> Science & Technology R&D Law
Back
Previous Executive Yuan Promotes Free Economic Demonstration Zone Next The Status of Taiwan's Regulations Concerning with Access to Biological Resources

New Version of Personal Information Protection Act and Personal Information Protection & Administration System

I.Summary

In 1995, the Computer-Processed Personal Data Protection Law was implemented in the Republic of China.  With the constant development of information technology and the limitations in the application of the legislation, the design of the original legal system is no longer consistent with practical requirements. Considering the increasing number of incidents of personal data leaks, discussions were carried out over a long period of time and the new version of the Personal Information Protection Act was passed after three readings in April, 2010. The title of the law was changed to Personal Information Protection Act. The new system has been officially implemented since 1 October, 2012. The new Act not only revised the provisions of the law in a comprehensive way, but also significantly increased the obligations and responsibilities of enterprises. In terms of civil liability, the maximum amount of compensation for a single incident is 200 Million NTD. For domestic industries, how to effectively respond to the requirements under the Personal Information Protection Act and adopt proper corresponding measures to lower the risk has become a key task for enterprise operation.

II. Main Points

1. Implementation of the Enforcement Rules of the Personal Information Protection Act

Personal information protection can be said the most concerned issue in Taiwan recently. As a matter of fact, the Computer-Processed Personal Data Protection Law was established in Taiwan as early as August 1995. After more than 10 years of development, computer and information technology has evolved significantly, and many emerging business models such as E-commerce are extensively collecting personal data. It has become increasingly important to properly protect personal privacy. However, the previous Computer-Processed Personal Data Protection Law was only applicable to certain industries, i.e. the following 8 specific industries: the credit investigation business, hospital, school, telecommunication business, financial business, securities business, insurance business, and mass media. And other business was  designated by the Ministry of Justice and the central government authorities in charge of concerned enterprises. In addition, the law only protected personal information that was processed by “computer or automatic equipment”.  Personal information that was not computer processed was not included.  There were clearly no sufficient regulations for the protection of personal data privacy and interest.

There were numerous incidents of personal data leaks. Among the top 10 consumer news issued by the Consumer Protection Committee of the Executive Yuan in 2007, “incidents of personal data leaks through E-commerce and TV shopping” was on the top of the list. This provoked the Ministry of Justice and the Ministry of Economic Affairs to “jointly designate” the retail industry without physical boutique (including 3 transaction models: online shopping, catalogue shopping and TV shopping) to be governed by the Computer-Processed Personal Data Protection Law since 1 July 2010.

To allow the provisions of the personal information protection legal system to meet the environment of rapid change, the Executive Yuan proposed a Draft Amendment to the Computer-Processed Personal Data Protection Law very early and changed the title to the Personal Information Protection Act. The draft was discussed many times in the Legislative Yuan. Personal Information Protection Act was finally passed after three readings in April 2010, which was officially published by the Office of the President on 26 May.

Although the new law was passed in April 2010, to allow sufficient time for enterprises and the public to understand and comply the new law, the new version of the personal information protection law was not implemented on the date of publication. In accordance with Article 56 of the Act, the date of implementation was to be further established by the Executive Yuan. After discussions over a long period of time, the Executive Yuan decided for the Personal Information Protection Act to be officially implemented on 1 October 2012. However, the implementation of two articles is withheld: Article 6 of the Act about the principal prohibition against the collection, processing and use of special personal information and Article 54 about the obligation to notice the Party within one year for personal information indirectly acquired before the implementation of the new law.

In terms of the personal data protection legal system, other than the most important Personal Data Protection Act, the enforcement rules established in accordance with the main law also play a key role. The previous Enforcement Rules of the Computer-Processed Personal Data Protection Law were published and implemented on 1 May, 1996. Considering that the Computer-Processed Personal Data Protection Law was amended in 2010 and that its title has been changed to the Personal Data Protection Act, the Ministry of Justice also followed the amended provisions under the new law and actively studied the Draft Amendment to the Enforcement Rules of the Computer-Processed Personal Data Protection Act. After it was confirmed that the new version of the Personal Data Protection Act would be officially launched on 1 October 2012, the Ministry of Justice announced officially the amended enforcement rules on 26 September, 2012. The title of the enforcement rules was also amended to the Enforcement Rules of the Personal Data Protection Act. The new version of personal data protection law and enforcement rules was thus officially launched, creating a brand new era for the promotion of personal data protection in Taiwan.

