> Article > Information and Communication Law
Back
Next From Deregulation to Re-regulation: An Analysis of the 2025 Amendment to Taiwan's Telecommunications Management Act

Response to Personal Data Security Incidents: Obligations of Third-Party Payment Service Providers under the Amended Personal Data Protection Act

Response to Personal Data Security Incidents: Obligations of Third-Party Payment Service Providers under the Amended Personal Data Protection Act

2025/11/15

Third-party payment service providers (TPPs) play a central role in payment processing, identity verification, and transaction records; and consequently hold large volumes of important personal data. In recent years, frequent personal data security incidents related to domestic and international electronic payment services have led to increased vigilance from the competent authority regarding the personal data security maintenance of third-party payment services. At the same time, new amendments to the Personal Data Protection Act (PDPA) have strengthened personal data protection obligations. TPPs that fail to implement adequate protective measures may face legal liabilities and reputational risks.

This article analyzes the new amendments to the PDPA. Drawing from the requirements of the Enforcement Rules of the Personal Data Protection Act (the Enforcement Rules) and the Regulations Regarding the Security Maintenance and Administration of Personal Information Files in Digital Economy Industry (數位經濟相關產業個人資料檔案安全維護管理辦法, Security Maintenance Regulations)[1], it outlines and explores the key considerations of TPPs’ major obligations in the event of a personal data security incident: reporting to the competent authority, notifying data subjects, implementing incident response measures, preventing personal data security incidents and cooperating with the competent authority’s inspections.

I. Key PDPA Amendments Regarding Security Incidents

Amendments to the PDPA recently passed the third reading by Taiwan’s Legislative Yuan[2] and were subsequently promulgated by the President on November 11, 2025[3]. These amendments vest regulatory authority in the Personal Data Protection Commission (個人資料保護委員會, PDPC) as the independent competent authority, strengthen personal data supervision and management in the public sector, and introduce several key changes to the data protection obligations of non-government agencies. Although the Executive Yuan has yet to designate an enforcement date for the new amendments[4], TPPs should prepare in advance. The following sections explain five key points from these amendments related to personal data security incidents.

1. Obligation to Report Personal Data Security Incidents and Notify Data Subjects

Following the amendments, Article 12 of the PDPA clarifies the obligations to report and notify personal data security incidents. First, the timing for notifying data subjects has been adjusted from “after investigation and confirmation” to “immediately upon becoming aware of the incident.” Second, the amendments introduce a new statutory obligation to “report to the competent authority if a certain reporting threshold is met.” This reporting requirement previously existed only in the Enforcement Rules[5] and the Security Maintenance Regulations[6].

2. Obligation to Implement Incident Response Measures and Retain Records

In addition to promptly notifying data subjects and reporting to the competent authority, TPPs must take “immediate and effective incident response measures” to contain the incident and prevent further harm. Furthermore, TPPs are required to document the facts, impact, and incident response measures taken, and retain such records for inspection by the competent authority.

3. Obligation to Prevent Personal Data Security Incidents

TPPs should establish comprehensive protective mechanisms to prevent personal data security incidents. Continuing the existing security maintenance obligations, the PDPA amendments relocate the provision of Article 27, Paragraph 1 of the old Act to Article 20-1, Paragraph 1, consolidating it as “matters required for security maintenance.” This revision reaffirms the TPPs' responsibility to maintain the security of personal data by adopting appropriate technical and organizational measures in accordance with relevant regulations.

TPPs are also required to comply with the specific security maintenance matters prescribed in the Security Maintenance Regulations. They must implement internal security management and technical protection measures to effectively prevent the theft, alteration, destruction, loss, or leakage of the personal data they hold.

4. Obligation to Cooperate with Administrative Inspections

To identify the cause of personal data security incidents and ensure the effective implementation of security maintenance measures, TPPs must cooperate with administrative inspections in addition to fulfilling their security maintenance obligations. Where the competent authority believes a TPP may have violated the PDPA, or deems it necessary to verify their compliance with the PDPA, TPPs must cooperate with the following inspection methods: (1) providing statements; (2) providing necessary documents, materials, items, or taking other cooperative measures; and (3) cooperating with on-site inspections, providing necessary explanations, cooperative measures, or relevant proof documents[7]. The competent authority may conduct ex officio on-site checks or document reviews, and TPPs must prepare supporting documentation and improvement plans to ensure incident response compliance and auditability.

5. Penalties and Transitional Period

After the amendments take effect, if a TPP fails to notify data subjects, report to the competent authority, take incident response measures, preserve records; or, without justifiable reason, evades, obstructs, or refuses to cooperate with administrative inspections, the competent authority may, depending on the nature and severity of the violation, order rectification within a prescribed period or impose a fine up to NT$15 million[8].

Furthermore, these amendments establish a jurisdictional transition period. For certain supervisory and administrative matters concerning non-government agencies, that fall within the mandate of the PDPC, jurisdiction shall, for six years from the establishment of the PDPC and upon public notice by the Executive Yuan, remain with the respective central competent authorities[9]. Accordingly, during this transition period, the inspection of security maintenance matters and the enforcement of penalties for TPPs may still be conducted by the Ministry of Digital Development (MODA). TPPs must continue to comply with the Security Maintenance Regulations issued by the MODA.

6. Summary

Integrating the amended PDPA, its Enforcement Rules, and the Security Maintenance Regulations, a TPP who becomes aware of a personal data security incident must notify data subjects, and the notification content must include the facts of the incident and the incident response measures taken. While the amended Article 12 emphasizes “immediacy” of notification upon awareness and requires incident response action to prevent further expansion, the full confirmation of incident response measures requires time in practice, which can create a timing conflict with the immediacy requirement.

Therefore, until the PDPC stipulates the “content, method, timing, scope of reporting, incident response measures, record preservation, and other related matters”[10], and to balance legal compliance with data subject rights, it is recommended that TPPs adopt a “phased notification” approach: immediately notifying the data subject upon awareness to prompt protective measures (such as changing passwords or guarding against scams), and subsequently issuing a supplementary notification after the incident response measures have been implemented, detailing the countermeasures taken and the full scope of the incident.

