A Brief Introduction to Taiwan’s Legislations to Promote Industrial Innovations of the Digital Economy

A Brief Introduction to Taiwan’s Legislations to Promote Industrial Innovations of the Digital Economy

2023/05/15

I. Background

To encourage the development of digital industries in communications, information, cybersecurity, networking and communication, to centralize digital governance and digital infrastructure development and to assist in digital transformation of public and private sectors in Taiwan, the Ministry of Digital Affairs (“the MODA”) was created on August 27, 2022 to spearhead the national digital development policy, communications and digital resources; the development of digital technology use cases and the environment for innovations and talents; policies and regulations governing digital economy industries, national cybersecurity, the government’s digital services, open data and data governance, digital infrastructure, international exchange and cooperation and competence standards for the government’s professional personnel in IT and informational security. The Administration for Digital Industries (ADI) and the Administration for Cyber Security (ACS) have been established as the MODA’s subordinate agencies, to address challenges on all fronts in the digital wave.

As the central competent authority on the industrial development of the digital economy, the MODA may subsidize, incentify or support innovative activities of digital economy industries in accordance with Paragraph 1, Article 9 of the Statute for Industrial Innovation and determine relevant matters in accordance with Paragraph 2 of the same article. Hence, the MODA promulgated the Subsidy, Reward and Assistance Regulations for Promoting Industry Innovation (“the Regulations”) on December 23, 2022, to encourage innovation and R&D on software, services, integration and application in telecommunications, information, cybersecurity, networking, and communication. The purpose is to enhance the industry environment and to boost the industry competitiveness.

These Regulations serve as the MODA’s flagship efforts in promotion of industrial innovations and highlights Taiwan’s emphasis on digital economy industries. Below is a summary of the Regulations.

II. Scope

As stated in the overview described in Article 2, the Regulations aim to assist in the development of software products, digital services and infrastructure, system integration and vertical use cases in telecommunications, information, cybersecurity, networking and communication, so as to encourage innovations in digital economy industries such as ecommerce, digital contents, new types of digital services, communications and network deployment, to improve the industry environment and enhance the industry competitiveness.

In sum, the “digital economy industries” mentioned in the Regulations refer to software, digital services or digital infrastructure sectors in telecommunications, information, cybersecurity, networking and communication.

III. Policy measures

According to Paragraph 1, Article 3 of the Regulations, the MODA or its subordinate agencies may provide subsidies, rewards and assistance to the activities in digital economy industries such as promotion of innovation or R&D, supply of technologies and support in upgrade. This may involve the encouragement of creation of innovation of R&D centers by companies; assistance to establishment of innovation or R&D institutions; fostering of cooperation among industries, academia and research organizations; promotion of corporate engagement in talent development at schools and development of human resources in industries; support to innovations by local industries; advocacy of corporate use of big data and the government’s open data; enhancement of communications network resilience and network infrastructure prevalence and other relevant matters.

Moreover, the Regulations provide details of the policy measures for subsidies, rewards and support as follows:

1. Subsidies

The relevant details are provided from Article 4 to Article 17 of the Regulations.

(1) Eligibility

According to Paragraph 1, Article 4 of the Regulations, subsidy recipients in principle shall be engaged in activities of digital economy industries, shall be either a sole proprietorship, partnership, limited partnership, or corporation registered in accordance with domestic laws or a natural person who is national of the R.O.C., a natural person from Hong Kong or Macau or a foreign national with permanent residency and has never been listed as a refusal account by any bank. Flexibility can be granted in accordance with Paragraph 2 of the same article. If required for the development of digital economy industries, the MODA or its subordinate agencies may establish separate eligibility criteria for subsidy recipients. However, such eligibility criteria only take effect via public announcement and publication on the Executive Yuan Gazette.

Finally, according to Article 13 of the Regulations, no subsidy application may be submitted in event of violation of laws related to environmental protection, labor safety and health or food safety and hygiene during the most recent three years, as determined to be serious by central competent authority.

(2) Subsidy limits

According to Article 5 of the Regulations, different programs come with different ceilings measured in percentage. In principle, the subsidized amount shall not exceed 50% of the program budget if it is for promotion of industry innovation or R&D or encouragement of corporate use of big data and the government’s open data to develop and innovate commercial applications or service models. However, this does not apply to specific policy considerations or subsidy schemes above the budget and approved by the MODA or its subordinate agencies.

