Response to Personal Data Security Incidents: Obligations of Third-Party Payment Service Providers under the Amended Personal Data Protection Act
Response to Personal Data Security Incidents: Obligations of Third-Party Payment Service Providers under the Amended Personal Data Protection Act
2025/11/15
Third-party payment service providers (TPPs) play a central role in payment processing, identity verification, and transaction records; and consequently hold large volumes of important personal data. In recent years, frequent personal data security incidents related to domestic and international electronic payment services have led to increased vigilance from the competent authority regarding the personal data security maintenance of third-party payment services. At the same time, new amendments to the Personal Data Protection Act (PDPA) have strengthened personal data protection obligations. TPPs that fail to implement adequate protective measures may face legal liabilities and reputational risks.
This article analyzes the new amendments to the PDPA. Drawing from the requirements of the Enforcement Rules of the Personal Data Protection Act (the Enforcement Rules) and the Regulations Regarding the Security Maintenance and Administration of Personal Information Files in Digital Economy Industry (數位經濟相關產業個人資料檔案安全維護管理辦法, Security Maintenance Regulations)[1], it outlines and explores the key considerations of TPPs’ major obligations in the event of a personal data security incident: reporting to the competent authority, notifying data subjects, implementing incident response measures, preventing personal data security incidents and cooperating with the competent authority’s inspections.
I. Key PDPA Amendments Regarding Security Incidents
Amendments to the PDPA recently passed the third reading by Taiwan’s Legislative Yuan[2] and were subsequently promulgated by the President on November 11, 2025[3]. These amendments vest regulatory authority in the Personal Data Protection Commission (個人資料保護委員會, PDPC) as the independent competent authority, strengthen personal data supervision and management in the public sector, and introduce several key changes to the data protection obligations of non-government agencies. Although the Executive Yuan has yet to designate an enforcement date for the new amendments[4], TPPs should prepare in advance. The following sections explain five key points from these amendments related to personal data security incidents.
1. Obligation to Report Personal Data Security Incidents and Notify Data Subjects
Following the amendments, Article 12 of the PDPA clarifies the obligations to report and notify personal data security incidents. First, the timing for notifying data subjects has been adjusted from “after investigation and confirmation” to “immediately upon becoming aware of the incident.” Second, the amendments introduce a new statutory obligation to “report to the competent authority if a certain reporting threshold is met.” This reporting requirement previously existed only in the Enforcement Rules[5] and the Security Maintenance Regulations[6].
2. Obligation to Implement Incident Response Measures and Retain Records
In addition to promptly notifying data subjects and reporting to the competent authority, TPPs must take “immediate and effective incident response measures” to contain the incident and prevent further harm. Furthermore, TPPs are required to document the facts, impact, and incident response measures taken, and retain such records for inspection by the competent authority.
3. Obligation to Prevent Personal Data Security Incidents
TPPs should establish comprehensive protective mechanisms to prevent personal data security incidents. Continuing the existing security maintenance obligations, the PDPA amendments relocate the provision of Article 27, Paragraph 1 of the old Act to Article 20-1, Paragraph 1, consolidating it as “matters required for security maintenance.” This revision reaffirms the TPPs' responsibility to maintain the security of personal data by adopting appropriate technical and organizational measures in accordance with relevant regulations.
TPPs are also required to comply with the specific security maintenance matters prescribed in the Security Maintenance Regulations. They must implement internal security management and technical protection measures to effectively prevent the theft, alteration, destruction, loss, or leakage of the personal data they hold.
4. Obligation to Cooperate with Administrative Inspections
To identify the cause of personal data security incidents and ensure the effective implementation of security maintenance measures, TPPs must cooperate with administrative inspections in addition to fulfilling their security maintenance obligations. Where the competent authority believes a TPP may have violated the PDPA, or deems it necessary to verify their compliance with the PDPA, TPPs must cooperate with the following inspection methods: (1) providing statements; (2) providing necessary documents, materials, items, or taking other cooperative measures; and (3) cooperating with on-site inspections, providing necessary explanations, cooperative measures, or relevant proof documents[7]. The competent authority may conduct ex officio on-site checks or document reviews, and TPPs must prepare supporting documentation and improvement plans to ensure incident response compliance and auditability.
5. Penalties and Transitional Period
After the amendments take effect, if a TPP fails to notify data subjects, report to the competent authority, take incident response measures, preserve records; or, without justifiable reason, evades, obstructs, or refuses to cooperate with administrative inspections, the competent authority may, depending on the nature and severity of the violation, order rectification within a prescribed period or impose a fine up to NT$15 million[8].
Furthermore, these amendments establish a jurisdictional transition period. For certain supervisory and administrative matters concerning non-government agencies, that fall within the mandate of the PDPC, jurisdiction shall, for six years from the establishment of the PDPC and upon public notice by the Executive Yuan, remain with the respective central competent authorities[9]. Accordingly, during this transition period, the inspection of security maintenance matters and the enforcement of penalties for TPPs may still be conducted by the Ministry of Digital Development (MODA). TPPs must continue to comply with the Security Maintenance Regulations issued by the MODA.
6. Summary
Integrating the amended PDPA, its Enforcement Rules, and the Security Maintenance Regulations, a TPP who becomes aware of a personal data security incident must notify data subjects, and the notification content must include the facts of the incident and the incident response measures taken. While the amended Article 12 emphasizes “immediacy” of notification upon awareness and requires incident response action to prevent further expansion, the full confirmation of incident response measures requires time in practice, which can create a timing conflict with the immediacy requirement.
Therefore, until the PDPC stipulates the “content, method, timing, scope of reporting, incident response measures, record preservation, and other related matters”[10], and to balance legal compliance with data subject rights, it is recommended that TPPs adopt a “phased notification” approach: immediately notifying the data subject upon awareness to prompt protective measures (such as changing passwords or guarding against scams), and subsequently issuing a supplementary notification after the incident response measures have been implemented, detailing the countermeasures taken and the full scope of the incident.
II. Four Key Steps for Responding to Personal Data Security Incidents
In practice, when a personal data security incident occurs, TPPs must immediately activate their incident response procedures and implement relevant measures in accordance with the “Security and Maintenance Plan for the Protection of Personal Data Files and a Guideline On Disposing Personal Data Following Business Termination (個人資料檔案安全維護計畫及業務終止後個人資料處理方法, Security Maintenance Plan)” stipulated by their Security Maintenance Regulations. The aforementioned statutory obligations concerning notification, reporting, incident response, prevention, and cooperation with inspections may all be activated simultaneously upon the incident's occurrence. Following the enforcement of the PDPA amendments, TPPs bear simultaneous compliance obligations under the amended PDPA, its Enforcement Rules, and the Security Maintenance Regulations. The following four steps are therefore recommended:
Step 1: Taking Immediate and Effective Incident Response Measures. TPPs must take immediate and effective incident response measures upon becoming aware of the incident to prevent further escalation. This is the first priority for responding to a data incident, aimed at damage control, and should be executed concurrently with the investigation of the incident cause and assessment of the scope of impact.
Step 2: Obligation to Notify Data Subjects. Upon becoming aware of the incident, TPPs must promptly notify data subjects of the occurrence of the personal data security incident and the measures taken in response through appropriate means such as oral statement, written notice, telephone, text message, email, fax, electronic document, or any other means sufficient to ensure the data subject is informed or can reasonably become aware[11], and provide “a hotline or other appropriate channel for follow-up inquiries for data subjects to seek information”[12]. Furthermore, since some data subjects whose personal data is collected by TPPs are the end-consumers transacting with merchants, TPPs must ensure that, at the outset of their service processes, they clearly establish the legal basis and contact mechanisms that enable direct notification of data subjects (including consumers) in accordance with the privacy policy, service contract, or relevant notice documents, to ensure effective fulfillment of the notification obligation when an incident occurs.