II. Four Key Steps for Responding to Personal Data Security Incidents

In practice, when a personal data security incident occurs, TPPs must immediately activate their incident response procedures and implement relevant measures in accordance with the “Security and Maintenance Plan for the Protection of Personal Data Files and a Guideline On Disposing Personal Data Following Business Termination (個人資料檔案安全維護計畫及業務終止後個人資料處理方法, Security Maintenance Plan)” stipulated by their Security Maintenance Regulations. The aforementioned statutory obligations concerning notification, reporting, incident response, prevention, and cooperation with inspections may all be activated simultaneously upon the incident's occurrence. Following the enforcement of the PDPA amendments, TPPs bear simultaneous compliance obligations under the amended PDPA, its Enforcement Rules, and the Security Maintenance Regulations. The following four steps are therefore recommended:

Step 1: Taking Immediate and Effective Incident Response Measures. TPPs must take immediate and effective incident response measures upon becoming aware of the incident to prevent further escalation. This is the first priority for responding to a data incident, aimed at damage control, and should be executed concurrently with the investigation of the incident cause and assessment of the scope of impact.

Step 2: Obligation to Notify Data Subjects. Upon becoming aware of the incident, TPPs must promptly notify data subjects of the occurrence of the personal data security incident and the measures taken in response through appropriate means such as oral statement, written notice, telephone, text message, email, fax, electronic document, or any other means sufficient to ensure the data subject is informed or can reasonably become aware[11], and provide “a hotline or other appropriate channel for follow-up inquiries for data subjects to seek information”[12]. Furthermore, since some data subjects whose personal data is collected by TPPs are the end-consumers transacting with merchants, TPPs must ensure that, at the outset of their service processes, they clearly establish the legal basis and contact mechanisms that enable direct notification of data subjects (including consumers) in accordance with the privacy policy, service contract, or relevant notice documents, to ensure effective fulfillment of the notification obligation when an incident occurs.

Step 3: Obligation to Report to the Competent Authority. This obligation is divided into two phases: before and after the amendments take effect. Before the amendments take effect, TPPs must comply with the current Security Maintenance Regulations and report to the Ministry of Digital Development (MODA). After the amendments take effect, TPPs will have the statutory obligation to report to the Personal Data Protection Commission (PDPC). Upon receiving a TPP’s report, the PDPC will in turn notify MODA.

During the transition period, the reporting requirements stipulated in Article 8 of the existing Security Maintenance Regulations may continue to apply. Specifically, the reporting timeline is limited to ”completion within 72 hours of becoming aware of the incident,” and the incident must be judged based on the criterion of “endangers its normal operations or the rights and interests of a large number of data subjects.” These requirements remain the key substantive compliance standards at present. TPPs are advised to establish their internal reporting procedures in accordance with the regulations in force at the time of reporting and to closely monitor the effective date of the amendments and any further announcements issued by the PDPC.

Step 4: Cooperating with Administrative Inspections and Retaining Records. TPPs must properly retain all relevant records from the incident response process for inspection by the competent authority. When cooperating with an administrative inspection, TPPs should not only prepare the root cause analysis report (documenting the relevant the facts, the impact, and the incident response measures taken) and supporting evidence for data subject notifications in a timely manner, but also be prepared to provide any additional documentation as required.

If the competent authority requests a review of the implementation of the Security Maintenance Plan, TPPs are advised to provide the Plan along with documentation demonstrating the implementation of the required security maintenance measures. Doing so enables TPPs to substantiate their compliance efforts and incident response capabilities.

III. Recommendations and Conclusion

In summary, this article recommends that TPPs promptly review and refine their Security Maintenance Plan to ensure that their systems, procedures, and operational practices comply with applicable legal requirements. Concurrently, TPPs should establish clear incident reporting and incident response procedures, incorporating into their internal processes the immediate notification of data subjects, reporting to the competent authority, taking incident response measures, and preparing documentation for inspection. Given the enforcement trends following the amended provisions, only by implementing robust preventive measures and effective post-incident response capabilities can TPPs maintain regulatory compliance and preserve market trust amid the increasing frequency of personal data security incidents.

[1]數位經濟相關產業個人資料檔案安全維護管理辦法，https://law.moda.gov.tw/LawContent.aspx?id=GL000090 （最後瀏覽日期︰2025/11/12）。

[2]〈立法院三讀通過「個人資料保護法」部分條文修正草案〉，個人資料保護委員會，https://www.pdpc.gov.tw/News_Content/20/1001/ （最後瀏覽日期︰2025/11/12）。

[3]總統令 華總一經字第11400114521號，中華民國總統府，https://www.president.gov.tw/Page/78 （最後瀏覽日期︰2025/11/12）。

[4]＜個人資料保護法部分條文修正案，業於今(114年11月11日)日經總統公布，本次修正條文施行日期將另由行政院定之＞，個人資料保護委員會，https://www.pdpc.gov.tw/News_Content/20/1010/ （最後瀏覽日期︰2025/11/12）。

[5]個人資料保護法施行細則第12條第2項第4款規定。

[6]數位經濟相關產業個人資料檔案安全維護管理辦法第8條第2項規定。

[7]個人資料保護法第22條第1項規定。

[8]個人資料保護法第47條至第50條規定。

[9]個人資料保護法第51-1條規定。

[10]個人資料保護法第12條第4項規定。

[11]個人資料保護法施行細則第22條規定。

[12]數位經濟相關產業個人資料檔案安全維護管理辦法第8條第1項第2款規定。

※Response to Personal Data Security Incidents: Obligations of Third-Party Payment Service Providers under the Amended Personal Data Protection Act,STLI, https://stli.iii.org.tw/en/article-detail.aspx?no=105&tp=2&i=169&d=9426 (Date:2026/07/19)
Quote this paper

Ke, Yu-Syuan
 Associate Legal Researcher

Release： 2025/12
Tag
Read with phone
Back
Next From Deregulation to Re-regulation: An Analysis of the 2025 Amendment to Taiwan's Telecommunications Management Act
You may be interested
Implementing Information Security to Protect Individuals' Privacy