For example, the subsidized amount shall not exceed 50% of the course fees for corporate engagement in talent development on campus or enhancement of talent resources for industries. However, this limit does not apply to subsidies to indigenous people, persons with disabilities, low-income households, or the special circumstances approved by the MODA or its subordinate agencies.

Support schemes such as assistance to industrial technology and upgrade; encouragement of creation of innovation of R&D centers by companies; assistance to establishment of innovation or R&D institutions; fostering of cooperation among industries, academia and research organizations; support to innovations by local industries; enhancement of communications network resilience and network infrastructure prevalence and other projects shall be announced by the MODA or its subordinate agencies and published on the Executive Yuan Gazette.

(3) Subsidy programs

According to Articles 6 of the Regulations, there are no specific restrictions on subsidy categories, with two exceptions: (1) promotion of industry innovation or R&D – Subsidies are limited to six categories, i.e., innovation or R&D personnel expenses for approved projects; costs for consumables and raw materials; access and maintenance expenses for innovative or R&D equipment; introduction of intangible assets; commissioning and verification fees of research; and travel expenses. (2) advocacy of corporate use of big data and the government’s open data to develop and innovate commercial applications or service models or enhancement of communications network resilience and network infrastructure prevalence - Subsidies are limited to three categories, i.e., fees for commissioned services; training & education fees; and promotional campaign expenses.

(4) Application submission

According to Article 7 of the Regulations, an applicant should submit the application form, the project plan and relevant data to the MODA or its subordinate agencies. If the contents of the project plan or documents fail to meet requirements, the MODA or its subordinate agencies may request missing materials before a deadline of up to one month. The MODA or its subordinate agencies may not accept applications without missing materials supplied before deadlines.

(5) Acceptance and review

According to Article 8 of the Regulations, the MODA or its subordinate agencies shall convene review meetings to review applications, changes and irregularities in the execution of subsidy programs. Applicants may be asked to provide explanations or Personnel may be sent to conduct on-site inspections. If necessary, relevant authorities or institutions may be commissioned assist in financial reviews.

Additionally, according to Article 9 of the Regulations, the period from document readiness by an applicant to notification of the completed review to the applicant may not exceed three months. This may be extended by one month if necessary.

Finally, according to Article 17 of the Regulations, subsidized projects, subsidy recipients, approval dates, subsidized amounts (including cumulative amounts) and relevant information shall be announced on the websites of the MODA or its subordinate agencies each quarterly unless the disclosure should be restricted or is not provided according to Article 18 of the Freedom of Government Information Law.

(6) Contract signing

Once reviewed and approved, the applicant must sign the subsidy contract with the MODA or its subordinate agencies within the time period specified by Article 10 of the Regulations. Unless extension has been agreed by the MODA or its subordinate agencies, the approval of the application loses validity if a contract is not signed before the deadline.

(7) Matters of adherence by subsidy recipients

Once the subsidy contract has been signed, an applicant becomes a subsidy recipient under the Regulations and must abide by relevant terms and conditions. First, the recipient shall establish a separate account for subsidy funds and maintain a separate account book, according to Article 11 of the Regulations. All of the interest generated from the subsidy account and any balance remaining after the project completion shall be fully returned to the national treasury via the MODA or its subordinate agencies. Meanwhile, to examine whether there are any duplications of application, the use of subsidy funds and the effectiveness of project implementation, the MODA or its subordinate agencies may dispatch personnel or commission a fair and just organization to inspect the relevant documents, account books and status of project execution. The subsidy recipient shall not refuse such an examination, is obligated to respond and shall submit work reports and details about the use of funds by following the agreed-upon schedule. In event of breach, the disbursement of subsequent funds may be suspended, under the terms and conditions of the subsidy contract.

Second, according to Article 12 of the Regulations, if a recipient fails to execute the subsidized project as planned or the project experiences a significant delay in progress, or there is an overly large gap between the project results and the business plan, or the project fails to pass the review, inspection or acceptance by the MODA or its subordinate agencies and no improvement has been made before the specified deadline, or there is a breach of the Regulations Governing Procurements for Scientific and Technological Research and Development if the subsidized amount exceeds 50% of the recipient’s procurement and it meets the threshold for public announcements under the Government Procurement Act, the MODA or its subordinate agencies may suspend the next disbursement in accordance with the terms and conditions of the subsidy contract, claw back the disbursed subsidy and even stop any subsidy to the recipient for one to five years, depending on the severity of the circumstances.