Step 3: Obligation to Report to the Competent Authority. This obligation is divided into two phases: before and after the amendments take effect. Before the amendments take effect, TPPs must comply with the current Security Maintenance Regulations and report to the Ministry of Digital Development (MODA). After the amendments take effect, TPPs will have the statutory obligation to report to the Personal Data Protection Commission (PDPC). Upon receiving a TPP’s report, the PDPC will in turn notify MODA.
During the transition period, the reporting requirements stipulated in Article 8 of the existing Security Maintenance Regulations may continue to apply. Specifically, the reporting timeline is limited to ”completion within 72 hours of becoming aware of the incident,” and the incident must be judged based on the criterion of “endangers its normal operations or the rights and interests of a large number of data subjects.” These requirements remain the key substantive compliance standards at present. TPPs are advised to establish their internal reporting procedures in accordance with the regulations in force at the time of reporting and to closely monitor the effective date of the amendments and any further announcements issued by the PDPC.
Step 4: Cooperating with Administrative Inspections and Retaining Records. TPPs must properly retain all relevant records from the incident response process for inspection by the competent authority. When cooperating with an administrative inspection, TPPs should not only prepare the root cause analysis report (documenting the relevant the facts, the impact, and the incident response measures taken) and supporting evidence for data subject notifications in a timely manner, but also be prepared to provide any additional documentation as required.
If the competent authority requests a review of the implementation of the Security Maintenance Plan, TPPs are advised to provide the Plan along with documentation demonstrating the implementation of the required security maintenance measures. Doing so enables TPPs to substantiate their compliance efforts and incident response capabilities.
III. Recommendations and Conclusion
In summary, this article recommends that TPPs promptly review and refine their Security Maintenance Plan to ensure that their systems, procedures, and operational practices comply with applicable legal requirements. Concurrently, TPPs should establish clear incident reporting and incident response procedures, incorporating into their internal processes the immediate notification of data subjects, reporting to the competent authority, taking incident response measures, and preparing documentation for inspection. Given the enforcement trends following the amended provisions, only by implementing robust preventive measures and effective post-incident response capabilities can TPPs maintain regulatory compliance and preserve market trust amid the increasing frequency of personal data security incidents.
[1]數位經濟相關產業個人資料檔案安全維護管理辦法，https://law.moda.gov.tw/LawContent.aspx?id=GL000090 （最後瀏覽日期︰2025/11/12）。
[2]〈立法院三讀通過「個人資料保護法」部分條文修正草案〉，個人資料保護委員會，https://www.pdpc.gov.tw/News_Content/20/1001/ （最後瀏覽日期︰2025/11/12）。
[3]總統令 華總一經字第11400114521號，中華民國總統府，https://www.president.gov.tw/Page/78 （最後瀏覽日期︰2025/11/12）。
[4]＜個人資料保護法部分條文修正案，業於今(114年11月11日)日經總統公布，本次修正條文施行日期將另由行政院定之＞，個人資料保護委員會，https://www.pdpc.gov.tw/News_Content/20/1010/ （最後瀏覽日期︰2025/11/12）。
[5]個人資料保護法施行細則第12條第2項第4款規定。
[6]數位經濟相關產業個人資料檔案安全維護管理辦法第8條第2項規定。
[7]個人資料保護法第22條第1項規定。
[8]個人資料保護法第47條至第50條規定。
[9]個人資料保護法第51-1條規定。
[10]個人資料保護法第12條第4項規定。
[11]個人資料保護法施行細則第22條規定。
[12]數位經濟相關產業個人資料檔案安全維護管理辦法第8條第1項第2款規定。
Artificial Intelligence Governance - Taking Deep Fake as an Example 1.Introduction With the increasing maturity of the use of neural networks, the application of artificial intelligence technologies is becoming more and more widely used. Among them, through the automated editor and convolutional neural network technology, the threshold of the technology of copying films is not very high. In November 2017, some films that superimpose the faces of social celebrities on pornographic film actors/actresses appeared in the American social networking platform, Reddit. These types of films analyze the faces of specific socialites through deep learning algorithms and superimpose their faces on the films, making them look as if the films were taken by the socialites themselves. This technology was released by developers in 2018 and was made into an app for public use. At present, such technology is generally referred to as "deep fake" internationally, and it is believed that it may contribute to the speedy invention and distribution of false information existing throughout the Internet nowadays, which has attracted the attention of legislators worldwide. As it uses fake images or films automatically generated by Deep-learning technology, it involves both dimensions of fake information prevention and artificial intelligence governance. The purpose of this paper is to observe the relevant policies, legal measures and related guidelines or principles of the international community in response to issues of deep fake and artificial intelligence governance, and to examine whether the current legal system in Taiwan can cope with the impact of deep fake so as to provide feasible recommendations. 2.Ethics Rules for Artificial Intelligence In the governance of artificial intelligence, the European Union introduced the “Ethics Guidelines for Trustworthy AI” on April 8, 2019 to establish a framework for supervising artificial intelligence in order to make artificial intelligence trustable. The guidelines first points out that Trustworthy AI requires three key characteristics: (1) it should be lawful: complying with all applicable laws and regulations; (2) it should be ethical: ensuring adherence to ethical principles and values; and (3) it should be robust: both from a technical and social perspective, to avoid AI from inadvertently causing harm. Fundamental Rights are the basis of trustworthy AI. In order to comply with the above-mentioned basic human rights and to make AI reliable, their expert group believes that AI should abide by four ethical principles, including: (1) respect for human autonomy; (2) prevention of harm; (3) fairness; and (4) explicability. The four ethical principles are also transformed into the seven specific measures: “human agency and oversight”, “technical robustness and safety”, “privacy and data governance”, “transparency”, “diversity, non-discrimination and fairness”, “societal and environmental wellbeing impact evaluation” and “AI accountability”. To facilitate the true implementation of self-assessment for application developers, the Guidelines devise the Trustworthy AI Assessment List in Chapter 4 for the reference of the enterprise. 3.Counter measures Against the International false messages In response to the prevention of false messages, the two parties in the United States also jointly proposed in 2018 the Malicious Deep Fake Prohibition Act of 2018 to amend the relevant provisions of fraud in the criminal law. This bill amends Chapter 47 of the United States Code by adding Section 1041 with regard to fraud in connection with audiovisual records. It treats the use of deep fake as a criminal offence and defines deep fake as “audiovisual record created or altered in a manner that the record would falsely appear to a reasonable observer to be an authentic record of the actual speech or conduct of an individual”. It shall be unlawful to, using any means or facility of interstate or foreign commerce, to create, with the intent to distribute, a deep fake with the intent that the distribution of the deep fake would facilitate criminal or tortious conduct; or distribute an audiovisual record with actual knowledge that the audiovisual record is a deep fake, and the intent that the distribution of the audiovisual record would facilitate criminal or tortious conduct. Any person who violates the above may be sentenced to imprisonment for more than 2 years but less than 10 years. However, the bill is currently put on hold without being further reviewed. In addition, in order to properly cope with the danger of deep fake, on June 28, 2019, the two parties in the US Congress jointly proposed the bill - "To require the Secretary of Homeland Security to publish an annual report on the use of deep fake technology, and for other purposes”, which may be cited as the "Deepfakes Report Act of 2019". This bill requires the Department of Homeland Security to conduct research on deep fake and related issues, produce