II. Personal Data Administration System and Information Privacy Protection Charter

Before the amendment to the Personal Data Protection Act was passed, the Legislative Yuan made a proposal to the government in June 2008 to promote a privacy administration and protection certification system in Taiwan, in reference to foreign practices. In August of the following year, the Strategic Review Board of the Executive Yuan passed a resolution to promote the E-Commerce Personal Data Administration and Information Security Action Plan. In December of the same year, approval was granted for the plan to be included in the key government promotion plans from 2010 to 2013.

Based on this action plan, since October 2010, the Ministry of Economic Affairs has asked the Institution for Information Industry to execute an E-Commerce Personal Data Administration System Setup Plan.  Since 2012, the E-Commerce Personal Data Administration System Promotion Plan and the Taiwan Personal Information Protection and Administration System (TPIPAS) have been established and promoted, with the objective of procuring enterprises to, while complying with the personal data protection legal system, properly protect consumers’ personal information through the establishment of an internal administration mechanism and ensuring that the introducing enterprises meet the requirements of the system. The issuance of the Data Privacy Protection Mark (dp.mark) was also used as an objective benchmark for consumers to judge the enterprise’s ability to maintain privacy.  

Regarding the introduction of the personal data administration system, enterprises should establish a content administration mechanism step by step in accordance with the Regulations for Taiwan Personal Information Protection and Administration System. Such system also serves as the review benchmark to decide whether domestic enterprises can acquire the Data Privacy Protection Mark (dp.mark). Since domestic enterprises did not have experience in establishing internal personal data administration system in the past, starting 2011, under the Taiwan Personal Information Protection and Administration System, enterprises received assistance in the training of system professionals such as Personal Data Administrators and Personal Data Internal Appraisers. Quality personal data administrators can help enterprises establish complete internal systems. Internal appraisers play the role of confirming whether the systems established by the enterprises are consistent with the system requirements. As of 2012, there are almost 100 enterprises in Taiwan that participate in the training of system staff and a total of 426 administrators and 131 internal appraisers.  In terms of the introduction of TPIPAS, in additional to the establishment and introduction of administration systems by qualified administrators, enterprises can also seek assistance from external professional consulting institutions. Under the Taiwan Personal Information Protection and Administration System, applications for registration of consulting institutions became available in 2012. Qualified system consulting institutions are published on the system website. Today 9 qualified consulting institutions have completed their registrations, providing enterprises with personal data consulting services.

After an enterprise completes the establishment of its internal administration system, it may file an application for certification under the Taiwan Personal Information Protection and Administration System.  The certification process includes two steps: “written review” and “site review”. After the enterprise passing certification, it is qualified to use the Data Privacy Protection Mark (dp.mark). Today 7 domestic companies have passed TPIPAS certification and acquired the dp.mark: 7net, FamiPort, books.com.tw, LOTTE, GOHAPPY, PAYEASY and Sinya Digital, reinforcing the maintenance of consumer privacy information through the introduction of personal data administration system.

III. Event Analysis

The Taiwan Personal Information Protection and Administration System (TPIPAS) is a professional personal data administration system established based on the provisions of the latest version of the domestic Personal Data Protection Act, in reference to the latest requirements of personal data protection by international organizations and the experience of main countries in promoting personal data administration system. In accordance with the practical requirements to protect personal data by industries, TPIPAS converted professional legal conditions into an internal personal data administration procedure to effectively assist industries to establish a complete and proper personal data administration system and to comply with the requirements of personal data legislations. With the launch of the new version of the Personal Data Protection Act, introducing TPIPAS and acquiring dp.mark are the best strategies for enterprises to lower the risk from the personal data protection law and to upgrade internal personal data administration capability.

※New Version of Personal Information Protection Act and Personal Information Protection & Administration System,STLI, https://stli.iii.org.tw/en/article-detail.aspx?d=6370&i=168&no=55&tp=2 (Date:2025/07/01)
Quote this paper
Release： 2013/10
Tag
Read with phone
Back
Previous Executive Yuan Promotes Free Economic Demonstration Zone Next The Status of Taiwan's Regulations Concerning with Access to Biological Resources
You may be interested
Legal Analysis of the U.S. BIOSECURE Act: Implications for Taiwanese Biotechnology Companies

