Taiwan Steps Up Data Protection: New Agency to Safeguard Your Information

Independent Commission to Oversee Personal Data Privacy and Security Across Public and Private Sectors

Taipei, March 27 – The Executive Yuan has approved a plan to establish an independent agency dedicated to strengthening personal data protection within Taiwan.

The proposed bill, requiring legislative approval, will provide the legal framework for the Personal Data Protection Commission. This initiative marks a significant step towards ensuring greater privacy and security for all citizens.

Under the proposal, each government agency will be required to designate a "personal data protection officer." These officers will be responsible for coordinating and overseeing efforts to bolster data protection measures and raise awareness of their importance.

Lin Yu-chia (林裕嘉), head of the planned agency's preparatory office, announced that the commission will consist of five to seven commissioners, each serving renewable four-year terms. These commissioners will operate independently.

Initially, the commission will focus on handling personal data breaches within both government agencies and private enterprises that "do not have a specific competent authority," as stated by Lin. This includes platform-based information services and credit providers.

The commissioners will have the authority to determine liability and penalties for these cases, ensuring accountability for data breaches. The plan is for all businesses to fall under the commission's jurisdiction within six years of operations.

In addition to enforcing personal data protection laws, the agency will be responsible for formulating policies, developing and promoting relevant technological applications, and fostering talent within the field.

The Cabinet's proposal addresses the current shortcomings, such as the absence of a unified supervisory mechanism and a designated agency overseeing both the public and private sectors, according to Lin. The establishment of such an agency was mandated by the Constitutional Court.

The Constitutional Court's 2022 ruling stipulated a three-year grace period for the executive body to establish an independent supervisory agency for improved personal data and privacy protection. The agency must be operational by August 12 of this year.