Groups decry revision of data act
By Loa Iok-sin
Taipei Times, Thursday, Apr 29, 2010, Page 3
“We regret that the revised law, which has sparked many controversies, was not fully discussed by the public and was hastily passed.”— Taiwan Association for Human Rights
The Taiwan Association for Human Rights (TAHR) and the Association of Taiwan Journalists (ATJ) yesterday expressed their regrets over the revision of the Personal Data Protection Act (個人資料保護法), saying the revision was passed too hastily and without a thorough public discussion.
The legislature adopted an amendment to the Computer- Processed Personal Data Protection Act (電腦保護個人資料處理法) on Tuesday, changing the name of the law to the Personal Data Protection Act (個人資料保護法) and requiring people to obtain the consent of individuals before collecting or publishing information about them, including their name, date of birth, ID number, occupation, medical records, genetic information and details about their sex life.
However, the media are exempt from the rule when they are acting in the public interest.
In a statement released yesterday, the TAHR said the amendment allowed too many exceptions from obtaining consent.
“In the revised Personal Data Protection Act, government and non-government organizations or individuals may be exempt from the rule for ‘proper reasons,’ making obtaining personal consent only one of the requirements [for collecting or publishing personal information], which defeats the purpose of the law,” the statement said.
“In addition, it fails to define what ‘proper reasons’ are, leaving loopholes for government or non-governmental organizations and individuals to justify their collection of personal information according to their own reasons,” the statement said.
The statement added the revised law fails to designate a government agency to be responsible for the matter, making it easy for different agencies to dodge responsibility when problems occur.
“We regret that the revised law, which has sparked many controversies, was not fully discussed by the public and was hastily passed,” the statement said. “We still have a long way to go to achieve genuine protection of personal information.”
The ATJ also said in a statement that some parts of the revision were too vague.
In its statement, the ATJ said that while the revised law permits collecting normally accessible personal data and publishing the information in the public interest, it does not define what “public interests” are, or under which circumstances the information can be collected and published.
“When the law becomes effective, it would likely be up to the government and the courts to define such conditions, which would give too much power to the authorities and may cause disputes,” the ATJ statement said. “It would also make everyone a possible target of lawsuits filed by individuals or groups.”
------------------------
New data law offers no aid to Taiwan citizens
Taiwan News 2010-04-29
Major revisions to the "Computer-Processed Personal Data Protection Act" approved Tuesday by the Legislative Yuan will not realize their touted aim of improving the protection of the right of privacy of Taiwan's 23 million residents.
The European Union's EU's Charter of Fundamental Rights declares that citizens have a "fundamental right to the protection of personal data," a right which is under incessant assault by public and private interests in our information society.
The most fundamental loopholes in the protection of the privacy of individual computerized data do not only concern the information security technology but begin with the upstream processes of the collection, processing and utilization of personal data that have gravely eroded the right of self-determination of the individual over his or her own personal information.
Essentially, except in very special circumstances, the collection, processing and utilization of personal data are all taking place should take place with a clear and precisely defined purpose and under a legal procedure in which the individual has equal rights of participation and decision.
However, the revised law reduces the importance of the preconditions of personal consent and clear and specific use and thus makes it more difficult for individual citizens to ensure the protection of sensitive personal data while giving a license to public and non-official agencies to violate at will the fundamental rights of self-determination that citizens should possess over the collection and of sensitive personal information.
First, as reflected in Article 6, the revised law only takes "proper and specific purposes" and the "consent of the affected person" as one of the preconditions for lawful collection of personal data alongside of "legal regulations" and "the obligations of public and non-official agencies" and not as necessary conditions.
This provision will not only fail to ameliorate the excessive collection of personal data by both public and private agencies but will essentially legalize such excessive behavior.
Second, the revised law has no provisions whatsoever for the establishment of a specialized official agency to be responsible for overseeing the protection of computerized personal data.
Instead, the revisions only requires individual ministries or agencies to regulate and manage the fields under their supervision and therefore will create a situation of duplication of authority and the kicking back and forth of responsibility.
Without the assignation of a specific responsible agency, it will also be impossible to realize the comprehensive integration of policy formation, implementation and even education and publicity efforts for the concepts of personal data protection or resolve disputes that involve more than one government ministry or agency.
Fourth, the newly revised law lacks clear mechanisms for the protection of personal data, a shortcoming which will do little to alleviate widespread concern over the invasion of privacy.
In contrast, the member countries of the European Union have each established special national data protection commissions and other mechanisms, such as the appointment of "information commissioners" who are empowered to promote education in "good practices" as resolve complaints from people who believe their rights have been breached and enforce related laws through legal sanctions against official agencies, private corporations or individuals who ignore or refuse to accept their legal obligations.
Protecting the powerful
In terms of remedial measures, Section Four of the revamped law does permit "class action" suits to allow persons whose interests have been harmed by a particular leakage of personal information to jointly file legal action with lower legal costs.
However, the revised law requires that only legal corporate entities with total capital of NT$10 million or social organizations with at least 100 members can initiate class action suits, a provision that imposes severe limitations on the use of class action suits.
Finally, it is vital to keep in mind that only political power-holders, including government law enforcement and intelligence agencies, and large for-profit corporations, truly have the capability to engage in systematic infringement of the right of privacy of our citizens.
The first step toward protecting the human rights of our ordinary citizens, including their right to the privacy of sensitive personal information, is the prevention of the abuse of power by the state and powerful corporate interests.
However, Article 10 of a law touted to "protect" personal information gives national security and government agencies blanket exemptions against the requirement of prior approval of citizens for the collection and use of personal data.
On the other hand, the vague definitions and draconian penalties in the newly revamped law will cause most ordinary citizens to be in danger of being sued by government or private agencies or other citizens for the obtaining, use and exposure of information on the Internet or in "whistleblowing" against unethical actions by government or corporate leaders or agencies.
Even with the last minute exemption of the collection, processing and use of personal data for "public interest" in news reporting by news media, the revised law on the protection of computerized personal data is weighted heavily to protect the privileges of the powerful instead of safeguarding the rights of ordinary citizens.
Instead, Taiwan citizens will face an era in which "the strong will feed on the weak."