Legal Analysis of the U.S. BIOSECURE Act: Implications for Taiwanese Biotechnology Companies 2024/11/15 I.Introduction The U.S. BIOSECURE Act (H.R.8333)[1](hereunder, "BIOSECURE Act" or "Act") is a strategic legislative measure designed to protect U.S. biotechnology technologies and data from potential exploitation by foreign entities deemed to be threats to national security. Passed by the House of Representatives on September 9, 2024, with a vote of 306-81[2], the Act demonstrates robust bipartisan support to limit foreign influence in critical U.S. sectors. Passed during the legislative session known as "China Week[3]," the Act imposes restrictions on government contracts, funding, and technological cooperation with entities classified as "Biotechnology Companies of Concern" (hereunder, "BCCs") that are affiliated with adversarial governments. Given Taiwan's prominent role in biotechnology and its strong trade ties with the U.S., Taiwanese companies must examine the implications of the BIOSECURE Act, specifically in regard to technology acquisition from restricted foreign companies and compliance obligations for joint projects with U.S. partners. This analysis will delve into three core aspects of the BIOSECURE Act: (1) the designation and evaluation of BCCs, (2) prohibitions on transactions involving BCCs, and (3) enforcement mechanisms. Each section will evaluate potential impacts on Taiwanese companies, focusing on how the Act might influence technology transfers, compliance obligations, and partnership opportunities within the U.S. biotechnology supply chain. II.Designation and Evaluation of Biotechnology Companies of Concern A central element of the BIOSECURE Act is the process of identifying and evaluating foreign biotechnology companies considered potential threats to U.S. national security.[4] Under Section 2(f)(2) of the Act, a "Biotechnology Company of Concern" is defined as any entity associated with adversarial governments—specifically, China, Russia, North Korea, and Iran[5]—that engages in activities or partnerships posing risks to U.S. security[6]. These risks may include collaboration with foreign military or intelligence agencies, involvement in dual-use research, or access to sensitive personal or genetic information of U.S. citizens. Companies already designated as BCCs include BGI, MGI, Complete Genomics, WuXi AppTec, and WuXi Biologics, all of which have substantial ties to China and the Chinese government or military[7]. Under Section 2(f)(4) of the Act, the Office of Management and Budget (OMB) is required to continuously evaluate and update the BCC list in consultation with agencies such as the Department of Defense, Department of Commerce, and the National Intelligence Community to reflect evolving security concerns[8]. The designation process presents significant challenges for Taiwanese companies, particularly those that have connections with BCCs or rely on BCC technologies for their products, diagnostics, or research initiatives. For instance, if a Taiwanese company uses gene sequencing technology or multiomics tools sourced from one of the designated BCCs, it may face restrictions when pursuing contracts with U.S. entities or seeking federal funding. To proactively address these challenges, Taiwanese companies should establish compliance protocols that verify the origin of their technology and data sources. Moreover, developing new supply chain relationships with U.S. or European suppliers may not only reduce reliance on BCC-affiliated technology but also enhance Taiwanese companies' reputation as secure and reliable partners in the biotechnology industry. By adapting proactively to the BCC designation process, Taiwanese companies can anticipate and respond to future regulatory shifts more effectively. Diversifying their technology base away from BCCs positions these companies to better align with U.S. biosecurity standards, thereby becoming more attractive collaborators for U.S.-based biotechnology and life sciences companies. Given the rapid pace of regulatory and security developments, staying informed about changes in BCC designations will enable Taiwanese companies to operate with greater agility, adjusting suppliers and adopting new compliance measures as needed. Such proactive alignment can strengthen their resilience and reinforce their status as stable and secure participants in the global biotechnology landscape. III.Prohibition on Government Contracts and Funding A core component of the BIOSECURE Act is its stringent restrictions on contracting and funding involving entities linked to BCCs, as detailed in Section 2(a) of the act[9]. These restrictions extend beyond direct federal interactions to include any recipients of federal funds, prohibiting them from using such funds to procure biotechnology products or services from BCCs[10]. By curtailing federal support and preventing indirect financial benefits to these companies, the U.S. aims to mitigate national security risks posed by adversarial governments. The wide-reaching scope of these prohibitions makes the BIOSECURE Act one of the most comprehensive legislative efforts to secure the biotechnology sector and address concerns over foreign technologies potentially compromising U.S. security interests. For Taiwanese biotechnology companies, these prohibitions introduce substantial compliance demands, particularly for companies that utilize BCC technology within their supply chains. For example, a Taiwanese company engaged in a joint research project with a U.S. government contractor may be required to demonstrate that none of its technology or data sources originate from BCCs. Compliance could necessitate rigorous supply chain audits and operational adjustments, potentially increasing short-term costs. However, aligning with U.S. regulatory standards preemptively can position Taiwanese companies as more desirable partners for U.S. entities that are increasingly prioritizing security and regulatory adherence. The BIOSECURE Act also incentivizes Taiwanese companies to explore alternative technology providers that meet U.S. biosecurity criteria, including secure data management practices, compliance with federal regulations, and the absence of connections to adversarial governments. By sourcing technology from approved U.S. or European biotechnology companies, Taiwanese companies can enhance their market access and collaborative prospects in the U.S. biotechnology and life sciences sectors. This strategy may also foster long-term stability in partnerships and mitigate risks associated with supply chain disruptions, particularly if more companies are designated as BCCs in the future[11]. Establishing partnerships with U.S.