Personal Data Protection Act - Article Content - Laws ...

"Consent", as referred to in Subparagraph 2, Paragraph 1, Article 15 and Subparagraph 5, Paragraph 1, Article 19, means a declaration of agreement given by ... GotoMainContent ::: Location： Home Law ArticleContent P Print SelectFolders： Save Save AddNewFolder ManageFolders ArticleContent Title： PersonalDataProtectionAct CH AmendedDate： 2015-12-30 Category： NationalDevelopmentCouncil（國家發展委員會） ArticleContent Chapter ArticleNoSearch ContentSearch LegislativeHistory ChapterIGeneralProvisions Article1ThePersonalDataProtectionAct（hereinafter,the"PDPA"）isenactedtoregulatethecollection,processinganduseofpersonaldatasoastopreventharmonpersonalityrights,andtofacilitatetheproperuseofpersonaldata. Article2Thetermsusedhereindenotethefollowingmeanings:1."personaldata"referstoanaturalperson'sname,dateofbirth,IDCardnumber,passportnumber,features,fingerprints,maritalstatus,familyinformation,educationbackground,occupation,medicalrecords,healthcaredata,geneticdata,dataconcerningaperson'ssexlife,recordsofphysicalexamination,criminalrecords,contactinformation,financialconditions,dataconcerningaperson'ssocialactivitiesandanyotherinformationthatmaybeusedtodirectlyorindirectlyidentifyanaturalperson;2.a"personaldatafile"referstoacollectionofpersonaldatastructuredtofacilitatedataretrievalandmanagementbyautomatedornon-automatedmeans;3."collection"referstotheactofcollectingpersonaldatainanyway;4."processing"referstotheactofrecording,inputting,storing,compiling/editing,correcting,duplicating,retrieving,deleting,outputting,connectingorinternallytransferringdataforthepurposeofestablishingorusingapersonaldatafile;5."use"referstotheactofusingpersonaldataviaanymethodsotherthanprocessing;6."cross-bordertransfer"referstothecross-borderprocessingoruseofpersonaldata;7."governmentagency"referstoacentralorlocalgovernmentagencyoradministrativeentityauthorizedtoexercisepublicauthority;8."non-governmentagency"referstoanaturalperson,legalpersonorgroupotherthanthosestatedintheprecedingsubparagraph;and9."datasubject"referstoanindividualwhosepersonaldataiscollected,processedorused. Article3Adatasubjectshallbeabletoexercisethefollowingrightswithregardtohis/herpersonaldataandsuchrightsshallnotbewaivedorlimitedcontractuallyinadvance:1.therighttomakeaninquiryofandtoreviewhis/herpersonaldata;2.therighttorequestacopyofhis/herpersonaldata;3.therighttosupplementorcorrecthis/herpersonaldata;4.therighttodemandthecessationofthecollection,processingoruseofhis/herpersonaldata;and5.therighttoerasehis/herpersonaldata. Article4Whoeveriscommissionedbyagovernmentagencyornon-governmentagencytocollect,processorusepersonaldatashallbedeemedtobeactingonbehalfofthecommissioningagencytotheextentthatthePDPAapplies. Article5Thecollection,processinganduseofpersonaldatashallbecarriedoutinawaythatrespectsthedatasubject'srightsandinterest,inanhonestandgood-faithmanner,shallnotexceedthenecessaryscopeofspecificpurposes,andshallhavelegitimateandreasonableconnectionswiththepurposesofcollection. Article6Datapertainingtoanaturalperson'smedicalrecords,healthcare,genetics,sexlife,physicalexaminationandcriminalrecordsshallnotbecollected,processedorusedunlessonanyofthefollowingbases:1.whereitisexpresslyrequiredbylaw;2.whereitiswithinthenecessaryscopeforagovernmentagencytoperformitsstatutorydutiesorforanon-governmentagencytofulfillitsstatutoryobligation,providedthatpropersecurityandmaintenancemeasuresareadoptedpriororsubsequenttosuchcollection,processingoruseofpersonaldata;3.wherethepersonaldatahasbeendisclosedtothepublicbythedatasubjectorhasbeenmadepubliclawfully;4.whereitisnecessaryforstatisticsgatheringoracademicresearchbyagovernmentagencyoranacademicinstitutionforthepurposeofhealthcare,publichealth,orcrimeprevention,providedthatsuchdata,asprocessedbythedataproviderorasdisclosedbythedatacollector,maynotleadtotheidentificationofaspecificdatasubject;5.whereitisnecessarytoassistagovernmentagencyinperformingitsstatutorydutiesoranon-governmentagencyinfulfillingitsstatutoryobligations,providedthatpropersecurityandmaintenancemeasuresareadoptedpriororsubsequenttosuchcollection,processing,oruseofpersonaldata;or6.wherethedatasubjecthasconsentedtothecollection,processinganduseofhis/herpersonaldatainwriting,exceptwherethecollection,processingoruseexceedsthenecessaryscopeofthespecificpurpose,orwherethecollection,processingorusebasedsolelyontheconsentofthedatasubjectisotherwiseprohibitedbylaw,orwheresuchconsentisnotgivenbythedatasubjectoutofhis/herfreewill.Articles8and9shallapplymutatismutandistothecollection,processing,oruseofpersonaldatainaccordancewiththeprecedingparagraph;Paragraphs1,2and4ofArticle7shallapplymutatismutandistotheconsentrequiredunderSubparagraph6oftheprecedingparagraph. Article7"Consent",asreferredtoinSubparagraph2,Paragraph1,Article15andSubparagraph5,Paragraph1,Article19,meansadeclarationofagreementgivenbyadatasubjectafterhe/shehasbeeninformedbythedatacollectoroftheinformationrequiredunderthePDPA."Consent",asreferredtoinSubparagraph7,Paragraph1,Article16andSubparagraph6,Paragraph1,Article20,meansaseparatedeclarationofagreementgivenbyadatasubjectafterhe/shehasbeeninformedbythedatacollectorofanyofthepurposesotherthanthatoriginallyspecified,thescopeofotheruse,andtheimpactofgivingornotgivingconsentontherightsandinterestsofthedatasubject.Thedatasubject'sconsentmaybepresumedgivenpursuanttoSubparagraph2,Paragraph1,Article15andSubparagraph5,Paragraph1,Article19ifthedatasubjectdoesnotindicatehis/herobjectionandaffirmativelyprovideshis/herpersonaldataafterthegovernmentornon-governmentagencyhasinformedthedatasubjectoftherelevantinformationspecifiedinParagraph1,Article8ofthePDPA.DatacollectorshallbeartheburdenofproofregardingthefactthatdatasubjecthasgiventheconsentprescribedunderthePDPA. Article8Agovernmentornon-governmentagencyshallexpresslyinformthedatasubjectofthefollowinginformationwhencolletingtheirpersonaldatainaccordancewithArticle15or19ofthePDPA:1.thenameofthegovernmentornon-governmentagency;2.thepurposeofthecollection;3.thecategoriesofthepersonaldatatobecollected;4.thetimeperiod,territory,recipients,andmethodsofwhichthepersonaldataisused;5.thedatasubject'srightsunderArticle3andthemethodsforexercisingsuchrights;and6.thedatasubject'srightsandintereststhatwillbeaffectedifhe/sheelectsnottoprovidehis/herpersonaldata.Theobligationtoinformasprescribedintheprecedingparagraphmaybewaivedunderanyofthefollowingcircumstances:1.wherenotificationmaybewaivedinaccordancewiththelaw;2.wherethecollectionofpersonaldataisnecessaryforthegovernmentagencytoperformitsstatutorydutiesorthenon-governmentagencytofulfillitsstatutoryobligation;3.wheregivingnoticewillpreventthegovernmentagencyfromperformingitsstatutoryduties;4.wheregivingnoticewillharmpublicinterests;5.wherethedatasubjecthasalreadyknownthecontentofthenotification;or6.wherethecollectionofpersonaldataisfornon-profitpurposesandclearlyhasnoadverseeffectonthedatasubject. Article9Agovernmentornon-governmentagencyshall,beforeprocessingorusingthepersonaldatacollectedinaccordancewithArticle15or19whichwasnotprovidedbythedatasubject,informthedatasubjectofitssourceofdataandotherinformationspecifiedinSubparagraphs1to5,Paragraph1oftheprecedingarticle.Theobligationtoinformasprescribedintheprecedingparagraphmaybeexemptunderanyofthefollowingcircumstances:1.underanyofthecircumstancesprovidedinParagraph2oftheprecedingarticle;2.wherethepersonaldatahasbeendisclosedtothepublicbythedatasubjectorhasbeenmadepubliclawfully;3.whereitisunabletoinformthedatasubjectorhis/herstatutoryrepresentative;4.whereitisnecessaryforstatisticsgatheringoracademicresearchinpursuitofpublicinterests,providedthatsuchdata,asprocessedbythedataproviderorasdisclosedbythedatacollector,maynotleadtotheidentificationofaspecificdatasubject;or5.wherethepersonaldataiscollectedbymasscommunicationenterprisesforthepurposeofnewsreportingforthebenefitofpublicinterests.TheobligationtoinformasprescribedinParagraph1maybeperformedatthetimeofthefirstuseofthepersonaldatatowardsthedatasubject. Article10Upontherequestofadatasubject,thegovernmentornon-governmentagencyshallreplytothedatasubject'sinquiry,allowthedatasubjecttoreviewthepersonaldatacollected,orprovidethedatasubjectwithacopythereofexceptunderanyofthefollowingcircumstances:1.wherenationalsecurity,diplomaticormilitarysecrets,overalleconomicinterestsorothermaterialnationalinterestsmaybeharmed;2.whereagovernmentagencymaybepreventedfromperformingitsstatutoryduties;or3.wherethematerialinterestsofthedatacollectorsoranythirdpartiesmaybeadverselyaffected. Article11Agovernmentornon-governmentagencyshallensuretheaccuracyofpersonaldatainitspossessionandcorrectorsupplementsuchdataonitsowninitiativeorupontherequestofdatasubjects.Intheeventofadisputeregardingtheaccuracyofthepersonaldata,thegovernmentornon-governmentagencyshall,onitsowninitiativeorupontherequestofthedatasubject,ceaseprocessingorusingthepersonaldata,unlesstheprocessingoruseiseithernecessaryfortheperformanceofanofficialorbusinessduty,orhasbeenagreedtobythedatasubjectinwriting,andthedisputehasbeenrecorded.Whenthespecificpurposeofdatacollectionnolongerexists,oruponexpirationoftherelevanttimeperiod,thegovernmentornon-governmentagencyshall,onitsowninitiativeorupontherequestofthedatasubject,eraseorceaseprocessingorusingthepersonaldata,unlesstheprocessingoruseiseithernecessaryfortheperformanceofanofficialorbusinessduty,orhasbeenagreedtobythedatasubjectinwriting.Agovernmentornon-governmentagencyshall,onitsowninitiativeorupontherequestofthedatasubject,erasethepersonaldatacollectedorceasecollecting,processingorusingthepersonaldataintheeventwherethecollection,processingoruseofthepersonaldataisinviolationofthePDPA.Ifanyfailuretocorrectorsupplementanypersonaldataisattributabletoagovernmentornon-governmentagency,thegovernmentornon-governmentagencyshallnotifythepersonswhohavebeenprovidedwithsuchpersonaldataafterthecorrectionorsupplementismade. Article12Ifanypersonaldataisstolen,disclosed,altered,orotherwiseinfringeduponduetoaviolationofthePDPAbyagovernmentornon-governmentagency,thedatasubjectshallbenotifiedviaappropriatemeansaftertherelevantfactshavebeenclarified. Article13Wherearequestismadebyadatasubjecttoagovernmentornon-governmentagencypursuanttoArticle10,theagencyshalldeterminewhethertoacceptorrejectsuchrequestwithinfifteendays;suchdeadlinemaybeextendedbyuptofifteendaysifnecessary,andthedatasubjectshallbenotifiedinwritingofthereasonfortheextension.Wherearequestismadebyadatasubjecttoagovernmentornon-governmentagencypursuanttoArticle11,theagencyshalldeterminewhethertoacceptorrejectsuchrequestwithinthirtydays;suchdeadlinemaybeextendedbyuptothirtydaysifnecessary,andthedatasubjectshallbenotifiedinwritingofthereasonfortheextension. Article14Agovernmentornon-governmentagencymaychargeafeetocovernecessarycostsfromthosewhomakeaninquiryorrequesttorevieworobtaincopiesofthepersonaldata. ChapterIIDataCollection,ProcessingandUsebyaGovernmentAgency Article15ExceptforthepersonaldataspecifiedunderParagraph1,Article6,thecollectionorprocessingofpersonaldatabyagovernmentagencyshallbeforspecificpurposesandononeofthefollowingbases:1.whereitiswithinthenecessaryscopetoperformitsstatutoryduties;2.whereconsenthasbeengivenbythedatasubject;or3.wheretherightsandinterestsofthedatasubjectwillnotbeinfringedupon. Article16ExceptforthepersonaldataspecifiedunderParagraph1,Article6,agovernmentagencyshallusepersonaldataonlywithinthenecessaryscopeofitsstatutorydutiesandforthespecificpurposeofcollection;theuseofpersonaldataforanotherpurposeshallbeonlyonanyofthefollowingbases:1.whereitisexpresslyrequiredbylaw;2.whereitisnecessaryforensuringnationalsecurityorfurtheringpublicinterest;3.whereitistopreventharmonlife,body,freedom,orpropertyofthedatasubject;4.whereitistopreventmaterialharmontherightsandinterestsofothers;5.whereitisnecessaryforstatisticsgatheringoracademicresearchbyagovernmentagencyoranacademicinstitutionforpublicinterests;providedthatsuchdata,asprocessedbythedataproviderorasdisclosedbythedatacollector,maynotleadtotheidentificationofaspecificdatasubject;6.whereitisforthedatasubject'srightsandinterests;or7.whereconsenthasbeengivenbythedatasubject. Article17Thegovernmentagencyshallmakepublicthefollowinginformationonlineorallowthepublictomakeinquiriesthereofviaotherappropriatemeans;theforegoingalsoapplieswhenanychangesaremadetothefollowinginformation:1.thenamesofthepersonaldatafiles;2.thenameandcontactinformationoftheagencythatisinpossessionofthepersonaldatafiles;3.thelegalbasisandpurposeofkeepingthepersonaldatafiles;and4.thecategoryofthepersonaldata. Article18Thegovernmentagencyinpossessionofpersonaldatafilesshallassigndedicatedpersonneltoimplementsecurityandmaintenancemeasurestopreventthepersonaldatafrombeingstolen,altered,damaged,destroyedordisclosed. ChapterIIIDataCollection,ProcessingandUsebyaNon-governmentAgency Article19ExceptforthepersonaldataspecifiedunderParagraph1,Article6,thecollectionorprocessingofpersonaldatabyanon-governmentagencyshallbeforspecificpurposesandononeofthefollowingbases:1.whereitisexpresslyrequiredbylaw;2.wherethereisacontractualorquasi-contractualrelationshipbetweenthenon-governmentagencyandthedatasubject,andpropersecuritymeasureshavebeenadoptedtoensurethesecurityofthepersonaldata;3.wherethepersonaldatahasbeendisclosedtothepublicbythedatasubjectorhasbeenmadepubliclawfully;4.whereitisnecessaryforstatisticsgatheringoracademicresearchbyanacademicinstitutioninpursuitofpublicinterests,providedthatsuchdata,asprocessedbythedataproviderorasdisclosedbythedatacollector,maynotleadtotheidentificationofaspecificdatasubject;5.whereconsenthasbeengivenbythedatasubject;6.whereitisnecessaryforfurtheringpublicinterest;7.wherethepersonaldataisobtainedfrompubliclyavailablesourcesunlessthedatasubjecthasanoverridinginterestinprohibitingtheprocessingoruseofsuchpersonaldata;or8.wheretherightsandinterestsofthedatasubjectwillnotbeinfringedupon.Adatacollectororprocessorshall,onitsowninitiativeorupontherequestofthedatasubject,eraseorceaseprocessingorusingthepersonaldatawhenitbecomesawareof,oruponbeingnotifiedbythedatasubject,thattheprocessingoruseofthepersonaldatashouldbeprohibitedpursuanttotheprovisotoSubparagraph7oftheprecedingparagraph. Article20ExceptforthepersonaldataspecifiedinParagraph1,Article6,anon-governmentagencyshallusepersonaldataonlywithinthenecessaryscopeofthespecificpurposeofcollection;theuseofpersonaldataforanotherpurposeshallbeonlyonanyofthefollowingbases:1.whereitisexpresslyrequiredbylaw;2.whereitisnecessaryforfurtheringpublicinterests;3.whereitistopreventharmonlife,body,freedom,orpropertyofthedatasubject;4.whereitistopreventmaterialharmontherightsandinterestsofothers;5.whereitisnecessaryforstatisticsgatheringoracademicresearchbyagovernmentagencyoranacademicinstitutionforpublicinterests;providedthatsuchdata,asprovidedbythedataproviderordisclosedbythedatacollector,maynotleadtotheidentificationofaspecificdatasubject;6.whereconsenthasbeengivenbythedatasubject;or7.whereitisforthedatasubject'srightsandinterests.Whenanon-governmentagencyusespersonaldataformarketingpurposepursuanttotheprecedingparagraph,uponthedatasubject'sobjectiontosuchuse,theagencyshallceaseusingthedatasubject'spersonaldataformarketing.Anon-governmentagency,whenusingthedatasubject’spersonaldataformarketingpurposeforthefirsttime,shallprovidethedatasubjectofthewaysthathe/shecanobjecttosuchuse,andtheagencyshallpayforthefeestherefrom. Article21Ifacross-bordertransferofpersonaldataiscarriedoutbyanon-governmentagencyunderanyofthefollowingcircumstances,thecentralgovernmentauthorityinchargeoftheindustryconcernedmayimposerestrictionsonsuchtransfer:1.wheremajornationalinterestsareinvolved;2.whereaninternationaltreatyoragreementsostipulates;3.wherethecountryreceivingthepersonaldatalacksproperregulationsonprotectionofpersonaldataandthedatasubjects'rightsandinterestsmayconsequentlybeharmed;or4.wherethecross-bordertransferofthepersonaldatatoathirdcountry(territory)iscarriedouttocircumventthePDPA. Article22Thecentralgovernmentauthoritiesinchargeoftheindustriesconcernedorthemunicipality/city/countygovernmentsconcernedmay,whentheydeemnecessaryorsuspectanypossibleviolationofthePDPA,inspectcompliancewiththesecuritycontrolmeasures,theguidelinesondisposingpersonaldatauponbusinesstermination,andtherestrictionsoncross-bordertransfers,orconductanyotherroutineinspectionsbyhavingtheirstaffenternon-governmentagencies'premisesuponpresentationoftheirofficialidentificationdocumentsandorderrelevantpersonnelatthenon-governmentagenciestoprovidenecessaryexplanations,cooperateonadoptingrelevantmeasures,orprovidesupportingdocuments.Whenthecentralgovernmentauthoritiesinchargeoftheindustriesconcernedorthemunicipality/city/countygovernmentsconcernedconducttheinspectionsdescribedintheprecedingParagraph,theymayretainormakeduplicationsofthepersonaldataorthefilesthereofthatcanbeconfiscatedorbeadmittedasevidence.Theowner,holderorkeeperofsuchdataorfilesthatshallbeconfiscatedorcopiedshallsubmitthemtotheauthoritiesuponrequest.Ifthenon-governmentagencyrefusestosubmitordelivertherequesteddataorfilesorrejectstheconfiscationorduplicationthereofwithoutanylegitimatereason,acompulsoryenforcementthatwilldotheleastharmtotherightsandinterestsofthenon-governmentagencymaybeapplied.Whenthecentralgovernmentauthoritiesinchargeoftheindustriesconcernedorthemunicipality/city/countygovernmentsconcernedconducttheinspectionsdescribedinParagraph1,professionalsinthefieldofinformationtechnology,telecommunicationsorlawmayaccompanytheinspectorsduringtheinspections.Non-governmentagenciesandtheirpersonnelmaynotevadesuchinspections,obstructtheinvestigatorsfromaccessingthepremisesordata,orrefusetocomplywiththeinspectionsordecisionsreferredtoinParagraphs1and2.Allpersonnelwhotakepartintheinspectionsshallkeepinconfidenceallthepersonaldatathattheybecomeawareofduetotheinspections. Article23TheconfiscatedfilesorduplicatesreferredtoinParagraph2oftheprecedingarticleshallbesealedortaggedandproperlyhandled;ifitisunfeasibletomoveortakepossessionofsuchfiles,theauthorityshallassignpersonneltoguardsuchfilesorordertheownerofsuchfilesoranappropriatepersontotakepossessionofthefiles.Ifitisnolongernecessarytokeeptheconfiscatedfilesortheduplicates,ortheauthorityhasdecidednottoimposeanypenaltiesorconfiscateanyfiles,theconfiscatedfilesandduplicatesshallbereturnedexceptforthefilesorduplicatesthatshallbeconfiscatedorkeptfortheinvestigationofothercases. Article24Thenon-governmentagency,owner,holder,keeperorinterestedpersonsofthoseconfiscatedfilesorduplicatesmayraiseanobjectionwiththecentralgovernmentauthorityinchargeoftheindustryconcernedorthemunicipality/city/countygovernmentconcernedagainsttheactsofdemand,compulsoryenforcement,detention,orduplicationmentionedintheprecedingtwoArticles.Uponreceivingtheobjectionmentionedintheprecedingparagraph,thecentralgovernmentauthorityinchargeoftheindustryconcernedorthemunicipality/city/countygovernmentconcernedshallimmediatelyceaseorrectifysuchactsiftheobjectionisconsideredreasonable;otherwise,itmaycontinuesuchacts.Upontherequestofthepersonwhoraisestheobjection,arecordoftheobjectionreasonsshallbepreparedanddeliveredtosuchperson.Anappealagainstthedecisionmadebythecentralgovernmentauthorityinchargeoftheindustryconcernedorthemunicipality/city/countygovernmentconcernedundertheprecedingparagraphmayonlybefiledjointlywiththeappealagainstthesubstantivedecisionofthecase.However,ifthepersonsidentifiedinParagraph1donothavetherightstoappealagainstthesubstantivedecisionofthecaseunderthelaw,suchpersonsmayfileanadministrativelawsuitsolelyagainsttheactsidentifiedinthesameParagraph1. Article25Intheeventthatanon-governmentagencyhasviolatedthePDPA,thecentralgovernmentauthorityinchargeoftheindustryconcernedorthemunicipality/city/countygovernmentconcernedmayimposefinesonthenon-governmentagencyinaccordancewiththePDPAandmayalsoenforcethefollowingcorrectivemeasures:1.prohibitthecollection,processingoruseofthepersonaldata;2.ordertheerasureoftheprocessedpersonaldataandpersonaldatafiles;3.confiscateororderthedestructionoftheunlawfullycollectedpersonaldata;and/or4.disclosetothepublictheviolationofthenon-governmentagency,thenameofthenon-governmentagencyanditsresponsibleperson/representative.Wherethecentralgovernmentauthorityinchargeoftheindustryconcernedorthemunicipality/city/countygovernmentconcernedenforcethecorrectivemeasuresreferredtointheprecedingparagraph,suchmeasuresshallbewithinthescopethatisnecessarytopreventandremedytheviolationofthePDPAandshalldotheleastharmtotherightsandinterestsofthenon-governmentagencyconcerned. Article26Thefindingsoftheinspectionsconductedbythecentralgovernmentauthoritiesinchargeoftheindustriesconcernedorthemunicipality/city/countygovernmentsconcernedinaccordancewithArticle22maybedisclosedtothepublicifthenon-governmentagenciesconcernedarenotinviolationofthePDPAandagreetothepublicdisclosureofsuchfindings. Article27Anon-governmentagencyinpossessionofpersonaldatafilesshallimplementpropersecuritymeasurestopreventthepersonaldatafrombeingstolen,altered,damaged,destroyedordisclosed.Thecentralgovernmentauthoritiesinchargeoftheindustriesconcernedmaydesignateandordercertainnon-governmentagenciestoestablishasecurityandmaintenanceplanfortheprotectionofpersonaldatafilesandaguidelineondisposingpersonaldatafollowingabusinesstermination.Matterssuchasstandardsonsettingforththeaforementionedplansanddisposalregulationsshallbeexpresslyestablishedbythecentralgovernmentauthorityofinchargeoftheindustryconcerned. ChapterIVDamagesandClassAction Article28Agovernmentagencyshallbeliableforthedamagesarisingfrominjurycausedbyanyunlawfulcollection,processingoruseofpersonaldata,orotherinfringementontherightsofdatasubjectsduetosuchgovernmentagency'sviolationofthePDPA,unlesssuchinjurywascausedbyanynaturaldisaster,emergencyorotherforcemajeureevent.Ifaninjurysufferedbythevictimisanon-pecuniarydamage,he/shemayrequestanappropriateamountofmonetarycompensation;iftheinjurysufferedbythevictimisdamagetohis/herreputation,thevictimmayrequestappropriatecorrectivemeasurestorestorehis/herreputation.Underthecircumstancesidentifiedintheprecedingtwoparagraphs,ifitisdifficultorimpossibleforthevictimtoprovethemonetaryvalueoftheactualdamage,he/shemayaskthecourttoawardthecompensationintheamountofatleastNT$500butnomorethanNT$20,000perincident,perpersonbasedontheseverityofthedamage.Wheretherightsofmultipledatasubjectshavebeeninfringeduponduetothesameincident,thetotalamountofcompensationawardedtosuchdatasubjectsshallnotexceedNT$200million.However,iftheinterestsinvolvedintheincidentexceedNT$200million,thecompensationshallbeuptothevalueofsuchinterests.Ifthetotalamountofdamagesfortheinjuriesattributabletothesameincidentexceedstheamountreferredtointheprecedingparagraph,thecompensationpayabletoeachvictimshallnotbelimitedtothelowerendofdamages