(May 6, 2010) On April 27, 2010, Taiwan's legislature passed amendments to the 1995 Computer-Processed Personal Data Protection Law (Tien-nao ch'u-li ke-jen tzu-liao pao-hu fa). Under the proposed amendment, the Law's name will change to simply the Personal Data Protection Law. (Media Exempt from Privacy Act, TAIWAN TODAY, Apr. 28, 2010, available at http://taiwantoday.tw/ct.asp?xItem=100781&ctNode=452&mp=9.) The purpose of the amendments, according to a Ministry of Justice spokesperson, is “to halt the leaking of personal information and instances of people being smeared by elected officials and members of the media.” (Privacy Amendment Signals an End to Smears, TAIWAN TODAY, Apr. 21, 2010, available at http://taiwantoday.tw/ct.asp?xItem=99965&ctNode=452&mp=9.)
Earlier versions of the bill had created controversy. Taiwan media feared that what legislators saw as provisions creating a balance between the right to privacy and the freedom of the press constituted instead an attack on press freedom, because the provisions would have required journalists to seek the consent of individuals before making personal data public. (Ts'ai P'ei-fang, Third Reading Tomorrow, Blue Camp Calls on Ministry of Justice to Provide a Complete Set [of Related Measures] Within 3 Months [in Chinese], UNITED DAILY NEWS, Apr. 22, 2010, available at http://www.udn.com/2010/4/22/NEWS/NATIONAL/NAT3/5553143.shtml.) The issue had arisen after the second reading of the bill, when the Organic Laws and Statutes Committee removed a clause in the amendments exempting the media from the consent requirement. Violation of the law would have made offenders subject to fines of up to NT$500,000 (about US$15,950). (Maubo Chang, KMT Puts Brakes on Controversial Personal Data Act, TAIWAN NEWS, Apr. 22, 2010, available at http://www.etaiwannews.com/etn/news_content.php?id=1234214&lang=eng_
news&cate_img=83.jpg&cate_rss=TAIWAN_eng; Privacy Amendment Signals an End to Smears, supra.)
Under the final version of the bill adopted by the legislature, individuals and agencies in the non-public sector may “collect and use generally accessible personal data in the public interest or for interests that are greater than the protection of privacy.” Journalists will generally not be required, before seeking access to individuals' personal data, to inform them and ask for their consent. (Media Exempt from Privacy Act, TAIWAN TODAY, Apr. 28, 2010, available at http://taiwantoday.tw/ct.asp?xItem=100781&ctNode=452&mp=9.) Legislators reportedly also appended a resolution to the bill urging the government to seek advice from experts, scholars, and civic organizations to define “generally accessible personal data” and “public interest.” (Id.)
Article 51 stipulates that the provisions of the Law do not apply to personal data collected, handled, or used by an individual purely for purposes of private and family-related activities; to the posting of pictures of family and friends on the Internet; or to recorded media data collected, handled, or used in public places or in public activities that is not linked to other individuals' personal data. According to Chin Jeng-shyang, Director of the Department of Legal Affairs under the Ministry of Justice, however, “[i]nfringement of portrait rights is still covered under the regulations of the Civil Code … .” (Id.; 99/04/27 Chiang “Tien-nao ch'u-li ke-jen tzu-liao pao-hu fa” ming-ch'eng hsiu-cheng wei “Ke-jen tzu-liao pao-hu fa,”ping hsiu-cheng ch'üan wen [Text of bill after third reading, in Chinese], Legislative Yuan website, Apr. 27, 2010 , available at http://npl.l
y.gov.tw/do/www/newRecord.)
With certain exceptions, the new legislation prohibits the collection, handling, or use of personal data concerning medical treatments, genetic make-up, sexual orientation, health examinations, and prior criminal records. Among the exceptions are: in cases clearly prescribed by law; when necessary in order for public or non-public sector agencies to carry out their statutory duties where it is appropriate for measures to be taken to safeguard security; or where the personal data has been revealed by the individual himself or has been otherwise lawfully revealed (art. 6).