an annual report, and to request it to assess the direction of addition or revision of relevant laws and regulations. Moreover, the US senators from both parties also proposed on June 12, 2019 the bill- “Defending Each and Every Person from False Appearances by Keeping Exploitation Subject to Accountability Act of 2019”, which may be cited as “DEEP FAKES Accountability Act”. This Act is the same as the Act of 2018, both of which treat the use of deep fake as a fraudulent act by adding section 1041 to Chapter 47 of the United States Code. However, this Act does not directly define deep fake, but rather define such a type of technology as “advanced technological false personation record”, and require such records to comply with: (1) DIGITAL WATERMARK: Any advanced technological false personation record which contains a moving visual element shall contain an embedded digital watermark clearly identifying such record as containing altered audio or visual elements. (2) AUDIOVISUAL DISCLOSURE shall comply with the following principles: A. clearly articulated verbal statement that identifies the record as containing altered audio and visual elements, and a concise description of the extent of such alteration; and B. an unobscured written statement in clearly readable text appearing at the bottom of the image throughout the duration of the visual element that identifies the record as containing altered audio and visual elements, and a concise description of the extent of such alteration. (3) VISUAL DISCLOSURE shall comply with the following principles: Any advanced technological false personation records exclusively containing a visual element shall include an unobscured written statement in clearly readable text appearing at the bottom of the image throughout the duration of the visual element that identifies the record as containing altered visual elements, and a concise description of the extent of such alteration. (4) AUDIO DISCLOSURE shall comply with the following principles: Any advanced technological false personation records exclusively containing an audio element shall include, at the beginning of such record, a clearly articulated verbal statement that identifies the record as containing altered audio elements and a concise description of the extent of such alteration, and in the event such record exceeds two minutes in length, not less than 1 additional clearly articulated verbal statement and additional concise description at some interval during each two-minute period thereafter. According to the bill, those who violate the above requirements shall be subject to legal responsibilities. In criminal liabilities, whoever knowingly violates the above requirements and (1) with the intent to humiliate or otherwise harass the person falsely exhibited, provided the advanced technological false personation record contains sexual content of a visual nature and appears to feature such person engaging in such sexual acts or in a state of nudity; (2) with the intent to cause violence or physical harm, incite armed or diplomatic conflict, or interfere in an official proceeding, including an election, provided the advanced technological false personation record did in fact pose a credible threat of instigating or advancing such; (3) in the course of criminal conduct related to fraud, including securities fraud and wire fraud, false personation, or identity theft; or (4) by a foreign power, or an agent thereof, with the intent of influencing a domestic public policy debate, interfering in a Federal, State, local, or territorial election, or engaging in other acts which such power may not lawfully undertake, may be sentenced to imprisonment for not more than 5 years. In civil liabilities, any person who violates the above requirements may be subject to a civil penalty of up to US$150,000 per record or alteration, as well as the compensation for the damage, if any. In addition to the United States, the United Kingdom also launched the "Online Harms White Paper" in April 2019, which will establish a new "Online Safety" control structure to respond to false messages and underage pornographic videos, deep fake and online drug trafficking and so on. The report points out that the new network security control framework will clarify the legal obligations of the Internet company to make the company assume more security responsibilities and avoid the harm caused by the content or actions generated by the service provided, and establish an independent regulatory agency supervising and implementing the relevant legal policies. The regulatory authority should provide relevant guidelines for compliance with the new obligations. If the company is unwilling to comply with the relevant guidelines, it must bear the burden of proof and prove that its alternative measures can achieve more effectively for the purpose of protecting the Internet users. In addition, the framework will also include elements of “Transparency, Trust, and Accountability”. The competent authority will be given the right to request an annual transparency report be submitted by the company, which the report should indicate the relevant harmful contents appeared on its platform, explain how it is handling with the problem, and publish the report on the website. Furthermore, the competent authority will have the right to request additional information from the Internet company, such as how its algorithm works. In response to false messages, the report points out that current Internet companies have begun to conduct research on the prevention and control methods of fake news dissemination, including: (1) through the terms of service, users are not allowed to distort their identity on social software to spread false messages. (2) developing relevant tools to detect suspicious, false or junk accounts; (3) using automated artificial intelligence to delete or remove fake accounts; and (4) collaborating with independent fact verifying platforms. However, in the future, the government hopes that the guidelines and related policies proposed by the competent authorities must further include the following matters: (1) The company shall clarify its definition of false information in its terms of service, and state its expectations of users, and the possible penalties to users who violate the company policy; (2) The company should adopt the relevant countermeasures to deal with users with distorted identities who disseminate false messages; (3) The visibility of the disputed content currently under the fact-verifying inspection shall be reduced; (4) The fact-verifying service shall be used, especially during the election period, for fulfilling the obligation of fact verification; (5) Promote authoritative news sources; (6) Promote news circulation from different perspectives, rather than only reinforce the messages of people's existing views; (7) Users should be able to recognize that they are interacting with automated accounts and should ensure that the dissemination of automated accounts information is not abused; (8) Promote the transparency of political advertising to comply with the norms of the UK electoral law; (9) Companies should ensure that users may mark the content that they believe to be false news by themselves and let them know that the company is targeting false news for countermeasures to be taken; (10) The procedures for publishing information should be open and transparent so that the public can assess the effectiveness of the company’s response to false information, and further support the relevant research on online false message activities; (11) The relevant procedures and measures should be taken to continuously monitor and evaluate the effectiveness of the processing flow of fake messages. From the above-mentioned relevant international legal policy observations, it can be found that international measures related to deep fake can be classified into the following items: (1) Establish an independent fact-verifying unit. (2) Improve the transparency of information sources. (3) Improve the oversight responsibility of the online platform for the messages appeared on such a platform. (4) Deep fake is to be treated as an independent criminal act and its criminal, civil and administrative responsibilities are to be clearly regulated. (5) On the technical level, relevant artificial intelligence tools are being developed to respond to this issue. For example, the American startup company, Deeptrace, has begun to conduct research and develop deep fake identification technology to identify the authenticity of the films.