,i.e.NT$500,perincidentassetforthinParagraph3ofthisArticle.TherightofclaimreferredtoinParagraph2abovemaynotbetransferredorinherited.However,thisdoesnotapplytothecircumstanceswheremonetarycompensationhasbeenagreeduponinacontractoraclaimthereforhasbeenfiledwiththecourt. Article29Anon-governmentagencyshallbeliableforthedamagesarisingfromanyinjurycausedbyanyunlawfulcollection,processingoruseofpersonaldata,orotherinfringementontherightsofdatasubjectsduetosuchnon-governmentagency'sviolationofthePDPA,unlessthenon-governmentagencycanprovethatsuchinjuryisnotcausedbyitswillfulactornegligence.Paragraphs2to6oftheprecedingarticleapplytothedamageclaimsraisedinaccordancewiththeprecedingparagraph. Article30Therighttoclaimdamagecompensationwillbeextinguishediftheright-holderdoesnotexercisesuchrightwithinthetwo-yearperiodafterhe/shebecomesawareofhis/herdamageandtheidentityoftheperson(s)liableforthecompensation,orthefive-yearperiodfollowingtheoccurrenceofthedamage. Article31Withregardtomatterspertainingtodamages,asidefromtheprovisionsofthePDPA,theStateCompensationLawmaybeappliedtoagovernmentagencyandtheCivilCodemaybeappliedtoanon-governmentagency. Article32AnincorporatedfoundationoranincorporatedcharitythatbringsacasetothecourtinaccordancewiththisChaptershallfulfillthefollowingcriteria:1.thetotalregisteredassetsofanincorporatedfoundationshallbeNT$10millionormore,orthetotalnumberofmembersofanincorporatedcharityshallbe100ormore;2.theprotectionofpersonaldatashallbesetforthasoneofitspurposesinitscharter;and3.Itshallhavebeenestablishedformorethanthreeyearsfollowingitsreceiptoftheapprovalthereof. Article33ThelawsuitfiledwiththecourtfordamagesagainstagovernmentagencyinaccordancewiththePDPAshallbesubjecttotheexclusivejurisdictionofthedistrictcourtwheretheagencyislocated.Thelawsuitagainstanon-governmentagencyissubjecttotheexclusivejurisdictionofthedistrictcourtwhereitsmainoffice,principalplaceofbusinessordomicileislocated.Ifthenon-governmentagencyreferredtointheprecedingparagraphisanaturalpersonandhasnoplaceofdomicileintheRepublicofChina,ortheaddressthereofisunknown,suchnaturalperson'splaceofresidenceintheRepublicofChinashallbedeemedtobetheplaceofdomicile.IfthenaturalpersonhasnoplaceofresidenceintheRepublicofChinaortheaddressthereofisunknown,his/herlastknowndomicileintheRepublicofChinashallbedeemedtobetheplaceofdomicile.Ifthenaturalpersonhasnolastknowndomicile,thedistrictcourtwherethecentralgovernmentislocatedshallhaveexclusivejurisdiction.Ifthenon-governmentagencyreferredtoinParagraph1isalegalpersonoragroupandhasnomainoffice,principalplaceofbusiness,ortheaddressesthereofarebothunknown,thedistrictcourtwherethecentralgovernmentislocatedshallhaveexclusivejurisdiction. Article34Wheretherightsofmultipledatasubjectshavebeeninfringeduponduetothesameincident,theincorporatedfoundationorincorporatedcharitymayfilealawsuitwiththecourtinitsownnameafterobtainingawrittendelegationoflitigationrightsofatleast20datasubjects.Thedatasubjectsmaywithdrawtheirdelegationinwritingbeforetheconclusionoftheoralargumentandthedatasubjectsshallnotifythecourtthereof.Withregardtothelitigationreferredtointheprecedingparagraph,thecourtmayissueapublicnotice,eitheruponreceivingapetitiontherefororonitsowninitiative,informingotherdatasubjectsthatsufferdamagesduetothesameincidentthattheymaydelegatetheirlitigationrightstotheincorporatedfoundationortheincorporatedcharityreferredtointheprecedingparagraphwithinaspecifiedperiodoftime.Theincorporatedfoundationortheincorporatedcharitymayexpanddemandforthereliefsoughtbeforetheconclusionoftheoralargument.Ifotherdatasubjectsthatsufferdamagesduetothesameincidentchosenottodelegatetheirlitigationrightspursuanttotheprecedingparagraph,theymaystillbringthecasetothecourtwithinthetimeframespecifiedinthepublicnoticeforthecourttocombinethecases.Otherdatasubjectsthathavesuffereddamagesduetothesameincidentmayalsofileapetition,requestingthecourttoissuethepublicnoticereferredtointheprecedingparagraph.Thenoticereferredtointheprecedingtwoparagraphsmaybepostedonthebulletinboardsofthecourt,ontheInternetoratotherproperlocations.Shouldthecourtconsideritnecessary,itmaymakesuchnoticeinagovernmentgazetteornewspaper,orthroughothermeans,andthefeestherefromshallbepaidbytheNationalTreasury.FortheincorporatedfoundationortheincorporatedcharitythatbringsacasetothecourtinaccordancewithParagraph1,iftheclaimvalueofthecaseexceedsNT$600,000,thecourtfeeattributabletotheexcessportionoftheclaimvalueshallbewaived. Article35Ifadatasubjectwithdrawshis/herdelegationofthelitigationrightsinaccordancewithParagraph