Third, according to Article 14 of the Regulations, the MODA or its subordinate agencies must conduct a comprehensive assessment of effectiveness of subsidized projects and the recipient shall cooperate by providing data required for the assessment.

Fourth, according to Article 16 of the Regulations and unless otherwise specified by laws, if the subsidized amount exceeds 50% of the total budget for a technology project, the ownership and utilization of R&D results shall comply with the Government Scientific and Technological Research and Development Results Ownership and Utilization Regulation. In event of breach by the recipient violates, the MODA or its subordinate agencies may terminate the subsidy contract and shall refuse to accept any subsidy application from the recipient for five years from the date of completion of the innovation or R&D. If the reason is attributable to the recipient, the subsidy contract shall be canceled and the subsidies shall be refunded.

(8) Subsidy applications

According to Article 17 of the Regulations, a subsidy applicant shall declare to the MODA or its subordinate agencies the following:

1) No significant default in the execution of any government-sponsored science and technology projects during the past five years.

2) No suspension currently in force as a result of disciplinary actions in relation to execution of a government-sponsored science and technology project.

3) No tax incentives, rewards or subsidies for the same matter under other laws granted to the same subsidized project.

4) No taxes owed during the past three years. However, individuals who apply for the subsidy under Subparagraph 5 or 6, Paragraph 1, Article 3 are exempted.

5) No violation of laws related to environmental protection, labor safety and health or food safety and hygiene or the People with Disabilities Rights Protection Act during the most recent three years, as determined to be serious by central competent authority. However, this does not apply to circumstances that occurred prior to the enforcement of the Statute.

If the applicant refuses to declare the above, the MODA or its subordinate agencies may not accept the application. If any false statement is identified, the application may be rejected, or the subsidy may be withdrawn, the contract may be canceled and the disbursed funds shall be returned.

2. Rewards

According to Paragraph 1 of Article 18 of the Regulations, the MODA or its subordinate agencies will announce reward programs for digital economy industries with details on recipients, eligibility criteria, evaluation standards, application procedures, approving agencies and other related matters.

Moreover, reward applications are not accepted according to Paragraph 2 of Article 18 and the provisions of Article 13 and Article 15 shall apply mutatis mutandis. Article 17 regarding announcement of government information on subsidy applications shall also apply to reward applications.

3. Assistance

Relevant rules are primarily prescribed from Article 19 to Article 21 of the Regulations.

(1) Eligibility

According to Paragraph 1 of Article 19 of the Regulations, the rules prescribed in Subparagraph 1, Paragraph 1 of Article 4 also apply to the eligibility criteria for assistance to digital economy industries. In other words, assistance recipients in principle shall engage in activities of digital economy industries, either a sole proprietorship, partnership, limited partnership, or corporation registered in accordance with domestic laws or a natural person who is national of the R.O.C., a natural person from Hong Kong or Macau or a foreign national with permanent residency and has never been listed as a refusal account by any bank.

Flexibility can be granted outside the aforesaid limitations and in accordance with Paragraph 2 of Article 19. If required for the development of digital economy industries, the MODA or its subordinate agencies may establish separate eligibility criteria for assistance recipients via public announcement and publication on the Executive Yuan Gazette.

(2) Oversight of commissioned organizations

According to Article 20 of the Regulations, the MODA or its subordinate agencies may evaluate and assess the effectiveness of the assistance services provided by the commissioned organization(s) for recipients as an important basis for reviewing assistance projects.

(3) Establishment of a single contact window

The assistance unit may establish a single contact window to provide assistance and counseling services, according to Article 21 of the Regulations.

4. General provisions

In addition to specific rules, the general provisions prescribed from Article 22 to Article 25 shall apply to subsidies, rewards or assistance provided by the MODA and its subordinate agencies.

First, all the funds required for policy measures shall come from the budgets allocated by the MODA or its subordinate agencies, according to Article 25 of the Regulations.

Second, the MODA or its subordinate agencies may commission a legal person or a group to handle the application acceptance, review, approval, inspection, subsidy disbursement and claw-back, rewards, assistance and other relevant matters, according to Article 22 of the Regulations.

Furthermore, according to Article 23 of the Regulations, the incoming and outgoing of funds for subsidy, reward and assistance projects are managed as follows:

1) The same project applying for subsidies with two or more organizations should list the details of all expenses and the breakdowns and amounts of subsidies, rewards and assistance under application with each government agency. The subsidy, reward and assistance program shall be canceled and the disbursed funds shall be returned in event of concealment or false statements.

2) If the review by each government agency on the use of funds identifies poor results, utilization not consistent with the subsidy purposes, or inflated or dishonest numbers, the subsidy, reward or assistance recipient shall return the disbursed funds. Meanwhile, no subsidy shall be granted to the subsidy, reward or assistance recipient in question for one to five years, depending on the severity of circumstances.

3) If procurement is involved in the subsidy, reward or assistance budget, the subsidy, reward or assistance recipient shall adhere to the Government Procurement Act.

4) When reporting on expenses, the subsidy, reward or assistance recipient shall enumerate in detail the utilization of expenditures and the total amount of spendings. The same project subsidized by two or more organizations shall list the actual sum of subsidies, rewards and assistance.

Finally, according to Article 24 of the Regulations, the approval, disbursement and reimbursement of subsidies, rewards and assistance are processed as follows:

1) Disbursement based on project progress: The number of instalments, the method, the amount (percentage) are specified in the contract by the MODA or its subordinate agencies, depending on the project and the timetable.

2) Reimbursement shall be based on the Management Guidelines for the Disposal of Government Expenditure Vouchers, the Matters of Attention Regarding Budget (Donation) Implementations by Central Government Agencies for Private Groups and Individuals and relevant contractual provisions.

IV. Conclusions

To accelerate the innovation and development of digital economy industries in Taiwan, the MODA has promogulated the Subsidy, Reward and Assistance Regulations for Promoting Industry Innovation in accordance with Paragraph 1, Article 9 of the Statute for Industrial Innovation. It is hoped that the subsidies, rewards and assistance provided by the MODA helps to enhance the competitiveness of digital economy industries and the effectiveness of the digital economy development in addition to the Statute.

The Regulations set out detailed rules on policy measures e.g., subsidies, rewards, and assistance. Key matters such as eligible recipients, application procedures, review mechanisms, responsibilities and obligations are clearly defined but certain flexibility is reserved by exceptions. A contract-centric approach provides manoeuvrability in practice specific to project circumstances. It is hoped that the MODA and its subordinate agencies can utilize these Regulations once in force, to enhance the business environment of the digital economy industries and continue to drive industry innovations.

※A Brief Introduction to Taiwan’s Legislations to Promote Industrial Innovations of the Digital Economy,STLI, https://stli.iii.org.tw/en/article-detail.aspx?no=105&tp=2&i=170&d=9041 (Date:2024/05/18)
Quote this paper
You may be interested
Product Liability of Living Lab Products