-aligned suppliers can also provide Taiwanese companies with a competitive edge in securing government contracts and research funding, as U.S.-based entities increasingly prefer suppliers that comply with national biosecurity requirements. IV.Enforcement Mechanisms, Transition Periods, and Taiwanese Considerations The BIOSECURE Act outlines key enforcement mechanisms and transitional provisions designed to facilitate the adjustment process for companies affected by its restrictions. Specifically, Section 2(c) of the Act provides an eight-year grandfathering period for contracts established prior to the Act’s effective date involving existing BCCs, allowing these agreements to continue until January 1, 2032[12]. This provision is intended to provide companies that are dependent on BCC-supplied biotechnology ample time to transition to compliant suppliers. In addition, the Act includes a "safe harbor" provision[13], which clarifies that equipment previously produced by a BCC but now sourced from a non-BCC entity will not be restricted. This allows companies to re-source components without the risk of penalties for past procurement decisions. For Taiwanese companies, this transition period presents a critical opportunity to adapt to the new regulatory environment without facing immediate disruptions to business operations. Companies dependent on BCC technology for essential biotechnological functions can leverage the eight-year window to gradually phase out such suppliers, thereby minimizing the impact on operations while ensuring future compliance. For example, a Taiwanese company that relies on a BCC’s sequencing technology for genomic research can use this period to forge partnerships with compliant technology suppliers, thereby avoiding sudden disruptions in research or production. Additionally, the Act includes a waiver provision[14] that allows case-by-case exemptions under specific conditions, particularly when compliance is infeasible, such as in instances where critical healthcare services abroad are at risk[15]. By making strategic use of the phased enforcement and waiver provisions, Taiwanese companies can restructure their supply chains to align fully with U.S. requirements. Those that plan these transitions carefully not only ensure regulatory compliance but also enhance their appeal as resilient and trustworthy partners in the U.S. market. Exploring new collaborations with U.S.-approved biotechnology suppliers can further bolster supply chain resilience against future geopolitical or regulatory uncertainties. The transition period[16] and waiver options[17] reflect the BIOSECURE Act's balanced approach between immediate security needs and pragmatic implementation, which Taiwanese companies can capitalize on to build robust, compliant biotechnological operations. V.Conclusion The U.S. BIOSECURE Act[18] presents both significant challenges and strategic opportunities for Taiwanese biotechnology companies. The Act’s restrictions on contracts with designated BCCs and funding constraints necessitate a reassessment of technology acquisition strategies and a reinforcement of compliance practices. Taiwanese companies seeking deeper integration into U.S. and global biotechnology markets will benefit from aligning their procurement approaches with non-BCC suppliers, particularly those in the U.S. or allied countries. This proactive alignment will not only mitigate potential compliance risks but also enhance Taiwanese companies’ reputations as reliable global partners in biotechnology. The phased enforcement and waiver provisions of the BIOSECURE Act[19] provide Taiwanese companies with a clear pathway to navigate the evolving regulatory landscape, allowing them to establish stronger, more resilient supply chains that meet U.S. standards. Such alignment positions these companies as competitive players in the biotechnology sector, contributing to secure and innovative progress in an increasingly interconnected world. By actively engaging with the BIOSECURE Act’s compliance demands, Taiwanese biotechnology companies can leverage the Act's phased implementation to ensure sustained, secure access to the U.S. market and foster strategic biotechnology partnerships. Reference: [1] U.S. CONGRESS, H.R. 8333 – U.S. BIOSECURE Act (2024), https://www.congress.gov/bill/118th-congress/house-bill/8333 (last visited Nov. 1, 2024). [2] OFFICE OF THE CLERK, U.S. HOUSE OF REPRESENTATIVES, Roll Call Vote No. 402 on H.R. 8333 (Sept. 9, 2024), https://clerk.house.gov/Votes?RollCallNum=402&BillNum=H.R.8333 (last visited Nov. 1, 2024). [3] JANINE LITTLE, U.S. House Of Representatives Passes The BIOSECURE Act During “China Week”, Global Supply Chain Law Blog (Sept. 13, 2024), https://www.globalsupplychainlawblog.com/supply-chain/u-s-house-of-representatives-passes-the-biosecure-act-during-china-week/ (last visited Nov. 1, 2024). [4] SABINE NAUGÈS & SARAH L. ENGLE, BIOSECURE Act: US Target on Chinese Biotechnology Companies, NAT'L L. REV. (Sept. 13, 2024), https://natlawreview.com/article/biosecure-act-us-target-chinese-biotechnology-companies (last visited Nov. 1, 2024). [5] 10 U.S.C. § 4872(d) (2024), https://www.law.cornell.edu/uscode/text/10/4872 (last visited Nov. 1, 2024). [6] U.S. CONGRESS, H.R. 8333 – U.S. BIOSECURE Act (2024), https://www.congress.gov/bill/118th-congress/house-bill/8333 (last visited Nov. 1, 2024). [7] id. [8] id. [9] id. [10] id. [11] JANINE LITTLE, U.S. House Of Representatives Passes The BIOSECURE Act During “China Week”, Global Supply Chain Law Blog (Sept. 13, 2024), https://www.globalsupplychainlawblog.com/supply-chain/u-s-house-of-representatives-passes-the-biosecure-act-during-china-week/ (last visited Nov. 1, 2024). [12] U.S. CONGRESS, H.R. 8333 – U.S. BIOSECURE Act (2024), https://www.congress.gov/bill/118th-congress/house-bill/8333 (last visited Nov. 1, 2024). [13] id. [14] id. [15] id. [16] id. [17] id. [18] id. [19] id.

