Cabinet to establish agency for strengthening personal data protection

Taipei, March 27 (CNA) The Executive Yuan on Thursday approved a proposal that would pave the way for the establishment of an independent agency tasked with strengthening personal data protection in Taiwan.

According to the Cabinet, the proposed bill and amendments, which still require legislative approval, will provide the legal basis for the planned Personal Data Protection Commission.

Under the proposal, each government agency should also appoint a "personal data protection officer" to coordinate and oversee efforts to strengthen data protection and promote awareness of its importance.

At a press briefing on Thursday, Lin Yu-chia (林裕嘉), head of the planned agency's preparatory office, said the commission would include five to seven commissioners serving for renewable four-year terms.

At the onset of the agency's operations, commissioners will primarily be tasked with handling cases of personal data breaches in both government agencies and private enterprises that "do not have a specific competent authority," Lin said.

The commissioners, who are expected to work independently, will determine liability and subsequent penalties for those cases, she said.

According to Lin, businesses without a specific competent authority include platform-based information services and credit providers.

Lin said if everything goes according to plan, the hope is that all businesses will fall under the commission's jurisdiction within six years of operations.

In addition to enforcing laws regarding personal data protection, the planned agency will also be responsible for formulating policies and regulations, developing and promoting relevant technology applications, and talent incubation, she added.

According to Lin, the Cabinet's proposal is aimed at addressing some of the current problems, such as the absence of a comprehensive and uniform personal data protection supervisory mechanism and the lack of a designated agency that oversees both the public and private sectors.

The establishment of a designated personal data protection agency was ordered by the Constitutional Court, which gave the executive body a three-year grace period to set up an independent supervisory agency for better protection of personal data and privacy in a 2022 ruling.

According to the ruling, the agency must be set up by Aug. 12 this year.