Legal issues of Third-Party Payment in TaiwanAlthough third-party payment is already one of the most popular ways to do the payment online in many countries, for example, Alipay of China and Paypal of USA, third-party payment in Taiwan is just about to start. For these days, the legislation of third-party payment has become a highly debated issue. However, due to many reasons, the legislation of third-party payment eventually has not been realized. And in fact, the third-party payment in Taiwan is not mature yet. A third-party payment system in Taiwan is unable to deposit stored value in advance. This is one of the basic functions of third-party payment system abroad, such as Alipay in China and Paypal in USA. Mainly, what third-party payment provides in Taiwan is money transmission based on real trade. 1. Latest progress of third-party payment in Taiwan. (1)Credit card payment for third-party payment system. Recently, third-party payment has a breakthrough development. According to the resolution of the meeting “Obstacles of using credit card in third party payment” held by Executive Yuan in September this year, Financial Supervisory Commission has made the commitment that the third party payment is allowed to be a “contracted merchant” under “Regulations Governing Institutions Engaging in Credit Card Business”, and personal entity or small business which is not provided with the qualification of “contracted merchant” are allowed to accept credit card payment though third party payment system. This is a very important progress in third-party payment in Taiwan. It means credit card payment is available for C2C transaction now. This will improve the safety of C2C transaction and reduce the quantity of fraud transaction. In other way, boost the prosperity of E-commerce. (2)Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction. In response to the Central Bank’s request, MOEA (Ministry of Economic Affairs) approved and announced the “Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction” on October 3rd, 2012. Any Data Processing Services Industry Performing Trans-border Internet Transaction would like to obtain the qualification as a mandatory under Article 8 of “Regulations Governing the Declaration of Foreign Exchange Receipts and Disbursements or Transactions”, should pass the evaluation according to the “Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction”, and get the compliance certification. The “Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction” has set up several requirements for a business which would like to run the payment service for trans-border internet transaction. Mainly, basic requirements are as the followings. 1-2-1 The applying data processing service enterprise should be a limited company or a company limited by shares. 1-2-2 The applying data processing service enterprise should open a special purpose deposit account to deposit the entire transmitting amount received from consumers. And the transaction of this account should be only based on the consumers’ directions of money transmitting. 1-2-3 Users of the third-party payment service provided by the data processing service enterprise should register for the first time usage. And the user’s name, birth and ID number are required for registration. The applying data processing service enterprise has the liability to check the reality of the information provided. 1-2-4 The contract between the data processing service enterprise and the user should be in writing. If the contract is performed in electronic way, it should follow the requirement of “in writing” according to Article 4 of “Electronic Signatures Act”. In addition, the contract should contain the mandatory articles about foreign exchange declaration listed in the “Evaluation Requirements for Data Processing Services Industry Performing Trans-border Internet Transaction”. 1-2-5 The data processing service enterprise should be equipped with sound information security system and operating regulations, comply with “Personal Information Protection Act” and the related directives, join ECTSA (E-commerce Trust Security Alliance), and get the ISO27001 certificate or PCI-DSS validation. 1-2-6 The data processing service enterprise should keep detailed transaction information for at least 5 years. 1-2-7 The data processing service enterprise should set up money laundering prevention operating regulations, and provide money laundering prevention employee training annually. Once MOEA receives the application, MOEA will set up a special team, which assembles legal professionals, information engineering experts and financial experts, to conduct the evaluation. The compliance certification of the evaluation will be valid for 5 years. During these 5 years, the data processing enterprise has the duty to accept the annual examination and non-timed examination by MOEA. 2.Three-Party Legal Relationship under Third-Party Payment The nature of a third-party payment service is “service of payment collection and forwarding”. Generally, payment collection and forwarding refers to the transfer of a transaction payment performed by a third party in its role of assisting the buyer and the seller. The current practice in Taiwan of making payment to and collecting product from a convenient store pursuant to online transaction or of paying for product upon delivery by shipping company is a type of “payment collection and forwarding” business. In a relationship of payment collection and forwarding service, the legal relationship between the buyer and the payment collector/forwarder is a “contract of mandate” under Article 528 of the Civil Code. Refer to Article 8 of the Regulations Government the Use of Uniform Invoices: “When a business entity is engaged to handle collection and payment on behalf of another party, if there is no difference between the amount collected and the amount paid, and the purchaser specified on the payment receipt voucher is the engaging party, then the business entity may deliver the voucher to the engaging party and is exempt both from issuing a uniform invoice and from including the payment as a sales amount.”. Article 18-2 of the Profit Seeking Enterprise Income Tax Audit Standard also has similar stipulations. As to whether or not a contract of mandate is formed between the seller and the payment collector/forwarder, depends on the agreement between the parties. If it is agreed that the buyer has completed payment when the payment collector/forwarder receives the fund, then the payment collector/forwarder receives the fund on behalf of the seller and a contract of mandate is formed. Under the contract of mandate, the seller grants the payment collector/forwarder the right of agency and the right of processing. Generally speaking, it is deemed that when the buyer pays the fund to the payment collector/forwarder, the buyer has completed the obligation of payment. Therefore, both the buyer and the seller form a contract of mandate with the payment collector/forwarder and grant the right of agency under such contract of mandate. Diagram 1 Three-party relationship diagram under collection/forwarding of transaction payment Source: Prepared by author The payment collector/forwarder under online transaction acts as the agent of the buyer and the seller at the same time with regard to the act of payment and collection. This constitutes the legal issue of “acting as agent for both parties” under Article 106 of the Civil Code. However, the payment collector/forwarder performs the contract of sale and purchase for the buyer and the seller. Therefore the exception provided under Article 106 of the Civil Code is applicable. 3.Payment Custody Mechanism under Third-Party Payment (1)Overview The important value of a third-party payment mechanism is that it provides a credit guarantee between the buyer and seller. Through a third-party payment organization, the buyer receives the merchandize and then sends an instruction to the third party payer for the price previously provided to the third party payer to be forwarded to the seller. Although the buyer and the seller cannot verify each other’s creditworthiness and the quality of the merchandize face-to-face, through third party payment, the buyer can be assured that the merchandize will be received after the price is paid. The buyer can even be assured that he/she will receive the merchandize that he/she is satisfied with. For example, in “Alipay”, the after shopping, the consumer pays the transaction price to Alipay. Only when the consumer replies with “production received” will Alipay forward the money to the seller. So “third-party payment service” helps activate E-commerce and is especially helpful in C2C transactions. This is one of the important features that differentiate “third-party payment service” from “Internet banking”. Therefore, although the Central Bank of Mainland China introduced the function of “Super Internet Bank” in 2009, consolidating the consultation and account transfer systems of many banks, it is generally considered that this did not have a strong impact on the third-party payment service industry which is already flourishing in Mainland China, because it does not provide value-added services, such as a guarantee and delayed payment provided by third-party payment service. Although third-party payment service provides account transfer service, absorbing part of the functions of Internet banking, it also created new business opportunities for the banks. In reference to the experience of Mainland China, the tasks are divided between third-party payers and banks as follows: Source: Xi-Song Zhang, Choice of Development Model for Third-Party Payment in China – From the Perspective of Full Intervention by Commercial Banks, Review by Xi’An University of Finance and Economics, Volume 22, Book 2, Page 46 (March 2009). So the service provided by third-party payment and the service provided by Internet banking overlap to a certain degree. Both perform the function of fund transmission. However, instead of thinking that the two as competitors, it is better to think of them as a cooperative. (2)Relevant Legal System in Taiwan The feature of the above-described third-party payment is that the third party holds the property for the benefit for others until the satisfaction of certain conditions. A similar legal system in Taiwan is “trust”. In accordance with Article 1 of the Trust Act: “For the purposes of this Law, the term "trust" refers to the legal relationship in which the settler transfers or disposes of a right of property and causes the trustee to administer or dispose of the trust property according to the stated purposes of the trust for the benefit of a beneficiary or for a specified purpose.”. However, in accordance with Article 2 of the Trust Act, a trust must be done through a contract of trust. What is different from the contract of mandate formed under the payment collection/forwarding described above is that, in a contract of trust, the parties must specify the purpose of the trust in the contract. Otherwise, the contract of a trust is not formed. An exception is trust by declaration for the purpose of public interest under Article 71 of the Trust Act. Below we discuss the structure and feasibility of providing third-party payment service through trust. 