Personal vs. Sensitive Data Under Taiwan's Personal Data Protection Act (PDPA)
Taiwan’s Personal Data Protection Act, or PDPA, is a landmark piece of legislation that provides comprehensive protection regarding the use of personal data by private entities or governmental agencies. Article one of the PDPA’s General Provisions defines the act as “enacted to regulate the collection, processing and use of personal data to prevent harm to personality rights and facilitate the proper use of personal data.”
Entities found in violation of the PDPA face both civil and criminal liability. The provisions of Directive 95/46/EC, the OECD guidelines, and the APEC privacy framework were all referenced while drafting the PDPA. However, no government agency has been designated as the official authority for PDPA-related issues. Nor have any official regulations or guidelines been set forth. Instead, each industry is encouraged to draft and adhere to its own data guidelines.
Official channels have published two handbooks on PDPA guidelines. Industries, organizations, and agencies are encouraged to create data protection policies using these documents as a guide. These policies govern how entities gather, process, and use personal information.
Taiwan’s PDPA categorizes data in two ways: personal and sensitive data. Special protections and procedures cover sensitive data under the Personal Data Protection Act. Therefore, understanding which information falls under each category is essential for remaining compliant with the PDPA.
Personal Data
Taiwan’s Personal Data Protection Act defines “personal data” as any information used to indirectly or directly identify any individual natural person. This data is the least regulated of the two sets and is subject to a few limitations. Therefore, the use of personal data is permissible under the PDPA, following specific guidelines.
Personal data includes:
name
birthdate
ID card number
passport number
characteristics
fingerprints
marital status
family
education
occupation
medical records
medical treatment
genetic information
sexual life
health examinations
criminal records
contact information
financial situation
social activities
How to Legally Obtain and Use Personal Data in Taiwan
The government of Taiwan may prohibit the use, collection, processing, or retention of data if such activities violate the PDPA. The consequences of PDPA violations can include data destruction, fines, or arrest. Therefore, avoiding these violations begins with obtaining data legally.
Adherence to the PDPA is critical. Understanding the legal process for obtaining and using data prevents breaches and violations. There are three steps entities must take to collect, process, and use personal data while remaining PDPA compliant:
Provide the subject with disclosure of intent to gather, process, and utilize their data. This disclosure should include the scope of the matter and how the data will be used. Failure to give proper disclosure violates the subject’s rights to data privacy as outlined in the Personal Data Privacy Act.
Obtain consent, except in certain circumstances. No permission is needed if the data is legally published or the subject has made a willing public disclosure. Consent need not be in writing, but proof of consent is required.
Adhere to the scope and intent of the matter. Data used in one case involves re-authorization for future use.
Sensitive Data
Article 6 of the PDPA defines sensitive data, a subset of personal data, as any personal information concerning medical records, medical treatment, genetic information, sexual life, health examinations, and criminal records. The collection, processing, and use of sensitive data are prohibited under the PDPA except under the following circumstances:
Where required by a government agency to meet a legal obligation, appropriate security measures must be implemented before or after collecting, processing, and using this data.
The subject has made a voluntary public disclosure of the data, or where the data has been legally published.
Where it’s necessary to perform academic research or gather statistical information, an educational organization or government agency may collect personal data for public health, medical treatment, or public safety/crime prevention. The information must not lead to the identification of subjects either through disclosure by the collector or through processing.
When a government agency must meet its legal duties or a non-government agency must meet its legal obligations, adequate safety measures must be taken.
Where the subject has given written consent, written consent does not authorize collecting, processing, or using personal data that falls outside the specific intent’s necessary scope. In addition, data restricted by any other statute is not authorized for use. Finally, written consent must be obtained freely and voluntarily.
Sensitive Data vs. Personal Data
The differences between personal and sensitive data are apparent. Personal data is information about your identity, whereas sensitive data is information about your life. Under the PDPA, a natural person’s identifying information carries less weight than insights into their family life, daily activities, and career.
The PDPA protects an individual’s life details, which could cause harm, embarrassment, prejudicial treatment, reputational damage, retribution, exclusion, loss of opportunity, and other detriments. Therefore, thoroughly understanding this legislation is the first step toward compliance.