The development of new technology is bound to have both positive and negative effects. However, when a new technology is first introduced, it is common for insufficient attention to be paid to its negative aspects, either because there has not been time to accumulate sufficient experience in using it or because users are blinded by the potential benefits. It is only later, when the technology begins to be abused, that people wake up to the potential dangers. The evolution of computers and the Internet is a classic example of this phenomenon. While the rapid development of information technology has helped to stimulate the flow of information in every corner of society, cyberspace has also become the setting for a wide range of criminal activities. In many cases, countries' existing legal and regulatory frameworks have proved inadequate to cope with the threat posed by the various forms of unauthorized access. A variety of forms of cyber-crime have developed, including denial-of-service attacks, unauthorized accessing of databases, phishing, identity theft and online fraud or intimidation. Cyber-crime may involve making unauthorized use of individuals' personal information, stealing companies' confidential business information or selling state secrets; these new types of crime thus affect every level of society. The effects can be catastrophic, hence the growing importance is now being attached to information security, including both the establishment of effective management mechanisms to prevent cyber-crime from occurring in the first place and the development of the capabilities needed to detect such crime when it occurs. Recognizing the need to plug the gaps in the existing legal and regulatory framework in the face of cyber-crime, countries all over the world are working on the formulation of new legislation, and Taiwan is no exception. The following sections will discuss the key developments in the laws and regulations governing information security in Taiwan in recent years. I. The Convention on Cyber-crime and Chapter 36 of Taiwan’s Criminal Code (offences relating to the abuse of computers) Today, governments throughout the world are formulating measures to combat criminal activity that makes use of the Internet (cyber-crime). In many cases these measures are based on the Convention on Cyber-crime announced by the European Commission on November 23, 2001, and which came into effect on July 1, 2004. This convention is the first international agreement to be established specifically to combat cyber-crime. Its contents include discussion of the various types of cyber-crime, regulations governing the obtaining of electronic evidence, provisions for mutual assistance between nations in judicial matters with respect to cyber-crime and measures to encourage multilateral collaboration. The European Commission asked all signatory nations to revise their own national laws so that they conform to the provisions of the Convention, with the aim of establishing a unified international framework for combating cyber-crime. Responding to the international trend towards the enactment of legislation to fight cyber-crime and to eliminate any loopholes in Taiwanese law that might result in Taiwan becoming a haven for cyber-criminals, on June 25, 2003 the Taiwanese government added a new chapter, Chapter 36 (Offences Relating to the abuse of Computers) to Taiwan's Criminal Code. It contains six articles covering four types of crime: unauthorized access (Article 358), the unauthorized acquisition, deletion or titleeration of electromagnetic records (Article 359), unauthorized use of or interference with a computer system (Article 360) and creating computer programs specifically for the perpetration of a crime (Article 362). Article 361 specifies that more severe punishment should be imposed in the case of violations carried out against the computers or other equipment of a public service organization, and Article 363 states that the provisions of Articles 358–360 shall apply only after prosecution is instituted upon complaint. These new articles provide a clear legal basis for the punishment of common types of cyber-crime such as unauthorized access by hackers, the spreading of computer viruses and the use of Trojan horse programs. In formulating these articles, reference was made to the categorization of cyber-crimes used in the Convention on Cyber-crime and to the suggestions for revision of national laws put forward there. Article 36 is thus in broad conformity with current international practice in this regard and can be expected to achieve significant results in terms of combating cyber-crime. II. The authority of law enforcement to get evidence and ISPs liability In its discussion of the securing of electromagnetic records by law enforcement agencies, the Convention on Cyber-crime notes that such securing of records falls into two broad categories: immediate access and non-immediate access. Immediate access includes the monitoring of communications by law enforcement agencies, non-immediate access relates mainly to the data retention obligations imposed on Internet Service Providers (ISPs). As regards the regulatory framework for the monitoring of communications, Communications Protection and Surveillance Act came into effect in Taiwan on July 16, 1999. According to its provisions, monitoring of communications may only be implemented when it is deemed necessary to protect national security or to maintain social order. Warrants for such surveillance may only be issued if the content of the communications is related to a threat to national security or to the maintenance of social order. Furthermore, the crime in question must be a serious one. In principle, the period for which surveillance is implemented should not exceed 30 days. These restrictions reflect the government’s determination to ensure that citizens' right to privacy is protected. While the Internet is an environment conducive to the maintenance of anonymity, electromagnetic records are easy to erase. Effective investigation of cyber-crime requires automatic recording of communications by the equipment used to transmit the messages, that is to say, it requires the retention of historic data. As regards the extent to which companies are required to collaborate with law enforcement agencies and the conditions applying to the making available of electromagnetic records, these issues relate to the public's right to privacy, and the law in this area needs to be very clear and precise. For the most part, data retention obligations are laid down in Taiwan’s Telecommunications Act. In Taiwan ISPs are classed as "Type II Telecommunications Operators". Article 27 of the Administrative Regulations on Type II Telecommunications Businesses stipulates that Type II telecommunications operators may be required to confirm the existence of, and provide the contents of, customers' communications for the purpose of investigation or collection of evidence upon request in accordance with the requirements of the law. ISPs are required to retain, for a period of between 1 and 6 months, data relating to the account number of subscribers, the times and dates of communications, the times at which subscribers logged on and off, free e-mail accounts, the IP addresses used when applying for Web space and the time and date when such applications were made, the IP address used to make postings on message boards and newsgroups, the time and date when such postings were made and subscribers' e-mail communications records. If a Type II telecommunications operator violates these provisions, he may be fined between NT$200,000 and NT$1 million and be required to remedy the situation within a specified time limit in accordance with Paragraph 2 of Article 64 of the Telecommunications Law. If he fails to remedy the situation within the specified time limit, his license may be revoked. III. The Legal Framework for Personal Data Protection titlehough, as outlined above, some revisions have already been made to the legal framework governing information security, there are still many areas which need to be reviewed. One of the most important is the protection of personal information. Following the explosive growth of the Internet, customer-related information is being processed by computers on a large scale in many different industries. With so many companies collaborating with other firms or adopting new marketing methods, the value and importance of personal information is being reassessed. The dramatic increase in the number of online scams in Taiwan in recent years has made the protection of privacy a focus of attention. The existing Computer-processed Personal Data Protection Law, drawn up to target specific industries, does not really provide adequate protection. A new Personal Data Protection Act, drawn up with reference to the European Union’s Directive (95/46/EC) on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data and the personal information protection legislation adopted in the USA and Japan, has already been submitted to the Legislative Yuan for deliberation. The key differences between this new Act and the existing Computer-processed Personal Data Protection Law are as follows. Protection is no longer industry-specific, it now applies to both natural and juristic persons and to both public and private agencies. The scope of protection has been expanded to include hard copies of documents containing personal information, and five new types of "sensitive information" – information relating to criminal records, medical examinations, medical records, sexual history and genetic information – have been added. Special restrictions apply to the collection and processing of these types of data. The Personal Data Protection Act also imposes stricter requirements on public and private agencies with regard to the protection of individuals' personal data. For example, agencies must formulate personal data protection plans and measures for dealing with personal data once those data are no longer needed for business purposes. If an agency discovers that an individual's personal data have been stolen, leaked, titleered or violated in any way, they are required to notify by telephone or letter the agency responsible for notifying the individual concerned as soon as possible. If these provisions are violated, the agency's responsible person will be liable for administrative punishment. The new Act also gives regulatory authorities greater powers to undertaking auditing in this area, makes provision for class action suits and increases the amount of compensation to be paid to victims. It is expected that these mechanisms will help boost awareness of the importance of information security in all sectors, thereby helping to ensure better protection for the public's personal information. IV. Management of Unsolicited Commercial E-Mail The widespread utilization of e-mail has created a brand new marketing channel, so that e-mail can fairly be described as one of the most important "killer applications" to which the Internet has given rise. Today, spamming is causing serious problems for both e-mail users and ISPs. E-mail users are concerned about their privacy being violated and about having their e-mail box stuffed full of junk e-mail. Spamming also ties up bandwidth which could be used for other purposes, and Distributed Denial of Service Attacks (DDOS) can make it difficult for ISPs to provide normal service to their customers. Governments throughout the world have begun to consider whether anti-spamming legislation may be necessary. In Taiwan draft legislation of this type has already been submitted to the Legislative Yuan. Taiwan's Anti-SPAM Act was drawn up with reference to the USA's CAN-SPAM Act of 2003, Japan's Law on Regulation of Transmission of Specified Electronic Mail, Australia's SPAM Act and the UK's Privacy and Electronic Communications (EC Directive) Regulations 2003. The draft SPAM Act contains 13 articles, with an emphasis on self-regulation, technology filtering and provision for seeking compensation through civil action. The Act provides for the use of an "opt-out" mechanism to regulate the behavior of e-mail senders, with the following obligations to be imposed on them. (1) The sender must specify in the "Subject" field of the e-mail whether it is a "business communication" or "advertising" to facilitate filtering by ISPs and to make clear to the recipient what type it is. (2) The sender must provide accurate information, including header, information on the sender's identity and the sender's e-mail address. (3) E-mails may not be sent if the sender knows or could be expected to know that the intended recipient has already expressed a wish not to receive e-mail from this source. E-mails may also not be sent if the sender knows or could be expected to know that the information in the "Subject" field is inaccurate or misleading. If the sender continues to send e-mails after the recipient has expressed a clear wish not to receive any more from the sender or if the sender falsifies the "Subject" or header information, then the sender may be required to pay compensation to the recipient at a rate of NT$500–2,000 per person per e-mail. With regard to the widespread practice whereby companies or advertising agencies commission third parties to send junk e-mail on their behalf, in cases where the commissioning party knows or could be expected to know that e-mail is being sent in violation of the above regulations, the commissioning party shall be held jointly liable with the party sending the e-mail. Through the implementation of this new law, the government hopes to establish a first-class Internet environment in Taiwan, putting an end to the current situation whereby large numbers of businesses are engaged in spamming. V. Conclusions Security is the biggest single factor affecting the implementation of e-government initiatives, e-business application adoption and Internet user confidence. Most people associate information security only with the purchasing of security hardware or software and the setting up of firewalls. While these products can indeed help to make the online environment more secure, Internet users should not allow themselves to be lulled into thinking that buying these products will in and of itself be sufficient to ensure security. "Security" is a fluid concept. Over time, the level of security that even a high-end product can provide will deteriorate; the fact that your system is secure now does not guarantee that it will remain secure in the future. Evidence that this is true is provided by the damage that is constantly being caused by viruses, by the need to constantly update security products and by the shift in emphasis away from virus prevention and firewalls towards preventing "backdoor" attacks and towards proactive intrusion detection. Furthermore, the information security risks that companies and organizations have to deal with are not limited to external threats; poor internal management may result in employees selling or leaking customer data or other company data, which can cause serious damage to the organization. Examination of information security theory and practice in Taiwan and overseas suggests that the establishment of effective information security measures embraces four main areas: the detection of cyber-crime, development of new information security technologies and formulation of standards, education and management of computer users and regulatory and policy issues. The most important of these is the education and management of computer users. Detection of cyber-crime is the next most important, while development of new technologies and standard setting and the regulatory and policy aspects play a supporting role. To create a genuinely secure online environment, attention must be paid to all of these. Today governments throughout the world are formulating new legislation to plug the gaps in the regulatory framework governing the online environment. Given the need to let the market mechanism operate freely and to refrain from measures that might retard industrial development, government interference in the Internet, with the exception of crime prevention activity, has generally been viewed as a last resort. Currently the government in Taiwan is still focusing mainly on self-regulation by Internet service providers and other types of business enterprise, and the government's role is still largely confined to formulating standards and assisting with the development of new security products. The area on which both the government and the private sector will need to concentrate in the future is educating and ensuring effective management of computer users.

