effective date of the new Act is expected to be July 1 2012.
The government has also been busy revising the Enforcement Rules of the new Act. After intensive consultations with various industries, the first draft Enforcement Rules were released for public comments late last year. Unsurprisingly, many complaints or disagreements have emerged, which include, among others:
- the incomprehensiveness related to international transfer of personal data;
- whether only mass collection of personal data is to be regulated;
- the appropriateness of heavy-handed criminal penalties on breaches without profit-seeking intent;
- the excessive restriction on collection of sensitive personal data; and
- the burden and timing for notification to the data subject within one year of coming into force for personal data indirectly collected before the new Act.
A new cabinet recently took office, and the Ministry of Justice, the ministry in charge of the new Act, reported to the Premier about its plans for partially bringing into force the new Act, while at the same time introducing amendments to the new Act into the legislative body.
Considering the disagreements from the financial industry and many others, the premier instructed the Ministry to submit an evaluation report within two months in order to decide the next step forward. It is strongly believed that the original target date will not be met, and the coming into force of the new Act will be further delayed.