I. Forward Only about 18% of the products or services continue to create good sales and have long product life cycles after entering the stream of commerce. This might denote that mass investing in the R&D does not necessary guarantee to develop popular goods and services. In order to overcome this obstacle, many experts and scholars from different research areas propose different R&D mechanisms to solve this problem. The so called “open innovation” is one of the most dynamic R&D mechanisms in recent years, which is created to compensate the weakness of “closed innovation”. By introducing the concept of “open innovation”, Living Lab invites real users join the projects of un-launched products and services for every possible R&D process to obtain the real interaction wherefrom, to fulfill the goal of “user centric” innovation. However, if users or any third party is injured or damaged from the trial products or services, to what extent Living Labs is liable for is one important question to further future innovation environment. This article will first gives a brief introduction and the development of living labs in Taiwan, follow by applying national laws and analysising obstacles to the liability issue caused by defective Living Lab products. Then, the article will continue to refer to foreign legislation and Living Lab practice, and conclude by suggestions and recommendations to the Living Labs practice in Taiwan. II. Brief Introduction of Living Labs A. Composition of Living Labs The concept of Living Labs was developed by Professor William J. Mitchell from the MIT Media Lab and School of Architecture. Professor Mitchell proposed applying the user-centric research method by using Living Lab as a R&D platform and bring together stockholders (co-creators), including public sectors, companies, universities and research fellows, and the most important, the end-users communities, both professional or non-professionals from various backgrounds, to join the R&D process. B. Operation Mode of Living Labs Living Lab invites end users to join the real world testing either in a digital, physical or virtual environment. Un-launched products or services are provided for testing and users are required to give feedbacks either experience, opinions, suggestions or even ideas to the products or services in return. Living Lab then collets and utilizes the feedbacks and observe the behavior patterns for product or service modification and improvement, future R&D plans and market analysis. C. Benefits of Living Labs Lirving Lab could effectively converse different backgrounds and levels of empirical environment, enhance the efficiency in R&D and bring about different benefits to the stakeholders. By participating in the R&D process, users could give feedbacks to Living Labs to further up the un-launched products and services (on the marketplace) to fit consumers’ needs. For industry, Living Lab provides platforms to get together stakeholders, speed up the integration of stakeholders of different size or from different fields and promote the R&D efficiency. For universities and research institutes, the public-private-people (user)-partnership (PPPP), could further more flexible services or R&D ecosystem and not only to have user-centric innovation, but also user-driven innovation.1 D. Development of Living Labs Living Labs has been energetically developed in Europe. Through the integration of project resources, individual Living Lab forms into Living Labs networks and actively engaging in cross-border or cross-project co-operation. 2 The concept of Living Labs has been introduced into Taiwan, there are several Living Labs in Taiwan so far, for example, Living Labs Taiwan from Institute for Information Industry (III), 3Touch Center (Center for Technology of Ubiquitous Computing and Humanity) from National Cheng Kung University, 4 Insight (Center of Innovation and Synergy for Intelligent Home and Living Technology) from National Taiwan University, 5 and Eco City from National Chiao Tung University. 6 The Living Labs aim to bring about the user-centric and user-driven model and bring new elements to R&D innovation. III. Liability of Losses, Damages, or Injuries Caused by Living Lab Products In order to encourage more end users join the Living Labs experiment, Living Labs usually provide the un-launched products or services as gifts or lend it for free. However, if products or services caused injury, economic loss or property damages to the users or third party during the experiment, to what extent should the Living Lab be liable for. A. Legal Status Upon on discussing of legal liability of Living Labs, the first prong to review is the legal status of Living Labs under the legal system in Taiwan. Although it is called “Lab”, but it is not necessarily to be a lab with “physical facility”, it could also be “virtual Labs”, for example, HP and Firebox are both launch for virtual Living Labs online to invite users join their open innovation projects. The concept of open innovation within the Living Labs environment, where Living Labs play as a role of a cook pot which gather personnel, equipment, and technology from parties from different working fields, integrate resources and creativeness to catalyze innovative ideas for new products and services. Normally, each Living Lab can be viewed as an independent "legal entity". In other words, it can exercise rights ad bear responsibility/liabilities under the law, and therefore, to response to needs for R&D, increase efficiency and contribute matters of legal compliance. B. User’s Legal Claims Against Living Labs 1. Contractual Liability Living Labs often use “user agreements” as legal documents to regulate the legal relationship