From Deregulation to Re-regulation: An Analysis of the 2025 Amendment to Taiwan's Telecommunications Management Act

From Deregulation to Re-regulation: An Analysis of the 2025 Amendment to Taiwan's Telecommunications Management Act 2025/09/30 As information and communication technologies (ICT) rapidly evolve, global industries have experienced swift iteration and convergence in the past decades. To adapt to this trend and dismantle outdated regulatory restrictions, Taiwan passed the Telecommunications Management Act in 2019[1], replacing the Telecommunications Act[2] of 1996. This move marked a departure from the traditional model of heavily regulating the telecommunications industry as a concession-based business. The new law aimed to promote the launch of innovative services and foster fair market competition. Its fundamental goal was to deregulate, encourage innovation, and establish a more flexible and efficient regulatory framework. However, the 2025 amendment to the Telecommunications Management Act suggests that Taiwan's telecommunications policy is shifting from openness toward a more conservative stance. I. Background: The 2019 Shift to a Registration-Based System The original Telecommunications Act adopted a strict licensing system and vertical regulation, categorizing operators based on whether they owned physical network infrastructure and the specific services they offered. This rigid regime established detailed rules for each business category and imposed heavy penalties on unlicensed operators, stifling the industry's potential for innovation. In response, the 2019 Telecommunications Management Act introduced a horizontal regulation approach, structuring the communications industry into three distinct layers: infrastructure (telecommunications networks), operations (telecommunications services), and content/application. Furthermore, the market entry system was transformed from a licensing model to a registration model. Only service providers needing to interconnect with other operators, apply for radio frequencies, or use telecommunications numbering resources were required to register as "telecommunications enterprises." Providers of other services, like Internet Access Service Providers (IASPs) and Mobile Virtual Network Operators (MVNOs), were not required to register–a policy designed to invigorate the market by encouraging innovation and cross-industry operations. Once registered, however, an enterprise is subject to close supervision by the National Communications Commission (NCC) and must fulfill various legal obligations, including: General Obligations (e.g., retaining communication records). Special Obligations (for specific services, such as providing emergency communications). Designated Obligations (cooperating with national policies like disaster response and assisting with communication surveillance). Given these obligations and a lack of sufficient incentive, IASPs and MVNOs are unlikely to voluntarily register as telecommunications enterprises. II. The 2025 Amendment: Mandating Registration to Combat Fraud Crime The 2025 amendment to Article 5 of the Telecommunications Management Act fundamentally alters this framework. It now mandates that all MVNOs and IASPs register as telecommunications enterprises and fulfill the corresponding obligations. The amended law took effect on July 2, 2025, and existing operators have a one-year grace period to complete their registration. The primary driver for this policy reversal is the national imperative to combat fraud-related crimes. For MVNOs, the rationale is clear. Mobile phone numbers are integral to modern life, functioning as digital identifiers for accessing financial services and engaging in economic activities. To prevent criminals from exploiting anonymous numbers, mandatory registration enables the government to enforce Know Your Customer (KYC) procedures, ensuring the verification of the end-user's identity. For IASPs, the previous voluntary system created ambiguity regarding the total number of operators in the market. The government requires cooperation from IASPs to implement crime-fighting measures, such as restricting access to fraudulent websites under “The Fraud Crime Hazard Prevention Act”[3], or providing “network traffic records” to judicial authorities as required by “The Communication Security and Surveillance Act”[4]. Mandatory registration ensures all IASPs are identifiable and can be called upon to assist in these efforts. III. Challenges and Outlook: The "Tiered Management" Approach Notably, the new law authorizes the NCC to implement "Tiered management", a system that allows for different regulatory requirements based on an operator's revenue, user base, and other factors. This suggests that smaller operators, which may have different risk profiles and a lesser impact on the public interest, could face more relaxed regulations. The NCC is currently drafting the specific standards for this tiered approach. This presents a potential paradox. If the primary goal of mandatory registration is to establish a comprehensive defense against crime, allowing regulatory intensity to vary by company size could create the very loopholes the amendment aims to close. Effectively implementing a framework that is both fair to smaller businesses and robust against criminal exploitation will be a significant test of NCC. [1]Telecommunications Management Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=K0060111 (last visited Sept. 30, 2025). [2]Telecommunications Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=K0060001 (last visited Sept. 30, 2025). [3]Fraud Crime Hazard Prevention Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=D0080226 (last visited Sept. 30, 2025). [4]The Communication Security and Surveillance Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=K0060044 (last visited Sept. 30, 2025).