The EU's New Legal Framework for European Research Infrastructure

Recognized that Research infrastructures (RIs) are at the centre of the knowledge triangle of research, education and innovation and play an increasingly important role in the advancement of knowledge and technology, the EU began to finance for the establishments of RIs by its Framework Programmes (FPs) since the start of FP2 of 1987. On the other hand, the EU also assigned the European Strategy Forum on Research Infrastructures (ESFRI) to develop a coherent and strategy-led approach to policy-making on RIs between Member States and to facilitate the better use and development of RIs at EU and international level. Based on those efforts, the European Commission understood that a major difficulty in setting up RIs between EU countries is the lack of an adequate legal framework allowing the creation of appropriate partnerships and proposed a legal framework for a European research infrastructure adapted to the needs of such facilities. The new legal framework for a European Research Infrastructure Consortium (ERIC) entered into force on 28 August 2009. An successfully-set-up ERIC will have the legal personality based on EU law, and can benefit from exemptions from VAT and excise duty in all EU Member States and may adopt its own procurement procedures to get rid of the EU's public procurement procedures. It is predicted that the Biobanking and Biomolecular Resources Research Infrastructure (BBMRI) will apply to become a BBMRI-ERIC in the near future. The EU also seeks to lead in Energy, Food and Biology through the reforms of ERICs to assist the high quality of activities of European scientists and attract the best researchers from around the world. Besides, in order to connect the knowledge triangle effectively, the European Commission also established the European Institute of Innovation and Technology (EIT) on March 2008. It hopes through the research development partnership network to gather all the advantages from the science and technology chains of multiple areas, and make an effort for the strategy of EU innovation development jointly；Meanwhile, extends its roadmap to the objectives and practices of the Knowledge and Innovation Communities (KICs) of the EIT. Contrast with the EU's advance, it is necessary to our government to concentrate and contemplate whether it is the time to reconsider if our existing legal instruments available to domestic research facilities and infrastructures are sufficient enough to reach our science and technology development goals.

Taiwan Announced the Biobanks Regulations and Management Practices

Taiwan Has Passed “Statute of Human Biobank Management” to Maintain Privacy and Improve Medicine Industries Due to lack of regulations, divergent opinions abounded about the establishment of Biobanks and collection of human biological specimen. For example, a researcher in an academic research organization and a hospital-based physician collected biospecimens from native Taiwanese. Although they insisted that the collections were for research only, human rights groups, ethics researchers, and groups for natives´ benefits condemned the collections as an invasion of human rights. Consequently, the Taiwanese government recognized the need for Biobanks regulation. To investigate the relationship between disease and multiple factors and to proceed with possible prevention, The Legislative Yuan Social Welfare and Healthy Environment Committee has passed "the draft statute of human biobank management" through primary reviewing process on December 30, 2009 and subsequently passed through entire three-reading procedure on January 7, 2010. Therefore, the medical and research institute not only can set up optimal gene database for particular disease curing, but also can collect blood sample for database establishment, legally. However, the use of sample collections will be excluded from the use of judiciary purpose. In the light of to establish large scale biobank is going to face the fundamental human right issue, from the viewpoint of biobank management, it is essential not only to set up the strict ethics regulation for operational standard, but also to make the legal environment more complete. For instance, the Department of Health, Executive Yuan had committed the earlier planning of Taiwan biobank establishment to the Academic Sinica in 2006, and planned to collect bio-specimen by recruiting volunteers. However, it has been criticized by all circles that it might be considered violating the Constitution article 8 provision 1 front paragraph, and article 22 rules; moreover, it might also infringe the personal liberty or body information privacy. Therefore, the Executive Yuan has passed the draft statute of human biobank management which was drafted and reviewed by Department of Health during the 3152nd meeting, on July 16, 2009, to achieve the goal of protecting our nation’s privacy and promoting the development of medical science by management biomedical research affairs in more effective ways. Currently, the draft statute has been passed through the primary review procedure by the Legislative Yuan. About the draft statute, there are several important points as following: (1) Sample Definition: Types of collected sample include human somatic cell, tissues, body fluids, or other derivatives; (2) Biobank Establishment: It requires not only to be qualified and permitted, but also to set up the ethical reviewing mechanism to strengthen its management and application; (3)Sample Collection and Participant Protection: In accordance with the draft statute, bio-specimen collecting should respect the living ethics during the time and refer to the "Medical Law" article 64 provision 1; before sample collection, all related points of attention should be kept in written form , the participant should be notified accordingly, and samples can only be collected with the participant’s consent. Furthermore, regarding the restrained read right and setting up participants’ sample process way if there were death or lost of their capacity; (4) Biobank Management: The safety regulation, obligation of active notification, free to retreat, data destruction, confidentiality and obligation, and termination of operation handling are stipulated; and (5) Biobank Application: According to the new draft statute, that the biological data can’t be used for other purposes, for example, the use of inquisition result for the "Civil law", article 1063, provision 2, prosecution for denying the parent-child relationship law suit", or according to the "Criminal law", article 213, provision 6. This rule not only protects the participants’ body information and their privacy right, but also clearly defines application limits, as well as to set up the mechanism for inner control and avoid conflict of interests to prevent unnecessary disputes. Finally, the Department of Health noted that, as many medical researches has shown that the occurrence of diseases are mostly co-effected by various factors such as multiple genes and their living environment, rather than one single gene, developed countries have actively devoted to human biological sample collection for their national biobank establishment. The construction and usage of a large-scale human bank may bring up the critical issue such as privacy protection and ethical problems; however, to meet the equilibrium biomedical research promotion and citizen privacy issue will highly depend on the cooperation and trust between the public and private sectors. Taiwan Department of Health Announced the Human Biobanks Information Security Regulation The field of human biobanks will be governed by the Act of Human Biobanks (“Biobanks Act”) after its promulgation on February 3, 2010 in Taiwan. According to Article 13 of the Biobanks Act, a biobank owner should establish its directive rules based on the regulation of information security of biobanks announced by the competent authority. Thus the Department of Health announced the draft of the Human Biobanks Information Security Regulation (“Regulation”) for the due process requirement. According to the Biobanks Act, only the government institutes, medical institutes, academic institutes, and research institutes are competent to establish biobanks (Article 4). In terms of the collecting of organisms, the participants should be informed of the relevant matters by reasonable patterns, and the collecting of organisms may be conducted after obtaining the written consent of the participants (Article 6). The relative information including the organisms and its derivatives are not allowed to be used except for biological and medical research. After all the protection of biobanks relative information above, the most important thing is the safety regulations and directive rules of the database administration lest all the restrictions of biobanks owners and the use be in vain. The draft Regulation aims to strengthen the safety of biobanks database and assure the data, the systems, the equipments, and the web circumstances are safe for the sake of the participants’ rights. The significant aspects of the draft are described as below. At first, the regulation should refer to the ISO27001, ISO27002 and other official rules. Concerning the personnel management, the security assessment is required and the database management personnel and researchers may not serve concurrently. In case some tasks are outsourced, the contractor should be responsible for the information security; the nondisclosure agreement and auditing mechanism are required. The application system should update periodically including the anti-virus and firewall programs. The biobanks database should be separated physically form internet connection, including the prohibition of information transforming by email or any other patterns through internet. The authorizing protocol of access to the biobanks should be established and all log files should be preserved in a period. The system establishment and maintenance should avoid remote control. In case the database system is physically out of the owner’s control, the authorization of the officer in charge is required. If an information security accident occurred, the bionbanks owner should contact the competent authority immediately and inform the participants by adequate tunnel. The biobanks owner should establish annual security auditing program and the project auditing will be conducted subject to the necessity. To sum up, while the biobanks database security regulation is fully established, the biobanks owners will have the sufficient guidance in connection with the biobank information security to comply with in the future.