3-2-1Third-Party Payer Acts as Trustee When a third-party payer acts as the trustee of under the contract of trust and the buyer that pays the price under an Internet transaction designates it as the principal and the beneficiary, a trust for self benefit is formed. It is a trust with a purpose. The purpose of the trust is to transfer the price of sale and purchase. The seller is also the beneficiary. According to the “principle of identified beneficiary” under the laws of Taiwan as long as the beneficiary is identifiable, even though many transactions may be formed with many sellers after the buyer registers to use third-party payment service, a contract of trust can still be formed. However, in accordance with Article 2 of the Trust Act, unless the principal has reservations in the contract of trust, the termination of a trust for the benefit of others is subject to the consent of the beneficiary. So it is simpler to process under a trust for one’s own benefit. Diagram 2 Diagram of trust relationship under third-party payment (where the third-party payer is the trustee) Source: Prepared by author To form a contract of trust, in accordance with Articles 9 to 12 of the Trust Act, the fund entrusted by the service user to the third party to be forwarded becomes trust property and can be effectively segregated from bankruptcy. If the trustee is bankrupt, the trust property will not be included in the bankruptcy property, and the creditors of the trustee cannot enforce upon the trust property, providing more protection for the user of third-party payment service. Also, in accordance with Article 24, the principal shall manage the trust property and the principal’s own property separately. A monetary trust can be managed by keeping separate accounts. So if a contract of trust is formed under a contract of third-party payment service, it can ensure proper accounting of trust property by the service provider. Also, in accordance with Paragraph 2, Article 9, property right acquired by the trustee through the management, disposal, loss, destruction or other event of the trust property remains part of the trust property. Therefore, proceeds received from the deposit by third-party payer with the bank of any fund before it is forwarded become part of trust property and belong to the buyer, i.e., the principal and beneficiary. Certain doubts as to whether the Trust Enterprise Act is applicable to third-party payment service provider. In accordance with Article 2 of the Trust Enterprise Act, “trust enterprise” referred to in this Act means an organization approved by the competent authority in accordance with this Act to operate trust activities. There are 4 targets regulated by the Trust Enterprise Act: Trust companies that operate trust activities with approval by the competent authority, banks they also operate trust activities, securities investment trusts, investment consulting businesses and securities dealers that also operate trust activities and trust investment companies. A third-party payer is not a trust enterprise approved by the Banking Bureau of the Financial Supervisory Commission. Therefore, the contract of trust formed under third-party payment service is a general trust under civil law and is subject to supervision by the court in accordance with Article 60 of the Trust Act. The court may select an inspector and impose other necessary disposition by order pursuant to the petition for inspection on trust activities filed by an interested party or a prosecutor. However, the court has a role of passive supervision and does not have the general authority of supervision and management by the Bureau of Banking. Third-party payment is a service provided to unidentified members of the society. Including third-party payers into the system of financial supervision for trust will provide better protection for interest of the general public. Also, in accordance with Article 34 of the Trust Act, trust enterprises have the obligation of provisioning compensation reserves. No such obligation is imposed under general civil-law trust. So if third-party payers are included as trust enterprises, better protection will be available to the consumers. Also in accordance with Article 19 of the Trust Enterprise Act, a trust contract must be done in writing. In case of an electronic document, requirements under Article 4 of the Electronic Signature Act must be met: “the content of the information can be presented in its integrity and remains accessible for subsequent reference, with the consent of the other party”. Under third-party payment service, the third-party payer must make payment in accordance with the user’s instructions. So the trust that is formed is “a trust where the trustee does not have discretion over utilization of trust property”, as referred to under Paragraph 2, Article 7 of the Enforcement Rules for Trust Enterprise Act. It is also “a monetary trust under specific centralized management and utilization” under Article 8 of the Enforcement Rules for Trust Enterprise Act. However, in accordance with Article 9 of the Trust Enterprise Act: “A trust enterprise's name shall indicate the word, ‘trust.’ This rule does not apply to an entity which conducts a trust business concurrently with the approval of the Competent Authority.” If the third party payer adds the word “trust” in the company name, it will create a difference from the scope of business of third-party payment service. So an approval from the competent authority, the Bureau of Banking of the Financial Supervisory Commission, allowing third party payers to also operate the trust activity, seems to be a better solution. 3-2-2Bank Acts as Trustee As mentioned above, in a payment collection/forwarding relationship, the underlying legal relationship between the third-party payer and buyer is a “mandate”. Under a separate relationship of mandate, the buyer can grant the third-party payer the right of agency to sign a contract of trust with the bank on behalf of the buyer. The bank will act as the trustee and the buyer will act as the principal and beneficiary. The third-party payer will be the agent of the principal. Same as above, the beneficiary can also be the seller here. Under the current structure of the Trust Act of Taiwan, almost all rights that can be exercised by a principal can also be exercised by a beneficiary, including the rights under Articles 23, 24, 32, 35 and 65. Therefore, it is more convenient for a bank, with the qualification of trust enterprise, to serve as the trustee. However, trust related fees may be payable to the bank, raising the cost of third-party payment service. The relevant cost will most likely be transferred to the user of third-party payment service. The third-party payment service fee is generally paid by the seller, i.e., the payee. Under the structure where the third-party payer acts as the trustee, the relationship between the third-party payer and the bank is solely one between a depositor and a depository account. Therefore the third-party service provider does not need to pay any fee to the bank. It may even receive interest from the deposit, constituting proceeds from trust property which belong to the principal. So if the bank acts as the trustee, the cost of transaction flow is higher. On the other hand, it may obstruct the development of the industry. However, it is more consistent with the model of trust management. Diagram 3 Diagram of trust relationship under third-party payment (bank being the trustee) Source: Prepared by author 4.Conclusion There is currently no legal restriction against simple payment collection and forwarding. The contract of mandate under the Civil Code can process the tri-party legal relationship (buyer, seller and payment collector/forwarder). The transaction guarantee for third-party payment and the mechanism of custody and delayed payment of price can be processed with the structure of trust. As mentioned above, under the structure of a trust, the third-party payer can act as the trustee and the bank can act as the principal (at which time the third-party payer represents the principal and signs a contract of trust with the bank on behalf of the buyer). The formation of trust ensures account management, avoiding improper utilization of the transaction price under custody. When the third-party payer is the trustee, a general civil-code trust is formed, which is only subject to inspection by court pursuant to petition by interested party or the judge. The supervision and management are more relaxed. However, third-party payment serves an unidentified public of society and has an extensive impact. It is suggested that the competent authority, the Financial Supervisory Commission, allows third-party payers to also operate the business of trust and include third-party payers into the scope of financial supervision. When the bank acts as the trustee, the transaction cost is higher. However, the supervision and management of its business activities under the current legal system is more complete. Currently, a more feasible way is when the bank serves as the trustee and the third-party payer serves as the agent of the principal. In the long term, it can be studied to open up for third-party payers to also operate Internet transaction trust business, acting as the trustee. Third-party payment replaces bank’s fund settlement function to a certain extent. Contrary to the traditional industry of payment collection and forwarding, third-party payment provides the convenience of fund collection/payment function and can fall prey to money laundering criminal activities. For the purpose of protecting the consumers and prevention of money laundering crimes, it is indeed necessary to include third-party payment into legislative management. The priority focus of such control is to require that the operator possesses a sound corporate structure and financial status. The requirement regarding capital is different depending on the country. The flexible requirement of capital amount in the EU can be used as a reference. For smaller operators with lower transaction volumes, a lower capital amount should be required under flexibility. In 2011, the Internet shopping market in China was 773.5 billion CNY. The amount of Internet payment was approximately 70 billion CNY. In 2011, the Internet shopping market in Taiwan was only 562.7 billion NT Dollars. If the minimum capital amount required of third-party payment operators in China is applied to third-party payment operators in Taiwan, it would not be reasonable. We can refer to the US method and ask operators to take out insurance to lower the risk and avoid market monopoly or oligopoly due to high capital amount barrier, blocking full competition. With the capital amount requirement, it is highly possible that the operators will increase the amount of transaction processed in accordance with the development of E-commerce, creating the necessity to increase the capital. It is best to choose the form of limited stock companies in order to answer to capital placement requirement swiftly. Regarding the issue of money laundering prevention, third-party payment institutions are currently not the “financial institutions” under Article 5 of the Money Laundering Prevention Act of Taiwan. However, it should be a “payment tool” under Article 9, with only an obligation to freeze the payment account and cooperate with investigation as required by prosecutors. At the same time of developing third-party payment services, the Bureau of Investigation of the Ministry of Justice should also develop a money laundering prevention reporting system for third-party payment services. In reference to the US legal system, third-party payers should be included into the network of money laundering crime prevention of Taiwan for management. In addition, third-party payment services should be performed on real-name basis. The general public should be required to register and use third-party payment services with their true identities. As for verification of identity, the so-called KYC process, the banks’ KYC can be relied upon to a certain degree, such as comparison of account name information of the credit card holder or the deposit account. In reference to the legal system of different countries and the current financial legal system of Taiwan, third-party payment operators should have the obligation to maintain payment transaction information in order to facilitate criminal investigation. To protect consumers, the rights and obligations between the consumers and the third-party payers should be specified in a written contract. If it is displayed in electronic form, the written requirement should be consistent with Article 4 of the Electronic Signature Act of Taiwan. In addition, the consumers’ funds should only be used in accordance with the consumers’ payment instructions. To avoid other uses by the operators, there should be a requirement to deposit into special bank accounts to provide clear trace of transaction history. In reference to Article 24 of the Trust Act, separate account management is required under trust. So if a trust is formed, then the requirement for special deposit account can be waived. Furthermore, to avoid insolvency by the operators, operators can be required to take out insurance and acquire full performance guarantee. Prevention is better than a cure. We should take precautions about possible issues that may arise from third-party payment. In addition, clear rules of the game will encourage industry development. On the other hand, with the new type of money flow payment activities in the Internet era, traditional financial industries should see it as a new opportunity of business development, and not a threat. What third-party payment system processes is information flow; the actual flow of funds is still dependent on the banking system. Internet payment operators are still dependent upon the finance industry to provide financial planning and new types of financial products (such as trust and insurance) in order to promote their business. Building a sound Internet payment system indeed requires contributions from the information industry, the finance industry and the legal industry.
