New Personal Data Protection Act Will Take Effect in Stages From October 1, 2012 Executive Yuan Proposed Further Amdnements to the Personal Data Protection Act

09/14/2012

---

The amendments to the Personal Data Protection Act (the "Act") were promulgated by the President on May 26, 2010, with the effective date to be further determined and announced by the Executive Yuan. However, given the public's concern with some of the amendments, the Executive Yuan has not yet announce the effective date of the amendments. In response to the public's concern, the Executive Yuan passed a draft amendment to Articles 6, 41, 45 and 54 of the Act (the "Further Amendment") on August 30, 2012, and submitted it to the legislature for deliberation. According to the press release of the Ministry of Justice dated September 4, 2012, except for Articles 6 and 54 of the Act, the remaining articles of the Act are expected to take effect on October 1, 2012.
The Further Amendment is summarized as follows:
1.	In addition to personal data concerning medical treatments, genetic records, sex life, health check results and criminal records, the Executive Yuan proposed the inclusion of “medical records” as a type of sensitive personal data that in principle should not be collected, processed or used. The Executive Yuan proposed to include the following as two additional exemptions from the restrictions on the collection, process and use of sensitive personal data: (i) when it is necessary for the purposes of serving public interests; and (ii) when written consent of the data subject is obtained. Also, the Further Amendment expressly specifies that (i) when collecting, processing or using sensitive personal data, one must comply with the notification obligations set forth under Articles 8 and 9 of the Act; and (ii) when written consent of the data subject concerning sensitive personal data is sought, the requirements under Article 7 of the Act must be met. (Article 6 of the Further Amendment).
2.	Acts in violation of the Act will no longer be subject to criminal sentences if such violations are committed without intent to gain profits (Articles 41 and 45 of the Further Amendment).
3.	After the Further Amendment takes effect, if a data collector would like to process or use personal data not obtained directly from the data subject himself/herself before May 26, 2010, the enactment date of the Act, the data collector should notify the data subject in accordance with Article 9 of the Act before the personal data is processed or used or when the data is about to be used for the first time (Article 54 of the Further Amendment).
If you have any questions about the Act or the Further Amendment, please feel free to contact our Personal Data Protection Practice Group. Thank you.