The opening and sharing of scientific data- The Data Policy of the U.S. National Institutes of Health

The opening and sharing of scientific data- The Data Policy of the U.S. National Institutes of Health Li-Ting Tsai 　　Scientific research improves the well-being of all mankind, the data sharing on medical and health promote the overall amount of energy in research field. For promoting the access of scientific data and research findings which was supported by the government, the U.S. government affirmed in principle that the development of science was related to the retention and accesses of data. The disclosure of information should comply with legal restrictions, and the limitation by time as well. For government-sponsored research, the data produced was based on the principle of free access, and government policies should also consider the actual situation of international cooperation[1]Furthermore, the access of scientific research data would help to promote scientific development, therefore while formulating a sharing policy, the government should also consider the situation of international cooperation, and discuss the strategy of data disclosure based on the principle of free access. 　　In order to increase the effectiveness of scientific data, the U.S. National Institutes of Health (NIH) set up the Office of Science Policy (OSP) to formulate a policy which included a wide range of issues, such as biosafety (biosecurity), genetic testing, genomic data sharing, human subjects protections, the organization and management of the NIH, and the outputs and value of NIH-funded research. Through extensive analysis and reports, proposed emerging policy recommendations.[2] At the level of scientific data sharing, NIH focused on "genes and health" and "scientific data management". The progress of biomedical research depended on the access of scientific data; sharing scientific data was helpful to verify research results. Researchers integrated data to strengthen analysis, promoted the reuse of difficult-generated data, and accelerated research progress.[3] NIH promoted the use of scientific data through data management to verify and share research results. 　　For assisting data sharing, NIH had issued a data management and sharing policy (DMS Policy), which aimed to promote the sharing of scientific data funded or conducted by NIH.[4] DMS Policy defines “scientific data.” as “The recorded factual material commonly accepted in the scientific community as of sufficient quality to validate and replicate research findings, regardless of whether the data are used to support scholarly publications. Scientific data do not include laboratory notebooks, preliminary analyses, completed case report forms, drafts of scientific papers, plans for future research, peer reviews, communications with colleagues, or physical objects, such as laboratory specimens.”[5] In other words, for determining scientific data, it is not only based on whether the data can support academic publications, but also based on whether the scientific data is a record of facts and whether the research results can be repeatedly verified. 　　In addition, NIH, NIH research institutes, centers, and offices have had expected sharing of data, such as: scientific data sharing, related standards, database selection, time limitation, applicable and presented in the plan; if not applicable, the researcher should propose the data sharing and management methods in the plan. NIH also recommended that the management and sharing of data should implement the FAIR (Findable, Accessible, Interoperable and Reusable) principles. The types of data to be shared should first in general descriptions and estimates, the second was to list meta-data and other documents that would help to explain scientific data. NIH encouraged the sharing of scientific data as soon as possible, no later than the publication or implementation period.[6] It was said that even each research project was not suitable for the existing sharing strategy, when planning a proposal, the research team should still develop a suitable method for sharing and management, and follow the FAIR principles. 　　The scientific research data which was provided by the research team would be stored in a database which was designated by the policy or funder. NIH proposed a list of recommended databases lists[7], and described the characteristics of ideal storage databases as “have unique and persistent identifiers, a long-term and sustainable data management plan, set up metadata, organizing data and quality assurance, free and easy access, broad and measured reuse, clear use guidance, security and integrity, confidentiality, common format, provenance and data retention policy”[8]. That is to say, the design of the database should be easy to search scientific data, and should maintain the security, integrity and confidentiality and so on of the data while accessing them. 　　In the practical application of NIH shared data, in order to share genetic research data, NIH proposed a Genomic Data Sharing (GDS) Policy in 2014, including NIH funding guidelines and contracts; NIH’s GDS policy applied to all NIHs Funded research, the generated large-scale human or non-human genetic data would be used in subsequent research. [9] This can effectively promote genetic research forward. 　　