The amendment of the Taiwanese Personal Data Protection ActThe amendment of the Taiwanese Personal Data Protection Act 2025/05/28 On March 27, 2025, the Executive Yuan released and submitted a draft partial amendment of the Personal Data Protection Act to the Legislative Yuan. The amendment aims to comprehensively enhance personal data protection by constructing the foundation for an independent supervisory agency[1]. Taiwan’s Personal Data Protection Act- legislative progress Taiwan’s Personal Data Protection Act (PDPA) has been amended three times since its release in 1995. In May 2023, the latest amendment to the PDPA introduced Article 1-1, designating the Personal Information Protection Committee as the competent authority under the Act. This legislative development was made in light of the Taiwan Constitutional Court Judgment 111-Hsien-Pan-13 (2022) (Case on the National Health Insurance Research Database)[2], which held that, to ensure the protection of personal information and the constitutional right to privacy under Article 22, the establishment of an independent data protection mechanism is required. In accordance with Taiwan Constitutional Court Judgment 111-Hsien-Pan-13 (2022), the Personal Data Protection Commission (PDPC) must be established by August 2025. To facilitate this, the Preparatory Office of the Personal Data Protection Commission was established in December 2023. This office is mainly responsible for drafting and establishing the regulations and organizational framework required to establish the independent authority, including drafting the Organization Act of the PDPC and the amendments to the PDPA. To develop the regulatory framework for an independent authority, the Preparatory Office of the Personal Data Protection Commission has planned a two-stage amendment process. The first phase seeks to establish the legal foundation of the PDPC, while the second phase will address other substantive issues of personal data protection. For the first stage, the Preparatory Office of the Personal Data Protection Commission drafted the Organization Act of the Personal Information Protection Committee in accordance with Article 1-1 of the PDPA and revised partial provisions of PDPA to reflect the function and duties of the PDPC. The Draft of Partial Amendment to the Personal Data Protection Act The key points of the amendment of PDPA are to empower the commission with essential regulatory functions, to strengthen the regulatory oversight and management of personal data within public sectors, and to set up a transition period to transfer regulatory authority over the private sectors[3]. 1. Empower the commission with essential regulatory functions Due to the lack of a unified agency for receiving incident reports and the efficiency issues caused by the current decentralized legal enforcement, the amendment of PDPA designates the PDPC as the competent authority to receive the incident reports. Centralizing incident reporting under the PDPC facilitates a clearer understanding of the nature and status of related incidents. It also helps regulatory authorities to investigate and handle problems quickly. The rules for reporting data breach incidents are set out in Article 12 of the amended PDPA. According to Article 12 of the amended PDPA, both public sector and private sector entities are required to take appropriate actions and retain the records when a data breach occurs. In addition, public sector entities must report the incident to the PDPC and other relevant government agencies, while private sector entities are required to notify the incident to the PDPC, which will then inform its competent authority[4]. In terms of personal data security maintenance, the amended PDPA states that the competent authority is responsible for formulating regulations concerning security maintenance, governance mechanisms, protective measures, and other relevant matters[5]. Accordingly, PDPC, as the competent authority, will draft the Regulations Governing Security Maintenance and Administration to provide the legal basis for the conducting audits, inspections, and administrative sanctions[6]. 2. Strengthen the regulatory oversight and management of personal data within the public sector The amendment of PDPA designates the PDPC as the independent authority responsible for overseeing the overall personal data protection affairs, including supervision of public sectors. The PDPC is empowered to supervise the public sector entities regarding their compliance with personal data protection regulations. Therefore, the role of the Data Protection Officer (DPO) is introduced in Taiwan for the first time. Article 18 of the amended PDPA states that every public sector entity must appoint a DPO to promote and oversee matters related to personal data protection. This approach reinforces personal data protection from both internal and external perspectives[7]. In considering restructuring and resource allocation associated with introducing this new role, the DPO requirement in PDPA currently applies to the public sector entities. However, both the public and private sectors are required to designate specialists to be responsible for managing personal data protection and security affairs[8]. 3. Set up a transition period to transfer regulatory authority over the private sectors Under the current regulation framework, the supervision of personal data protection in the private sector is decentralized and supervised by different competent authorities. To address this gap, the amendment of PDPA clarifies that the PDPC will serve as the supervisory authority for these entities in the future. In terms of the private sector entities already under the supervision of specific competent authorities, supervisory arrangements will initially remain unchanged. However, to achieve regulatory consistency, the amendment introduced a six-year transitional period during which supervisory responsibility will be transferred to the PDPC. During this transition, the PDPC will collaborate with relevant agencies every 2 years to assess the implementation of the new framework of PDPC and the situation of supervision across the private sector[9]. The draft Organization Act of the Personal Data Protection Committee has also been released To complete the legal basis of PDPC, the draft Organization Act of the Personal Data Protection Committee (hereinafter referred to as the draft of the Organization Act) is released with the PDPA amendment. The draft of the Organization Act aims to formalize the PDPC as the independent central supervisory body. Additionally, it also clarifies the division of responsibilities among agencies on personal data-related matters. Once enacted, the PDPC will serve as Taiwan’s independent authority. According to the draft of the Organization Act, the PDPC is designed as a collegial system with 5-7 committee members, serving a term of 4 years, and members may be reappointed upon completion of their term[10]. As a central third-level agency, the committee members will exercise their powers independently. The draft of the Organization Act states that the PDPC is responsible for making the legislation and policies of personal data protection, the oversight of personal data protection, promoting and researching personal data-related technology, protecting cross-border transfer of personal data and the talent acquisition of personal data protection[11]. The draft of the Organization Act establishes the legal foundation for the PDPC, outlining its organization structure and core responsibilities. Additionally, it grants the PDPC the authority to supervise and enforce compliance with personal data protection regulations. Benefits of the legal reform of the Personal Data Protection Act and the next step The draft partial amendment to the Personal Data Protection Act, along with the draft Organization Act of the Personal Information Protection Committee, have been submitted to the Legislative Yuan for legislative review. This marks the first time that Taiwan has established an independent authority responsible for personal data protection. The PDPA amendment not only formalizes the legal status and authority of the Commission but also enhances the legitimacy and credibility of personal data collection and use. However, amendments to other substantial aspects of data protection will be introduced in the next phase. The Preparatory Office of the Personal Data Protection Commission has already initiated work on the second phase, which will focus on substantial personal data protection issues in the context of the digital era. Reference: [1]The Executive Yuan approved the draft Organizational Act of the Personal Data Protection Commission and the draft of partial amendments to the Personal Data Protection Act, aiming to establish a comprehensive independent supervisory mechanism and enforcement authority, and to build robust data governance for the era of comprehensive AI application., Executive Yuan, https://www.ey.gov.tw/Page/9277F759E41CCD91/747cda78-926f-4205-99b3-1a735fc1b97b (last visited May. 19, 2025). [2]Constitutional Court Judgment 111-Hsien-Pan-13 (2022) (Case on the National Health Insurance Research Database). [3]Establish an independent supervisory authority for personal data protection to strengthen personal data safeguards. The Executive Yuan approved the draft Organization Act of the Personal Data Protection Commission and the draft partial amendments to the Personal Data Protection Act., Preparatory Office of the Personal Data Protection Commission website, https://www.pdpc.gov.tw/News_Content/20/907/ (last visited May. 19, 2025). [4]Partial Amendment Draft to the Personal Data Protection Act, the 8th meeting of the 3rd session of the 11th Legislative Yuan, General Bill No.20, Executive Yuan Proposal No.11010550, Art. 12. [5]Id. Art 18, Art 20-1. [6]Supra note 3. [7]Id. Art.18. [8]Id. Art. 20-1. [9]Id. Art.51-1. [10]Draft of the Organization Act of the Personal Information Protection Committee, the 8th meeting of the 3rd session of the 11th Legislative Yuan, General Bill No.20, Executive Yuan Proposal No. 1101052, Art. 3.Draft of the Organization Act of the Personal Information Protection Committee, the 8th meeting of the 3rd session of the 11th Legislative Yuan, General Bill No.20, Executive Yuan Proposal No. 1101052, Art. 3. [11]Id. at Art. 2.