1oftheprecedingarticle,thepartofthecourtproceedingsrelatingtosuchdatasubjectshallautomaticallybesuspended,andsuchdatasubjectshallmakeadeclarationtobecomeapartytothesuit.Thecourtmayalso,onitsowninitiative,ordersuchdatasubjecttobecomeapartytothesuit.Aftertheincorporatedfoundationortheincorporatedcharityfilesalawsuitwiththecourtinaccordancewiththeprecedingarticle,ifthewithdrawaloflitigationrightsbysomedatasubjectscausesthenumberofremainingdatasubjectsinthelawsuittodroptolessthan20,thecourtproceedingsfortheremainingdatasubjectsmaystillcontinue. Article36ThestatuteoflimitationforeachdatasubjecttoexercisetherighttoclaimdamagesunderParagraphs1and2ofArticle34shallbecalculatedseparately. Article37Anincorporatedfoundationoranincorporatedcharitythathasbeendelegatedlitigationrightsbydatasubjectsshallbeentitledtoimplementanyandallactspertainingtothelawsuit.However,thedatasubjectsmaysetrestrictionsontheabandonment,withdrawal,orsettlementrelatingtosuchlawsuit.Therestrictionssetbyoneofthedatasubjectsreferredtointheprecedingparagraphhavenoeffectontheotherdatasubjects.TherestrictionsreferredtoinParagraph1shallbespecifiedinthedocumentsidentifiedinParagraph1ofArticle34,orshallbesubmittedtothecourtinwriting. Article38IntheeventthatadatasubjectisnotsatisfiedwiththejudgmentofthelawsuitfiledpursuanttoArticle34,he/shemaywithdrawhis/herdelegationoflitigationrightsbeforethedeadlineforfilinganappealbysuchincorporatedfoundationorincorporatedcharity,andthenfiletheappealhimself/herself.Afterreceivingtheoriginalcopyofthejudgment,theincorporatedfoundationortheincorporatedcharityshallnotifythedatasubjectsoftheoutcomeandalsonotifythedatasubjectsinwritingwithinsevendaysastowhetherornotanappealwillbefiled. Article39TheincorporatedfoundationortheincorporatedcharityshalldeductthenecessarylitigationfeesfromthecompensationawardedinaccordancewiththeresultofthelawsuitfiledpursuanttoArticle34,anddelivertheremainingamounttothedatasubjectsthatdelegatethelitigationrights.TheincorporatedfoundationortheincorporatedcharitymaynotaskforremunerationforthelawsuitfiledinaccordancewithParagraph1ofArticle34. Article40TheincorporatedfoundationortheincorporatecharitythatfiledalawsuitinaccordancewiththeprovisionsofthisChaptershallengageanattorneyasitsagentadlitemforthelawsuit. ChapterVPenalties Article41Ifaperson,withtheintentionofobtainingunlawfulgainsforhimself/herselforathirdparty,orwiththeintentionofimpairinganotherperson'sinterests,isinviolationofParagraph1,Article6,Articles15,16,19,andParagraph1,Article20,oranorderordecisionrelatingtotherestrictionsoncross-bordertransfersmadebythecentralgovernmentauthorityinchargeoftheindustryconcernedinaccordancewithArticle21ofthePDPA,therebycausingdamagetoothers,thepersonshallbesentencedtoimprisonmentfornomorethanfiveyears;inadditionthereto,afineofnomorethanNT$1millionmaybeimposed. Article42Ifaperson,withtheintentionofobtainingunlawfulgainsforhimself/herselforforathirdparty,orinfringingupontheinterestsofothers,illegallychangesorerasespersonaldatafiles,orotherwisecompromisestheaccuracyofanother'spersonaldatafiles,therebycausingdamagestoothers,thepersonshallbesentencedtoimprisonmentfornomorethanfiveyearsordetention,and/orafineofnomorethanNT$1million. Article43TheprecedingtwoarticlesalsoapplytonationalsoftheRepublicofChinaiftheycommitanyoffensespecifiedthereinoutsideoftheRepublicofChinaagainstanyothernationaloftheRepublicofChina. Article44Agovernmentofficialwhoabusesthepower,opportunityormeansavailabletohim/hertocommitanyoftheoffensesdescribedinthisChaptershallbesubjecttoamoreseverepunishmentwhichisupto50%morethanthatprescribedabove. Article45ApersonwhocommittedanyoftheoffensesidentifiedinthisChaptershallbeindictedonlyuponacomplaint,exceptfortheoffensesspecifiedinArticle41andthoseidentifiedinArticle42againstagovernmentagency. Article46IfamoreseverepunishmentisprovidedforunderotherlawswithrespecttotheoffensesidentifiedinthisChapter,themoreseverepunishmentshalltakeprecedence. Article47Ifanon-governmentagencyviolatesanyofthefollowingprovisions,thecentralgovernmentauthorityinchargeoftheindustryconcernedorthemunicipality/city/countygovernmentconcernedshallimposeanadministrativefinebetweenNT$50,000andNT$500,000onthenon-governmentagencyandshallorderthenon-governmentagencytoimplementcorrectivemeasureswithinaspecifiedperiodoftime;ifthenon-governmentagencyfailstodoso,afineshallbeimposedeachtimetheviolationoccurs:1.Paragraph1,Article6;2.Article19;3.Paragraph1,Article20;and/or4.anorderordecisionrelatingtotherestrictionsoncross-bordertransfersmadebythecentralgovernmentauthorityinchargeoftheindustryconcernedunderArticle21. Article48Ifanon-governmentagencyviolatesanyofthefollowingprovisions,thecentralgovernmentauthorityinchargeoftheindustryconcernedorthemunicipality/city/countygovernmentconcernedmayorderthenon-governmentagencytorectifytheviolationwithinaspecifiedperiodoftime;ifthenon-governmentagencyfailstorectifytheviolationintime,afinebetweenNT$20,000andNT$200,000shallbeimposedonthenon-governmentagencyforeachoccurrenceoftheviolation:1.Article8orArticle9;2.Article10,Article11,Article12,orArticle13;3.Paragraph2orParagraph3,Article20;and/or4.Paragraph1,Article27,orfailuretoestablishasecurityandmaintenanceplanfortheprotectionofpersonaldatafilesoraguidelineondisposingpersonaldatafollowingabusinessterminationunderParagraph2,Article27. Article49Ifanon-governmentagencyisinviolationofParagraph4,Article22withoutanylegitimatereason,thecentralgovernmentauthorityinchargeoftheindustryconcernedorthemunicipality/city/countygovernmentconcernedshallimposeanadministrativefinebetweenNT$20,000andNT$200,000onthenon-governmentagency. Article50Therepresentative,manager,oranyotherauthorizedrepresentativeofanon-governmentagencyshallbefinedthesameamountimposedonthenon-governmentagencyforaviolationofanyoftheprecedingthreearticles,unlesssaidpersonprovesthathe/shehasexercisedduecaretopreventsuchviolation. ChapterVISupplementaryProvisions Article51ThePDPAdoesnotapplytothefollowingcircumstances:1.wherepersonaldataisbeingcollected,processed,orusedbyanaturalpersonpurelyforpurposesofpersonalorhouseholdactivities;or2.whereaudio-visualdataiscollected,processed,orusedinpublicplacesorpublicactivitiesandnotconnectedtootherpersonaldata.ThePDPAalsoappliestothegovernmentandthenon-governmentagenciesoutsidetheterritoryoftheRepublicofChina(R.O.C)whentheycollect,processorusethepersonaldataoftheR.O.C.nationals. Article52Thedutiesofthecentralgovernmentauthoritiesinchargeoftheindustriesconcernedorthemunicipality/city/countygovernmentsconcernedunderArticles22to26maybedelegatedtotheirsubordinateagencies,otheragenciesorpublicinterestgroups.Thepersonnelofsuchagenciesorpublicinterestgroupsshallbeobligatedtokeepconfidentialallthedatatheybecomeawareofduringtheperformanceofthedutiessodelegatedorcommissioned.Thepublicinterestgroupsreferredtointheprecedingparagraphshallnotreceiveanydatasubject'sdelegationoflitigationrightstofilealawsuitfordamagesintheirnamesinaccordancewithParagraph1ofArticle34. Article53TheMinistryofJusticeshall,inconjunctionwiththecentralgovernmentauthoritiesinchargeoftheindustriesconcerned,setforththespecificpurposesandcategoriesofpersonaldata,andprovidethesametogovernmentandnon-governmentagenciesforreferenceanduse. Article54AftertheenactmentoftheamendmentstothePDPAonDecember15,2015,ifanypersonaldatawasfurnishedbeforetheamendmentstothePDPAonMay26,2010,notbythedatasubject,thedatasubjectshallbeprovidedwiththeinformationrequiredunderArticle9beforesuchpersonaldataisprocessedorused,.TheobligationtoinformasprescribedintheprecedingparagraphmaybegivenatthetimewhensuchpersonaldataisusedforthefirsttimeaftertheenactmentoftheamendmentstothePDPAonDecember15,2015.AnyuseofpersonaldatawithouttheinformationprovidedinaccordancewiththeprecedingtwoparagraphsshallbedeemedandpunishedasaviolationofArticle9. Article55TheEnforcementRuleofthePDPAshallbeprescribedbytheMinistryofJustice. Article56TheenforcementdateofthePDPAshallbesetbytheExecutiveYuan.ThedeletionofArticles19to22andArticle43underthepre-amendmentPDPAbecomeseffectiveonthedateofpromulgation.Ifthedateofpromulgationasreferredtointheprecedingparagraphfallswithinthesixmonthperiodwithinwhichtheenterprises,groupsorindividualsdesignatedinParagraph2ofArticle43underthepre-amendedPDPAarerequiredtocompletetheregistrationorobtainthepermit,suchdesignatedenterprises,groupsorindividualsmayfileanapplicationtoterminatetheregistrationprocess.Uponthetermination,thegovernmentauthorityinchargeoftheindustryconcernedshallrefundthefeesthathavebeenpaid.Thosewhohavecompletedtheregistrationmayalsoapplyfortherefund.Thefeesreferredtointheprecedingparagraphshallberefundedtogetherwiththetotaldailyinterestincurredfromthedateofpaymentbytheapplicanttothedateoftheterminationbythegovernmentauthoritybasedonthefixedannualinterestrateforaone-yeartimedepositannouncedbytheDepartmentofSavingsandRemittances,ChunghwaPostCo.,Ltd.onthedateofthepayment.Thesameappliestotherefundwheretheregistrationprocesshasbeencompleted.Theinterestthereonshallbeincurredfromthedateofpaymentofthefeetothedatewhenthegovernmentauthorityinchargeoftheindustryconcernedapprovestheregistration.