The GDS policy obliged researchers to provide genomic data; researchers who access genomic data should also abide by the terms that they used the Controlled-Access Data for research.[10] After NIH approved, researchers could use the NIH Controlled-Access Data for secondary research.[11] Reviewed by NIH Data Access Committee, while researchers accessed data must follow the terms which was using Controlled-Access Data for research reason.[12] The Genomic Summary Results (GSR) was belong to NIH policy,[13] and according to the purpose of GDS policy, GSR was defined as summary statistics which was provided by researchers, and non-sensitive data was included to the database that was designated by NIH.[14] Namely. NIH used the application and approval of control access data to strike a balance between the data of limitation access and scientific development. 　　For responding the COVID-19 and accelerating the development of treatments and vaccines, NIH's data sharing and management policy alleviated the global scientific community’s need for opening and sharing scientific data. This policy established data sharing as a basic component in the research process.[15] In conclusion, internalizing data sharing in the research process will help to update the research process globally and face the scientific challenges of all mankind together. [1]NATIONAL SCIENCE AND TECHNOLOGY COUNCIL, COMMITTEE ON SCIENCE, SUBCOMMITEE ON INTERNATIONAL ISSUES, INTERAGENCY WORKING GROUP ON OPEN DATA SHARING POLICY, Principles For Promoting Access To Federal Government-Supported Scientific Data And Research Findings Through International Scientific Cooperation (2016), 1, organized from Principles, at 5-8, https://obamawhitehouse.archives.gov/sites/default/files/microsites/ostp/NSTC/iwgodsp_principles_0.pdf (last visited December 14, 2020). [2]About Us, Welcome to NIH Office of Science Policy, NIH National Institutes of Health Office of Science Policy, https://osp.od.nih.gov/about-us/ (last visited December 7, 2020). [3]NIH Data Management and Sharing Activities Related to Public Access and Open Science, NIH National Institutes of Health Office of Science Policy, https://osp.od.nih.gov/scientific-sharing/nih-data-management-and-sharing-activities-related-to-public-access-and-open-science/ (last visited December 10, 2020). [4]Final NIH Policy for Data Management and Sharing, NIH National Institutes of Health Office of Extramural Research, Office of The Director, National Institutes of Health (OD), https://grants.nih.gov/grants/guide/notice-files/NOT-OD-21-013.html (last visited December 11, 2020). [5]Final NIH Policy for Data Management and Sharing, NIH National Institutes of Health Office of Extramural Research, Office of The Director, National Institutes of Health (OD), https://grants.nih.gov/grants/guide/notice-files/NOT-OD-21-013.html (last visited December 12, 2020). [6]Supplemental Information to the NIH Policy for Data Management and Sharing: Elements of an NIH Data Management and Sharing Plan, Office of The Director, National Institutes of Health (OD), https://grants.nih.gov/grants/guide/notice-files/NOT-OD-21-014.html (last visited December 13, 2020). [7]The list of databases in details please see：Open Domain-Specific Data Sharing Repositories, NIH National Library of Medicine, https://www.nlm.nih.gov/NIHbmic/domain_specific_repositories.html (last visited December 24, 2020). [8]Supplemental Information to the NIH Policy for Data Management and Sharing: Selecting a Repository for Data Resulting from NIH-Supported Research, Office of The Director, National Institutes of Health (OD), https://grants.nih.gov/grants/guide/notice-files/NOT-OD-21-016.html (last visited December 13, 2020). [9]NIH Genomic Data Sharing, National Institutes of Health Office of Science Policy, https://osp.od.nih.gov/scientific-sharing/genomic-data-sharing/ (last visited December 15, 2020). [10]NIH Genomic Data Sharing Policy, National Institutes of Health (NIH), https://grants.nih.gov/grants/guide/notice-files/NOT-OD-14-124.html (last visited December 17, 2020). [11]NIH Genomic Data Sharing Policy, National Institutes of Health (NIH), https://grants.nih.gov/grants/guide/notice-files/NOT-OD-14-124.html (last visited December 17, 2020). [12]id. [13]NIH National Institutes of Health Turning Discovery into Health, Responsible Use of Human Genomic Data An Informational Resource, 1, at 6, https://osp.od.nih.gov/wp-content/uploads/Responsible_Use_of_Human_Genomic_Data_Informational_Resource.pdf (last visited December 17, 2020). [14]Update to NIH Management of Genomic Summary Results Access, National Institutes of Health (NIH), https://grants.nih.gov/grants/guide/notice-files/NOT-OD-19-023.html (last visited December 17, 2020). [15]Francis S. Collins, Statement on Final NIH Policy for Data Management and Sharing, National Institutes of Health Turning Discovery Into Health, https://www.nih.gov/about-nih/who-we-are/nih-director/statements/statement-final-nih-policy-data-management-sharing (last visited December 14, 2020).

Most read
[　X Close　]
Copyright © 2016 STLI,III. All Rights Reserved.
TOP