Legal issues of Third-Party Payment in Taiwan

Although third-party payment is already one of the most popular ways to do the payment online in many countries, for example, Alipay of China and Paypal of USA, third-party payment in Taiwan is just about to start. For these days, the legislation of third-party payment has become a highly debated issue. However, due to many reasons, the legislation of third-party payment eventually has not been realized. And in fact, the third-party payment in Taiwan is not mature yet. A third-party payment system in Taiwan is unable to deposit stored value in advance. This is one of the basic functions of third-party payment system abroad, such as Alipay in China and Paypal in USA. Mainly, what third-party payment provides in Taiwan is money transmission based on real trade. 1. Latest progress of third-party payment in Taiwan. (1)Credit card payment for third-party payment system. Recently, third-party payment has a breakthrough development. According to the resolution of the meeting “Obstacles of using credit card in third party payment” held by Executive Yuan in September this year, Financial Supervisory Commission has made the commitment that the third party payment is allowed to be a “contracted merchant” under “Regulations Governing Institutions Engaging in Credit Card Business”, and personal entity or small business which is not provided with the qualification of “contracted merchant” are allowed to accept credit card payment though third party payment system. This is a very important progress in third-party payment in Taiwan. It means credit card payment is available for C2C transaction now. This will improve the safety of C2C transaction and reduce the quantity of fraud transaction. In other way, boost the prosperity of E-commerce. (2)Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction. In response to the Central Bank’s request, MOEA (Ministry of Economic Affairs) approved and announced the “Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction” on October 3rd, 2012. Any Data Processing Services Industry Performing Trans-border Internet Transaction would like to obtain the qualification as a mandatory under Article 8 of “Regulations Governing the Declaration of Foreign Exchange Receipts and Disbursements or Transactions”, should pass the evaluation according to the “Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction”, and get the compliance certification. The “Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction” has set up several requirements for a business which would like to run the payment service for trans-border internet transaction. Mainly, basic requirements are as the followings. 1-2-1　The applying data processing service enterprise should be a limited company or a company limited by shares. 1-2-2　The applying data processing service enterprise should open a special purpose deposit account to deposit the entire transmitting amount received from consumers. And the transaction of this account should be only based on the consumers’ directions of money transmitting. 1-2-3　Users of the third-party payment service provided by the data processing service enterprise should register for the first time usage. And the user’s name, birth and ID number are required for registration. The applying data processing service enterprise has the liability to check the reality of the information provided. 1-2-4　The contract between the data processing service enterprise and the user should be in writing. If the contract is performed in electronic way, it should follow the requirement of “in writing” according to Article 4 of “Electronic Signatures Act”. In addition, the contract should contain the mandatory articles about foreign exchange declaration listed in the “Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction”. 1-2-5　The data processing service enterprise should be equipped with sound information security system and operating regulations, comply with “Personal Information Protection Act” and the related directives, join ECTSA (E-commerce Trust Security Alliance), and get the ISO27001 certificate or PCI-DSS validation. 1-2-6　The data processing service enterprise should keep detailed transaction information for at least 5 years. 1-2-7　The data processing service enterprise should set up money laundering prevention operating regulations, and provide money laundering prevention employee training annually. Once MOEA receives the application, MOEA will set up a special team, which assembles legal professionals, information engineering experts and financial experts, to conduct the evaluation. The compliance certification of the evaluation will be valid for 5 years. During these 5 years, the data processing enterprise has the duty to accept the annual examination and non-timed examination by MOEA. 2.Three-Party Legal Relationship under Third-Party Payment The nature of a third-party payment service is “service of payment collection and forwarding”. Generally, payment collection and forwarding refers to the transfer of a transaction payment performed by a third party in its role of assisting the buyer and the seller. The current practice in Taiwan of making payment to and collecting product from a convenient store pursuant to online transaction or of paying for product upon delivery by shipping company is a type of “payment collection and forwarding” business. In a relationship of payment collection and forwarding service, the legal relationship between the buyer and the payment collector/forwarder is a “contract of mandate” under Article 528 of the Civil Code. Refer to Article 8 of the Regulations Government the Use of Uniform Invoices: “When a business entity is engaged to handle collection and payment on behalf of another party, if there is no difference between the amount collected and the amount paid, and the purchaser specified on the payment receipt voucher is the engaging party, then the business entity may deliver the voucher to the engaging party and is exempt both from issuing a uniform invoice and from including the payment as a sales amount.”. Article 18-2 of the Profit Seeking Enterprise Income Tax Audit Standard also has similar stipulations. As to whether or not a contract of mandate is formed between the seller and the payment collector/forwarder, depends on the agreement between the parties. If it is agreed that the buyer has completed payment when the payment collector/forwarder receives the fund, then the payment collector/forwarder receives the fund on behalf of the seller and a contract of mandate is formed. Under the contract of mandate, the seller grants the payment collector/forwarder the right of agency and the right of processing. Generally speaking, it is deemed that when the buyer pays the fund to the payment collector/forwarder, the buyer has completed the obligation of payment. Therefore, both the buyer and the seller form a contract of mandate with the payment collector/forwarder and grant the right of agency under such contract of mandate. Diagram 1 Three-party relationship diagram under collection/forwarding of transaction payment Source: Prepared by author The payment collector/forwarder under online transaction acts as the agent of the buyer and the seller at the same time with regard to the act of payment and collection. This constitutes the legal issue of “acting as agent for both parties” under Article 106 of the Civil Code. However, the payment collector/forwarder performs the contract of sale and purchase for the buyer and the seller. Therefore the exception provided under Article 106 of the Civil Code is applicable. 