iRent fined for data leak

Taipei Feb. 9 (CNA) Taiwanese car rental and automobile/motorcycle-sharing services platform iRent received separate fines from the Ministry of Transportation and Communications (MOTC) and Taipei City government on Thursday for data protection failings.

The popular platform is operated by Ho Ing Mobility Service, a subsidiary of Taiwanese automotive conglomerate Hotai Motor Co.

The company received the fines for a recent data leak that risked the exposure of personal data from more than 400,000 customers.

After the leak was reported in late January, the Ministry of Digital Affairs became involved while the company undertook measures to rectify the problem and paid compensation to its customers.

The Directorate General of Highways (DGH) under the MOTC also sent investigators to the company to conduct inspections on Feb. 4.

In a Thursday press release, the DGH said it found the service to be in violation of the Personal Data Protection Act and an MOTC regulation relating to the security of personal information for transportation businesses.

The DGH said Ho Ing did not establish and implement a sufficiently secure personal data security protocol and failed to correct the mistake in a timely manner.

These problems were directly responsible for the data leak, which violated Article 27 of the Personal Data Protection Act and as a result the platform was fined NT$200,000 (US$13,303) in accordance with Article 48 of the act.

The company has been instructed to show proof weaknesses in its operations have been dealt with by Feb. 28, and if violations are discovered at that point new fines will be imposed, the DGH added.

Meanwhile, Taipei City government also penalized Ho Ing for violating a municipal autonomous ordinance that regulates vehicle sharing services.

Department of Transportation division head Liao Yuan-ling (廖苑伶) said the city government sought an explanation from the company soon after the data leak was made public.

Liao said the company admitted to wrongdoing and as a result, the city decided to fine Ho Ing the maximum NT$90,000, with a deadline for systemic issues to be addressed.

A copy of the official determination will be sent to the company on Friday, Liao added.

In addition, the department explained that if any member of the general public feels their rights have been violated, they should contact iRent for further explanation.

Furthermore, a civil case could be made under Chapter IV: Damages and Class Action of the Personal Data Protection Act to get the DGH involved, or under the Consumer Protection Act.