between Living Labs and users. If there is any injury, damages or losses occurred during the experiment, users can sue Living Labs for breach of contract and sue for liability, warranty or violation of justice of contract. If the product is defective, such as manufacture defect, design defect or lack of proper warning, the injured user can sue Living Labs based on warranty. However under the provisions of Article 411 of the Civil Code, 7 if the product is offered for trial free for charge, if the gift is defective and caused injury, damages or losses to the users, Living Lab is not liable for breach of warranty. Unless the Living Lab intentionally conceal the defects and not information the user, or represent to the user that the product is guaranteed flawlessness and free from defects. Under this situation, Living Lab will be liable for damages caused by the defect. In the situation that when Living Lab only lend the products for trial, with the provisions of Article 466 of the Civil Code, 8 only when Living Lab intentionally conceal the defect, then is liable for the injuries and damages resulting there from. However, the purpose of the Living Labs experiment is to implement the open innovation, through the operation of the mechanism, by inviting potential users to join the experiment and require them to give feedbacks, ideas and recommendations for future product improvement. In addition to that, in most of the situations, it is difficult for Living Labs to foresee the existence of potential risks of their products or intentionally conceal the defects or guarantee the products are without defects; therefore it will be even harder for the injured users to bear the burden to proof the above situations. It is worth to address that, Living Labs and users shall enjoy contract autonomy as long as the provisions and terms of contract are not violating laws, public order and good morals, but not without any restriction. When parties have right of freedom of contract, at the mean time, their contract shall not exceed the boundaries of contractual justice. Especially, the burden and allocation of risks needs to be measured and assessed by the status and interests of the parties on rational bases. Because one of the special characteristics of Living Lab is open to general users to participate the experiment voluntarily, Living Lab usually adapts fill-in standard form contracts for convenience. But for the protection of the users, Living Lab shall pay more attention to the provisions and terms of contract which must not violate Article 247-1 of the Civil Code, 9 for example, provisions of contract shall not waive, decrease or increase liabilities of the parties, waive or limit any party to exercise his/her rights, or significant detriment one another’s’ interests, otherwise that part of the provision shall be void. 2. Tortious Liability When damages are caused by defective Living Lab products, users may be able to sue Living Labs and based his/her causes of action on Consumer Protection Law Article 7 business operator’s liability, 10 The Civil Code Article 191-1 manufacturer’s liability 11 and as well as The Civil Code Article 184 (1) tortious liability. 12 Yet, in order to provide motivations and incentives for users to join the open innovation, Living Labs usually gratuitous lending or gifting products or services to the users, at least in this stage, Living Labs are not conform with the definition of “business operators” 13 in the Consumer Protection Law, in designing, producing, manufacturing, importing or distributing goods, or providing services design, manufacturing, inputs, distribution of goods or the provision of services for business enterprise operators. Nor the Living Labs users are under the same definition of “consumer” 14 protected under the definition of the Consumer Protection Law, as those who enter into transactions, use goods or accept services for the purpose of consumption. Therefore, the relationship between Living Labs and the users are not “consumer relationship” 15 for sale of goods or provision of services, for which the Consumer Protection Law might not be applicable to offer protection to the users. Reviewing from the legislative history, Article 191-1 of the Civil Code was amended after the Consumer Protection Law. The reason for amendment was to maintain the completeness of the torts liability in the Civil Code and in supplement to the inadequacy of the Consumer Protection Law. 16 In referred from the above, the definition of “goods” is synonymous with the definition in the Consumer Protection Law. In order to apply the provisions, parties must be in the “consumer relationship” as regulated in Article 2 (3) of the Consumer Protection Law. As mentioned above, usually, Living Labs provide the products free of use or as gifts, it is really difficult to say there is “consumer relationship” between the parties. The first clause of Article 184 of the Civil Code states, “A person who, intentionally or negligently, has wrongfully damaged the rights of another is bound to compensate him for any injury arising there from. The same rule shall be applied when the injury is done intentionally in a manner against the rules of morals.” Hence, in this situation the burden of proof will lay on the users to prove that Living Labs is either with negligent or intent to damage the users by the defective products. Living Labs adapt open innovation to encourage users to participate into the every possible R&D process and obtain feedbacks or recommendations in return. Therefore, most of the time, Living Labs do not have “intent” to cause damages to the users, but whether Living Labs are with “negligence” will often be difficult to prove by the users. C. Third Party’s Legal Claim Against Living Labs 1. Contractual Liability In the case when a third party, who is not associated with the Living Labs experiment, sustains injury or damage from the defective Living Labs products, he or she might not be able to sue under the terms of contract because there is no contractual relationship exists between the parties. The possible cause of action for the third party might be able to sue Living Labs based on torts liability for damages. 