New Personal Data Protection Act Scheduled by Executive Yuan to Take Effect

09/28/2012

---

On September 21, 2012, the Executive Yuan ordered that except for Articles 6 and 54, the new Personal Data Protection Act (the "New Act"), promulgated on May 26, 2010, take effect on October 1, 2012.

Article 6 of the New Act governs the collection, processing, and use of sensitive personal data such as medical history, genetic records, sex life, health check results and criminal records. Article 54 requires data collectors to notify data subjects within one year of the effective date of the New Act if the personal data the collectors would like to process or use were not obtained directly from the data subjects before the effective date.

On September 26, 2012, the Ministry of Justice also announced that the Enforcement Rules of the Computer-Processed Personal Data Protection Act were amended and renamed "Enforcement Rules of the Personal Data Protection Act," and will take effect, along with the New Act (Personal Data Protection Act), on October 1, 2012. The new Enforcement Rules enumerate the methods of sending a written consent or a notification under the New Act, define "proper security measures" prescribed in the New Act, and explain and regulate other critical matters related to the New Act.

Meanwhile, as the personal data protection laws in China are still inadequate, and Taiwanese communications enterprises are required to evaluate whether the transferee nations have comprehensive legal protections for personal data before making cross-border transfer of or using personal data, on September 25, 2012, the National Communications Commission issued a blanket order prohibiting all communications enterprises from transferring subscribers' personal data to China.

If you have any questions about the New Act or any related matter, please feel free to contact our Personal Data Protection Practice Group. Thank you!