3.Payment Custody Mechanism under Third-Party Payment (1)Overview The important value of a third-party payment mechanism is that it provides a credit guarantee between the buyer and seller. Through a third-party payment organization, the buyer receives the merchandize and then sends an instruction to the third party payer for the price previously provided to the third party payer to be forwarded to the seller. Although the buyer and the seller cannot verify each other’s creditworthiness and the quality of the merchandize face-to-face, through third party payment, the buyer can be assured that the merchandize will be received after the price is paid. The buyer can even be assured that he/she will receive the merchandize that he/she is satisfied with. For example, in “Alipay”, the after shopping, the consumer pays the transaction price to Alipay. Only when the consumer replies with “production received” will Alipay forward the money to the seller. So “third-party payment service” helps activate E-commerce and is especially helpful in C2C transactions. This is one of the important features that differentiate “third-party payment service” from “Internet banking”. Therefore, although the Central Bank of Mainland China introduced the function of “Super Internet Bank” in 2009, consolidating the consultation and account transfer systems of many banks, it is generally considered that this did not have a strong impact on the third-party payment service industry which is already flourishing in Mainland China, because it does not provide value-added services, such as a guarantee and delayed payment provided by third-party payment service. Although third-party payment service provides account transfer service, absorbing part of the functions of Internet banking, it also created new business opportunities for the banks. In reference to the experience of Mainland China, the tasks are divided between third-party payers and banks as follows: Source: Xi-Song Zhang, Choice of Development Model for Third-Party Payment in China – From the Perspective of Full Intervention by Commercial Banks, Review by Xi’An University of Finance and Economics, Volume 22, Book 2, Page 46 (March 2009). So the service provided by third-party payment and the service provided by Internet banking overlap to a certain degree. Both perform the function of fund transmission. However, instead of thinking that the two as competitors, it is better to think of them as a cooperative. (2)Relevant Legal System in Taiwan The feature of the above-described third-party payment is that the third party holds the property for the benefit for others until the satisfaction of certain conditions. A similar legal system in Taiwan is “trust”. In accordance with Article 1 of the Trust Act: “For the purposes of this Law, the term "trust" refers to the legal relationship in which the settler transfers or disposes of a right of property and causes the trustee to administer or dispose of the trust property according to the stated purposes of the trust for the benefit of a beneficiary or for a specified purpose.”. However, in accordance with Article 2 of the Trust Act, a trust must be done through a contract of trust. What is different from the contract of mandate formed under the payment collection/forwarding described above is that, in a contract of trust, the parties must specify the purpose of the trust in the contract. Otherwise, the contract of a trust is not formed. An exception is trust by declaration for the purpose of public interest under Article 71 of the Trust Act. Below we discuss the structure and feasibility of providing third-party payment service through trust. 3-2-1Third-Party Payer Acts as Trustee When a third-party payer acts as the trustee of under the contract of trust and the buyer that pays the price under an Internet transaction designates it as the principal and the beneficiary, a trust for self benefit is formed. It is a trust with a purpose. The purpose of the trust is to transfer the price of sale and purchase. The seller is also the beneficiary. According to the “principle of identified beneficiary” under the laws of Taiwan as long as the beneficiary is identifiable, even though many transactions may be formed with many sellers after the buyer registers to use third-party payment service, a contract of trust can still be formed. However, in accordance with Article 2 of the Trust Act, unless the principal has reservations in the contract of trust, the termination of a trust for the benefit of others is subject to the consent of the beneficiary. So it is simpler to process under a trust for one’s own benefit. Diagram 2 Diagram of trust relationship under third-party payment (where the third-party payer is the trustee) Source: Prepared by author To form a contract of trust, in accordance with Articles 9 to 12 of the Trust Act, the fund entrusted by the service user to the third party to be forwarded becomes trust property and can be effectively segregated from bankruptcy. If the trustee is bankrupt, the trust property will not be included in the bankruptcy property, and the creditors of the trustee cannot enforce upon the trust property, providing more protection for the user of third-party payment service. Also, in accordance with Article 24, the principal shall manage the trust property and the principal’s own property separately. A monetary trust can be managed by keeping separate accounts. So if a contract of trust is formed under a contract of third-party payment service, it can ensure proper accounting of trust property by the service provider. Also, in accordance with Paragraph 2, Article 9, property right acquired by the trustee through the management, disposal, loss, destruction or other event of the trust property remains part of the trust property. Therefore, proceeds received from the deposit by third-party payer with the bank of any fund before it is forwarded become part of trust property and belong to the buyer, i.e., the principal and beneficiary. Certain doubts as to whether the Trust Enterprise Act is applicable to third-party payment service provider. In accordance with Article 2 of the Trust Enterprise Act, “trust enterprise” referred to in this Act means an organization approved by the competent authority in accordance with this Act to operate trust activities. There are 4 targets regulated by the Trust Enterprise Act: Trust companies that operate trust activities with approval by the competent authority, banks they also operate trust activities, securities investment trusts, investment consulting businesses and securities dealers that also operate trust activities and trust investment companies. A third-party payer is not a trust enterprise approved by the Banking Bureau of the Financial Supervisory Commission. Therefore, the contract of trust formed under third-party payment service is a general trust under civil law and is subject to supervision by the court in accordance with Article 60 of the Trust Act. The court may select an inspector and impose other necessary disposition by order pursuant to the petition for inspection on trust activities filed by an interested party or a prosecutor. However, the court has a role of passive supervision and does not have the general authority of supervision and management by the Bureau of Banking. Third-party payment is a service provided to unidentified members of the society. Including third-party payers into the system of financial supervision for trust will provide better protection for interest of the general public. Also, in accordance with Article 34 of the Trust Act, trust enterprises have the obligation of provisioning compensation reserves. No such obligation is imposed under general civil-law trust. So if third-party payers are included as trust enterprises, better protection will be available to the consumers. Also in accordance with Article 19 of the Trust Enterprise Act, a trust contract must be done in writing. In case of an electronic document, requirements under Article 4 of the Electronic Signature Act must be met: “the content of the information can be presented in its integrity and remains accessible for subsequent reference, with the consent of the other party”. Under third-party payment service, the third-party payer must make payment in accordance with the user’s instructions. So the trust that is formed is “a trust where the trustee does not have discretion over utilization of trust property”, as referred to under Paragraph 2, Article 7 of the Enforcement Rules for Trust Enterprise Act. It is also “a monetary trust under specific centralized management and utilization” under Article 8 of the Enforcement Rules for Trust Enterprise Act. However, in accordance with Article 9 of the Trust Enterprise Act: “A trust enterprise's name shall indicate the word, ‘trust.’ This rule does not apply to an entity which conducts a trust business concurrently with the approval of the Competent Authority.” If the third party payer adds the word “trust” in the company name, it will create a difference from the scope of business of third-party payment service. So an approval from the competent authority, the Bureau of Banking of the Financial Supervisory Commission, allowing third party payers to also operate the trust activity, seems to be a better solution. 