2. Tortious Liability Although Article 7 of the Consumer Protection Law does provide cause of action for the third party to sue against the business operator for defective products, the third party must base his or her claim on the “consumer relationship” between the Living Labs or users. However, as mention as above, the relationship between Living Labs and the users are not under the “consumer relationship” as prescribed in the Consumer Protection Law, thus third party cannot sue Living Labs for damages in accordance with the Consumer Protection Law. As to the application process of provisions prescribed in Article 191-1 and 184 (1) of the Civil Code, the result is as the same as above. IV. Foreign Legislation and Practice A. American Jurisprudence 2d In the Comment of the 63A Am. Jur. 2d Products Liability §1142 states, “[s]trict liability covers not only products which have been sold, but also products that have been designed to be sold, have been produced to be sold, or are offered to be sold or marketed”. Furthermore, introduction into the stream of commerce does not require a transfer of possession; strict liability rests on “foreseeability”, and not on esoteric concepts relating to transfer or delivery of possession. Furthermore, the Comment extends the scope of application of strict liability to the “Transaction Other than Sales”. Strict liability also applies to the distribution products in a commercial transaction other than a sale, one provides the product to another either for use or consumption or as a preliminary step leading to ultimate use or consumption. For products made available for demonstration, testing or trial regulated in 63A Am. Jur. 2d Products Liability §1147, where a product-caused injury has taken place while the product is being tested or used for trial purposes by the prospective buyer, prior to the completion of a sales transaction, the person or entity who placed the product into the stream of commerce by providing it to the prospective buyer may be strictly liable. Strict liability also applies to those who manufacture and supply products to consumers on an investigational basis, even though the "supplying" does not technically amount to a sale. In the Observation of §1147 states that “[a] manufacturer who enters the marketing cycle by way of a demonstration, lease, free sample, or sale is in the best position to know and correct defects in its product, and as between the manufacturer and its prospective consumers, should bear the risk of injury to those prospective consumers when any such defects enter the market uncorrected. In sum, if one sustained injury, damages or economic losses by Living Labs products, he or she may sue Living Labs for product strict liability prescribes in §1142 & §1147. B. Living Labs Practice in Foreign Countries Referring to provisions of “Standard Contract” used between Living Labs and the users in other countries, most of the time, Living Labs might disclaim damages to property, but cannot disclaim legal protection or injury compensation. At the mean time, most of the Living Labs also adapt public safety insurance and product liability insurance to protect themselves and the users. V. Conclusion and Recommendation In conclude, the legal norms in Taiwan seems not be able to offer proper protection to Living Labs and the users. This article suggests that in order to form the ecosystem for the open innovation model of Living Labs, Living Labs shall provide proper protection to the users in order to balance the interests between Living Labs and users and catalyze the motive for the users to join the experiment. In referring to the “Guidelines for Good Clinical Practice for Trials on Pharmaceutical Products” 17 from the Department of Health, besides the proper duty, the main purpose of the guideline is to ensure the safety of the human participants. In the provisions prescribe in Article 22 of the “Good Clinical Guidelines”, the clinical trial agreement or related document shall provide participants with proper compensation or treatment when damage occurs. The “Model Clinical Trail Agreement” also provides provisions of damage compensation and insurance in the template which state the application to the assumption of risks and consumer protection. However, because the pharmaceutical clinical trial is with higher risk, the competent authorities, Department of Health, particularly get involved within the regulations and mechanisms of clinical trials to protect the human participants. In sum, whether the similar mechanism can be applied directly between the Living Labs and users needs for further consideration. Finally, for the continuous operating environment, it is necessary for Living Labs to adapt related laws and measures for the open innovation operating model. It is suggested that Living Labs shall enter contracts in the terms with proper risk allocation in accordance to contract justice and possibly with public safety or product insurance to share their liabilities. 1.EUROPEAN COMMISSION INFORMATION SOCIETY AND MEDIA, Living Labs for User-Driven Open Innovation:An Overview of the Living Labs Methodology, Activities and Achievements, European Commission(2009),at7,availableat http://ec.europa.eu/information_society/activities/livinglabs/docs/brochure_jan09_en.pdf (last accessed on Dec. 31, 2012). 