Development Trend of Information Communication Technology Related LawsIn light of the influence on social security of Internet-related crime, in 2007 Taiwan passed the amendment to the Communication Protection and Inspection Act (CPIA) to update the articles relating to the surveillance of Internet-related crimes. Moreover, the notification obligator clause was added to the Child and Adolescent Sex Trade Prevention ACT (CASTPA), and the penalty for copyright infringement over the Internet was prescribed in the Copyright Act in order to stop Internet-related crimes. 1. Amendment to the CPIA On 15 June 2007, the legislature of Taiwan passed the amendment to the CPIA which was promulgated by the President of Republic of China on 11 July 2007. The amendment mainly concerns the update of the power of issuing surveillance warrants, the scope of emergency surveillance, the supervisory agencies of relevant surveillance activities, and the evidence power of illegal surveillance. The amendment will be brought into force in five months. Currently, a surveillance warrant is issued (1) by the district prosecutor following an application made by the police or based on his authority for cases under investigation; and (2) by the judge based on his power for cases on trial. According to Article 5.2 of the amended CPIA, for cases under investigation, the district prosecutor should record the details of surveillance in writing following the applications made by the judiciary police or based on his authority and should state the reasons and submit relevant documents before applying to the jurisdiction court for the issue of the surveillance warrant. The district prosecutor should approve and reply to the applications made by the judiciary police within 2 hours. For cases of greater complexity, the approval and reply time may be extended for another 2 hours with the consent of the chief district prosecutor. After receiving an application for a surveillance warrant from the district prosecutor, the jurisdiction court should approve and reply to the application within 24 hours. For cases on trial, a surveillance warrant should be issued by the judge based on his authority. Also, the judge may give appropriate instructions for the surveillance in the warrant. Moreover, if an application for a surveillance warrant is rejected by the court, the district prosecutor should make no objection in any form. In other words, the power of issuing a surveillance warrant for cases under investigation has been transferred from the district prosecutor to the judge. Furthermore, the law-enforcement authorities are given the right to initiate an “emergency surveillance” before application during the investigation of serious criminal cases according to Article 6 of the CPIA. In an investigation of serious criminal cases involving obstruction of voting, kidnapping, offence of the President and Vice President Election and Recall Act, the judiciary police may request the district prosecutor to orally notify the implemental authorities of an emergency surveillance. However, the district prosecutor should report to the jurisdiction court to apply for a make-up issue of the surveillance warrant within 24 hours. The district prosecutor’s office should appoint a responsible district prosecutor or a head district prosecutor as the emergency contact for cases involving emergency surveillance. The court should also assign a special window to take charge of the applications for surveillance warrants made by the district prosecutor, and should issue a make-up surveillance warrant within 48 hours of the acceptance of the application. Should the make-up surveillance warrant not be issued within 48 hours, the emergency surveillance should be terminated immediately. The district prosecutor, the court of law and agencies taking charge of the country’s intelligence work are responsible for the supervision of surveillance. According on Articles 12 and 16 of the amended CPIA, regulations governing the period and supervision of surveillance are summarized as follows: (1) The period of surveillance should not exceed 30 days for serious and emergency cases involving endangering national security or social order and blackmailing as in Article 5 of the CPIA; or for cases involving obstruction of voting, kidnapping and offence of the President and Vice President Election and Recall Act as in Article 6 of the CPIA. The responsibility of supervision is the district prosecutor's office for cases under investigation and the court of law for cases on a trial. (2) The period of surveillance should not exceed 1 year for collecting information of foreign powers or offshore opposing powers as in Article 7 of the CPIA. Intelligence authorities should send agents to supervise the electronic surveillance equipment or to the supplier of surveillance equipment to supervise the conditions of surveillance. Should continual surveillance be needed, the implemental agency should submit concrete reasons to make a second application for surveillance two days before the end of the first surveillance period. However, the surveillance should be terminated immediately when the chief of the intelligence agency believes that it is no need to continue the surveillance before the end of the surveillance period. Lastly, the exclusivity of the evidence power of information collected from illegal surveillance is added to Articles 5, 6, 7 and 32 of the amended CPIA. According to Articles 5 and 6, should the surveillance involve severe offence of regulations, the information or evidence collected from the surveillance will not be accepted as evidence in a judiciary investigation, a trial or relevant procedure. Additionally, according to Articles 7 and 32, information or evidence collected from illegal surveillance will not be accepted as evidence in a judiciary investigation, a trial or relevant procedure. The severity of the offence should be determined by the judge based on individual cases. 2. Amendment to the CASTPA Child pornography is easily distributed because of the advancement of Internet communication; and the prepubescent pornography market is expanding as a result. The legislature of Taiwan thus passed on 15 June 2007 the amendment to the CASTPA that was promulgated by the President of Republic of China on 4 July 2007. In the amendment, neighborhood heads, ISPs and telecommunication system providers are the obligator of notification, and “possessors” of child pornography are to be penalized. According to the explanatory statement of the act, child pornography is the permanent record of the abuse of the victims. This will inflict continual damage on the victims. Moreover, child pornography is considered a “serious child exploitation” all over the world. Therefore, there is an international understanding to penalize the possession of child pornography. Before the amendment, Article 28 of the statue simply penalizes people distributing and selling child pornography in the form of disc, videotape and printing. Those deliberately distributing, broadcasting and/or selling child pornography in the form of pictures, videotape, film, disc, electronic signal or other form will be penalized by imprisonment for a term of less than 2 years and with a fine of under NT$2 million. [In the amendment,] those deliberately distributing, broadcasting and/or selling child pornography are penalized and imprisonment for a term of less than 3 years and with a fine of under NT$5 million. While child pornography inflicts continual damage on the victims, Article 28.3 has been added to statute. According to this new Article, those in possession without a proper reason of pictures, films, videotapes, discs, electromagnetic recordings and/or other articles containing sexual intercourses or acts of indecency by people under 18 are to be penalized. In this case, the “possession” of child pornography is penalized. The penalization falls into two stages: competent authorities of municipalities and local counties and cities may order the offender to receive guidance education for 2-10 hours if he/she is detected possessing child pornography without a proper reason for the first time; if offenders are detected for the second time or more, they will be fined NT$20000 to NT$200000. The amendment also refers to the legislation in Canada and the Netherland to reduce the scope of “proper reasons for possession” to scientific study, education and for medical treatment purposes in order to protect prepubescent children from sexual exploitation. Moreover, the amendment has expanded the scope of the notification obligator by including ISPs and telecommunication system providers as the notification obligator. While the Internet and mobile phones are widely used by the public and prepubescent children often receive pornographic information via the chat rooms on the Internet and SMS, this will cause many side effects on prepubescent children in the absence of appropriate management and protection. According to the statistics provided by the Ministry of the Interior, about 300 prepubescent children are sexually assaulted every year from online dating. According to The Garden of Hope Foundation, 40% of sex trade with prepubescent girls found in Taipei County during 2003-5 was conducted over the Internet, and it was 100% for prepubescent boys. It is thus clear that the Internet has become a platform