3-2-2Bank Acts as Trustee As mentioned above, in a payment collection/forwarding relationship, the underlying legal relationship between the third-party payer and buyer is a “mandate”. Under a separate relationship of mandate, the buyer can grant the third-party payer the right of agency to sign a contract of trust with the bank on behalf of the buyer. The bank will act as the trustee and the buyer will act as the principal and beneficiary. The third-party payer will be the agent of the principal. Same as above, the beneficiary can also be the seller here. Under the current structure of the Trust Act of Taiwan, almost all rights that can be exercised by a principal can also be exercised by a beneficiary, including the rights under Articles 23, 24, 32, 35 and 65. Therefore, it is more convenient for a bank, with the qualification of trust enterprise, to serve as the trustee. However, trust related fees may be payable to the bank, raising the cost of third-party payment service. The relevant cost will most likely be transferred to the user of third-party payment service. The third-party payment service fee is generally paid by the seller, i.e., the payee. Under the structure where the third-party payer acts as the trustee, the relationship between the third-party payer and the bank is solely one between a depositor and a depository account. Therefore the third-party service provider does not need to pay any fee to the bank. It may even receive interest from the deposit, constituting proceeds from trust property which belong to the principal. So if the bank acts as the trustee, the cost of transaction flow is higher. On the other hand, it may obstruct the development of the industry. However, it is more consistent with the model of trust management. Diagram 3 Diagram of trust relationship under third-party payment (bank being the trustee) Source: Prepared by author 4.Conclusion There is currently no legal restriction against simple payment collection and forwarding. The contract of mandate under the Civil Code can process the tri-party legal relationship (buyer, seller and payment collector/forwarder). The transaction guarantee for third-party payment and the mechanism of custody and delayed payment of price can be processed with the structure of trust. As mentioned above, under the structure of a trust, the third-party payer can act as the trustee and the bank can act as the principal (at which time the third-party payer represents the principal and signs a contract of trust with the bank on behalf of the buyer). The formation of trust ensures account management, avoiding improper utilization of the transaction price under custody. When the third-party payer is the trustee, a general civil-code trust is formed, which is only subject to inspection by court pursuant to petition by interested party or the judge. The supervision and management are more relaxed. However, third-party payment serves an unidentified public of society and has an extensive impact. It is suggested that the competent authority, the Financial Supervisory Commission, allows third-party payers to also operate the business of trust and include third-party payers into the scope of financial supervision. When the bank acts as the trustee, the transaction cost is higher. However, the supervision and management of its business activities under the current legal system is more complete. Currently, a more feasible way is when the bank serves as the trustee and the third-party payer serves as the agent of the principal. In the long term, it can be studied to open up for third-party payers to also operate Internet transaction trust business, acting as the trustee. Third-party payment replaces bank’s fund settlement function to a certain extent. Contrary to the traditional industry of payment collection and forwarding, third-party payment provides the convenience of fund collection/payment function and can fall prey to money laundering criminal activities. For the purpose of protecting the consumers and prevention of money laundering crimes, it is indeed necessary to include third-party payment into legislative management. The priority focus of such control is to require that the operator possesses a sound corporate structure and financial status. The requirement regarding capital is different depending on the country. The flexible requirement of capital amount in the EU can be used as a reference. For smaller operators with lower transaction volumes, a lower capital amount should be required under flexibility. In 2011, the Internet shopping market in China was 773.5 billion CNY. The amount of Internet payment was approximately 70 billion CNY. In 2011, the Internet shopping market in Taiwan was only 562.7 billion NT Dollars. If the minimum capital amount required of third-party payment operators in China is applied to third-party payment operators in Taiwan, it would not be reasonable. We can refer to the US method and ask operators to take out insurance to lower the risk and avoid market monopoly or oligopoly due to high capital amount barrier, blocking full competition. With the capital amount requirement, it is highly possible that the operators will increase the amount of transaction processed in accordance with the development of E-commerce, creating the necessity to increase the capital. It is best to choose the form of limited stock companies in order to answer to capital placement requirement swiftly. Regarding the issue of money laundering prevention, third-party payment institutions are currently not the “financial institutions” under Article 5 of the Money Laundering Prevention Act of Taiwan. However, it should be a “payment tool” under Article 9, with only an obligation to freeze the payment account and cooperate with investigation as required by prosecutors. At the same time of developing third-party payment services, the Bureau of Investigation of the Ministry of Justice should also develop a money laundering prevention reporting system for third-party payment services. In reference to the US legal system, third-party payers should be included into the network of money laundering crime prevention of Taiwan for management. In addition, third-party payment services should be performed on real-name basis. The general public should be required to register and use third-party payment services with their true identities. As for verification of identity, the so-called KYC process, the banks’ KYC can be relied upon to a certain degree, such as comparison of account name information of the credit card holder or the deposit account. In reference to the legal system of different countries and the current financial legal system of Taiwan, third-party payment operators should have the obligation to maintain payment transaction information in order to facilitate criminal investigation. To protect consumers, the rights and obligations between the consumers and the third-party payers should be specified in a written contract. If it is displayed in electronic form, the written requirement should be consistent with Article 4 of the Electronic Signature Act of Taiwan. In addition, the consumers’ funds should only be used in accordance with the consumers’ payment instructions. To avoid other uses by the operators, there should be a requirement to deposit into special bank accounts to provide clear trace of transaction history. In reference to Article 24 of the Trust Act, separate account management is required under trust. So if a trust is formed, then the requirement for special deposit account can be waived. Furthermore, to avoid insolvency by the operators, operators can be required to take out insurance and acquire full performance guarantee. Prevention is better than a cure. We should take precautions about possible issues that may arise from third-party payment. In addition, clear rules of the game will encourage industry development. On the other hand, with the new type of money flow payment activities in the Internet era, traditional financial industries should see it as a new opportunity of business development, and not a threat. What third-party payment system processes is information flow; the actual flow of funds is still dependent on the banking system. Internet payment operators are still dependent upon the finance industry to provide financial planning and new types of financial products (such as trust and insurance) in order to promote their business. Building a sound Internet payment system indeed requires contributions from the information industry, the finance industry and the legal industry.