for distributing child pornography. ISPs and telecommunication system providers are included as the notification obligator in Article 9 of the amended statute. Therefore, if they do not notify the authorities in the knowledge of child pornography, they will be fined NT$6000-NT$30000 according to Article 36 of the statue. Therefore, neighborhood heads, ISPs and telecommunication system providers must notify the local competent authorities or authorities specified in Article 6 of any prepubescent children who engage or probably engage in the sex trade in their knowledge. This is designed in order to strengthen the notification and prevention functions and to effectively stop those who deliberately use chat rooms on the Internet and SMS to engage in true sex trade in the disguise of online dating. Though the scope of notification obligation has been expanded in the amendment to the CASTPA to strengthen the notification and prevention mechanisms of prepubescent children sex trade and to define the notification obligations of the supplier and provider of SMS, network chat rooms, BBS, blogs and e-news services, many problems arise as a result. First, when telecommunication system providers have the obligation of notification, they also need to submit relevant evidence. However, this may involve the infringement of privacy of communication. If telecommunication system providers must not commit illegal surveillance, they are unable to acknowledge the contents of communication of consumers. In this case, how can they notify any crime? On the other hand, though information over the Internet is open to the public, it is a tough question for law enforcement officers to provide solid evidence proving that the administrator of online chat rooms and blogs has failed to perform his obligation of notification. 3. Amendment to the Copyright Act The online music downloading service debate has become a heated issue in recent years for the following reasons: “to select only the songs I like”, “comprehensive repertoires”, and “convenience”. According to the Online Music Downloading Survey by the Secure Online Shopping Association (SOSA), 85% consumers have tried the online music downloading service, thus giving rise to the comprehensive online music downloading software and services. However, to attract consumers with files containing unlicensed music, video or other files and charge users of such services, some ISPs provide computer programs or technologies, e.g. point-to-point (P2P), for users to exchange such outlawed materials and charge users for such services. Such acts of making profit from copyright infringement has inflicted disputes in copyright infringement. For example, the IFPI’s accusation in 2003 of Kuro, a P2P platform provider, is the first convicted case of P2P music downloading service in Taiwan. Though the software supplied by Kuro is a neutral technology which is not illegal, Kuro recruited members and charged them membership fees for allowing them to illegally downloading, exchanging and reproducing a large amount of unlicensed copyrighted materials with such software and the platform services it supplies. Kuro also advertised that consumers can download tens of thousands of the latest popular songs with the Kuro software and even encouraged members to download them. Therefore, the court decided that Kuro and its members who have practically downloaded copyrighted music illegally are guilty of copyright infringement. On the other hand, ezPeer, another P2P downloading platform provider, was not found guilty of copyright infringement because no law was practiced at that time to prohibit or restrict the use of P2P software. Also, as a transfer platform, ezPeer offers comprehensive functions and it is thus not a tool for committing crime. Even some users transfer or download unlicensed copyrighted materials with this tool, there is possibility for the non-liability reasonable use. Moreover, ISPs have no filtering obligations in the Copyright Act of the ROC. Therefore, even consumers may use the services for illegal activities, P2P service providers are not an accomplice. Therefore, to define the liabilities of P2P platform providers, the legislature of Taiwan passed on 14 June 2007 the amendment to the Copyright Act to include P2P software providers in governance of the act. In the future, platform providers will be prohibited by the Copyright Act from charging members for unlicensed activities. New objects of copyright infringement are added to the amendment, and the amendment includes the addition of Article 87.1.7, 87.1.2, and 97.1; and the revision of Article 93.4. According to Article 87.1.7, attempt to allow the public to openly transfer or reproduce works of others without prior consent or licensing from the owner is copyright infringement, and supply of computer programs and/or technologies that can be used for public transfer and/or reproduction of such for the purpose of making profits is deemed as copyright infringement. As the supplier of computer programs and/or technologies is the focus of this article, behaviors categorized based on this article must also meet the following requirements: (1) attempt to allow the public to download and/or transfer over the Internet copyrighted materials without prior consent or licensing of the copyright owner; (2) the act of supply of computer programs and/or technologies; (3) and making profits from such behaviors. In other words, the focus of the amendment is to prohibit providers by written law from supplying computer programs and/or technologies for users to transfer and/or exchange unlicensed music, video and/or other copyrighted materials and from charging users or making profits from such services. However, the amendment has adopted the principle of technology neutrality and specifies that P2P software providers will only be penalized when they have the act of making profit and the intention of copyright infringement in order not to prevent technological development and to save ISPs from breaking the law all the time. As the “intention” of copyright infringement is the criterion of judgment, Article 87.2 is added to the Copyright Act in the present amendment. According to this article, whether or not the doer instigates, guides or incites in advertisements or other active actions the public to use the computer programs and/or other technologies it supplies to commit copyright infringement is the criterion for determining the “intention” of copyright infringement. Also, the court will determine with severity whether or not the advertisements or other active actions are ready for instigating, guiding or inciting the public use the computer programs and/or other technologies the doer supplies to commit copyright infringement. In general, when providers offer services, such as web photo albums, BBS, instant messengers, auctions, web disks and online discussions, it is not their initial intention to supply software and/or technologies for users to illegally download and/or transfer the copyrighted materials of others, nor do they encourage, instigate, guide, incite and/or convince users to commit copyright infringement. Even such software can be used for transferring and/or distributing unlicensed copyrighted materials, providers must not be restricted, and it should be the users who take the liability of copyright infringement. After the enactment of the amendment, providers who make profit from supplying software for others to distribute unlicensed copyrighted materials and encourage users to exchange such materials with the software are to be penalized by imprisonment for a term of less than 2 years, community service, or fined, or penalty together with a find of under NT$500000 according to Article 93. Moreover, by adding Article 97.1, the competent authorities are entitled to order ISPs to shutdown or close the business when they are convicted for the abovementioned offences and refuse to stop such illegal acts after being determined for “severe copyright infringement” and “severely injury of the benefits of the copyright owner”. After this amendment of the Copyright Act, service providers can no longer use the excuse “we simply provide a service platform and have no right to check the behavior of consumers” as an escape of their liabilities. In fact, P2P service providers who charge users monthly fees for the P2P software, such as Kuro and ezPeer, have already signed licensing agreements with music companies before the enactment of this amendment. Therefore, the music they provide for users to download is no more unlicensed copyrighted materials. Therefore, the amendment has certain effect on improving copyright protection.
- Impact of Government Organizational Reform to Scientific Research Legal System and Response Thereto (1) – For Example, The Finnish Innovation Fund (“SITRA”)
- The Demand of Intellectual Property Management for Taiwanese Enterprises
- Impact of Government Organizational Reform to Research Legal System and Response Thereto (2) – Observation of the Swiss Research Innovation System
- Blockchain in Intellectual Property Protection
- The amendment of the Taiwanese Personal Data Protection Act
- Recent Federal Decisions and Emerging Trends in U.S. Defend Trade Secrets Act Litigation
- Legal issues of Third-Party Payment in Taiwan
- Copyright Ownership for Outputs by Artificial Intelligence