To establish a trusted foundation for sports data compliance, the Sports Data Altruism Service releases the Sports Data Altruism Service Personal Data Assessment Legal Compliance Handbook

To establish a trusted foundation for sports data compliance, the Sports Data Altruism Service releases the Sports Data Altruism Service Personal Data Assessment Legal Compliance Handbook 2024/05/15 I. Introduction The Sports Data Altruism Service aims to construct a blueprint for the development of sports and technology, to promote practical applications for sports scientific research results, to drive industry development, and to establish a sports data innovation ecosystem. This will be achieved through multi-ministerial/multi-agency value-added applications for sports data, multidisciplinary upgrading and transformation of sports technology, digital empowerment to establish a sports technology ecosystem, and public-private collaboration efforts. The Sports Data Altruism Service aims to build a legal compliance platform, and to reinforce the trust foundation for legally-compliant sports data operations, all while balancing privacy protection and public interest. In pursuit of these ends, the Sports Data Altruism Service draws upon international data governance practices and trends, as well as current industry practices. It aims to develop guidelines and regulations that consider the value of sports data applications and apply them to data legal compliance operations for sports venues. The Service is also intended to help operators in the sports field maintain personal data protections and reasonable use. Consequently, in August 2023, the Sports Data Altruism Service released the Sports Data Altruism Service Personal Data Assessment Legal Compliance Handbook. For entities seeking to become Sports Data Altruism Service data providers, the Handbook explains the related regulations and provides important things to watch out for. II. Structure of the Sports Data Altruism Service Personal Data Assessment Legal Compliance Handbook The Handbook is divided into three sections: A. Requirements for joining the Sports Data Altruism Service: Before starting with the Sports Data Altruism Service, users must read and agree to the service’s Privacy Policy, Terms of Service, Notification Regarding Personal Data Collection and Personal Data Provision Agreement, and other important platform information. The Privacy Policy explains how the platform collects, uses, and protects the information that users provide. If you wish to become a data provider or data user, the Terms of Service will explain what you need to comply with to do so. And if you decide to become a data provider or data user, you must register on this platform and must sign the "Notification and Letter of Consent for Collection, Processing, and Use of Personal Data" to state your agreement to provide your data to the platform. B. Personal data subject rights protection mechanism for sports venue operators (data providers): After becoming a Sports Data Altruism Service data provider, to lawfully obtain the personal sports data, the data provider must submit the Points of Note When Connecting to the Sports Data Altruism Service and Personal Sports Data Provision Agreement. This form, submitted in either paper or online format, must include a signature from the person whose personal sports data is to be used. When a data subject needs to correct their personal data or no longer wishes to provide their data to the Sports Data Altruism Service, the data provider must provide the Exercise of Data Subject Rights Application Form. After the data subject submits the application, the sports venue operator must verify whether the data has been processed to the extent that it cannot be used to identify a specific individual. In accordance with Article 4 of the Points of Note When Connecting to the "Notice of Connection to the Sports Data Altruism Service Platform and Consent Form for Provision of Personal Sports Data", data that can no longer identify specific data subjects is no longer considered personal data, and is not subject to exercising of data subject rights, nor is it subject to deletion of statistical or analytical results based on such data. If the data has not been anonymized, the operator must remove the data subject from the list uploaded to the platform and delete any unprocessed sports data. They must also retain records of the deletion and notify the data subject. Source: Sports Data Altruism Service Personal Data Assessment Legal Compliance Handbook Figure 1　Data Subject Rights Exercise Mechanism for Sports Venue Operators C. Data protection management process for sports venue operators (data providers): To assist sports venue operators in complying with personal data protection requirements, the Sports Data Altruism Service provides a personal data protection self-assessment tool. After an operator becomes a Sports Data Altruism Service data provider, they must assess their compliance with data protection laws by completing the Self-Assessment Form for Personal Data Protection in Collecting Public Sports Data by Sports Venue Operators (Data Providers). This helps operators understand the importance of personal data protection and establish a robust personal data protection management system, to achieve both data protection and reasonable usage. The Self-Assessment Form for Personal Data Protection in Collecting Public Sports Data by Sports Venue Operators (Data Providers) is designed in accordance with the regulations of the Personal Data Protection Act and its enforcement rules. It includes 20 assessments in 10 major categories. When filling out the self-assessment form, the operator must provide the name of the self-assessment venue, the name of the person filling out the form, and the date. The form has to be completed based on the personal characteristic data and sports data that is to be uploaded to the Sports Data Altruism Service. However, not every assessment is mandatory. The form requires considering the operator’s actual situation to review the current practices related to personal data protection and management, then conducting the self-assessment based on this. For more detailed information about the Sports Data Altruism Service Personal Data Assessment Legal Compliance Handbook, please visit the Sports Data Altruism Service website (https://www.data-sports.tw/#/SportData/Landing?redirect=%2FDashboard).

Most read
[　X Close　]
Copyright © 2016 STLI,III. All Rights Reserved.
TOP