2. Id., at 11-12 & 14. 3.Living Lab Taiwan, http://www.livinglabs.com.tw/index.html (Last accessed Dec. 26, 2012). 4. Touch Center from National Cheng Kung University, http://touch.ncku.edu.tw/touch/?q=node/52 (Last accessed Dec. 26, 2012). 5.Insight from National Taiwan University, http://insight.ntu.edu.tw/zh-tw/node/662 (Last accessed Dec. 26, 2012). 6.Eco City from National Chiao Tung University, http://www.ecocity.org.tw (Last accessed Dec. 26, 2012). 7.Civil Code Article 411, “The donor is not liable for a defect in the thing or right given. But, if he has intentionally concealed the defect or expressly guaranteed that the thing was free from such defect, he is bound to compensate the donee for any injury arising therefrom.” 8.Civil Code Article 466, “If the lender intentionally conceals a defect in the thing lent, he is responsible to the borrower for any injury resulting therefrom.” 9.Civil Code Article 247-1, “If a contract has been constituted according to the provisions which were prepared by one of the parties for contracts of the same kind, the agreements which include the following agreements and are obviously unfair under that circumstance are void. (1) To release or to reduce the responsibility of the party who prepared the entries of the contract. (2) To increase the responsibility of the other party. (3) To make the other party waive his right or to restrict the exercise of his right. (4) Other matters gravely disadvantageous to the other party. 10.Consumer Protection Law Article 7, “ business operators engaging in the design, production or manufacture of goods or in the provisions of services shall ensure that goods and services provided by them meet and comply with the contemporary technical and professional standards of the reasonably expected safety prior to the sold goods launched into the market, or at the time of rendering services. Where goods or services may endanger the lives, bodies, health or properties of consumers, a warning and the methods for emergency handling of such danger shall be labeled at a conspicuous place. Business operators violating the two foregoing two paragraphs and thus causing injury to consumers or third parties shall be jointly and severally liable therefore, provided that if business operators can prove that they are not guilty of negligence, the court may reduce their liability for damages.” 11.Civil Code Article 191-1, “The manufacturer is liable for the injury to another arising from the common use or consumption of his merchandise, unless there is no defectiveness in the production, manufacture, process, or design of the merchandise, or the injury is not caused by the defectiveness, or the manufacturer has exercised reasonable care to prevent the injury. The manufacturer mentioned in the preceding paragraph is the person who produces, manufactures, or processes the merchandise. Those, who attach the merchandise with the service mark, or other characters, signs to the extent enough to show it was produced, manufactured, or processed by them, shall be deemed to be the manufacturer. If the production, manufacture, process, or design of the merchandise is inconsistent with the contents of its manual or advertisement, it is deemed to be defective. The importer shall be as liable for the injury as the manufacturer.” 12.Civil Code Article 184 (1), “A person who, intentionally or negligently, has wrongfully damaged the rights of another is bound to compensate him for any injury arising there from. The same rule shall be applied when the injury is done intentionally in a manner against the rules of morals.” Consumer Protection Law Article 2 (2), “business operators" means those who are engaged in the business of designing, producing, manufacturing, importing or distributing goods, or providing services. Consumer Protection Law Article 2 (1), “consumers" means those who enter into transactions, use goods or accept services for the purpose of consumption. Consumer Protection Law Article 2 (3), “consumer relationship” means the legal relationship arising between consumers and business operators for sale of goods or provision of services. 16.王澤鑑,侵權行為法第二冊:特殊侵權行為,第313-314頁 (出版日期2006年7月) 17.DEPARTMENT OF HEALTH, Guidelines for Good Clinical Practice for Trials on Pharmaceutical Products, http://www.6law.idv.tw/6law/law3/%E8%97%A5%E5%93%81%E5%84%AA%E8%89%AF%E8%87%A8%E5%BA%8A%E8%A9%A6%E9%A9%97%E6%BA%96%E5%89%87.htm (last visited Dec. 31, 2012)

Brief Introduction to “European Union’s Recommendations for QTSPs Based on Standards”

Brief Introduction to “European Union’s Recommendations for QTSPs Based on Standards” 2022/06/24 I. Introduction   The Electronic Identification and Trust Services Regulation (eIDAS)[1] of the European Union was passed in 2014 and came into effect in July 2016. The eIDAS consists of six chapters and its core elements are covered in two parts: Chapter 2 Electronic Identification and Chapter 3 Trust Services. Chapter 3 provides the legal framework for trust services (TS) in relation to electronic transactions and encompasses electronic signatures, electronic seals, electronic time stamps, electronic registered delivery services and website authentication. Each trust service can be provided by trust service providers (TSP) or qualified trust service providers (QTSP). Qualification from the supervisory authority of each member state is required to become a QTSP and provide qualified trust services (QTS).   In March 2021, the European Union Agency for Cybersecurity (ENISA) published “Recommendations For QTSPs Based On Standards[2]” for those interested in becoming QTSPs. II. Highlights   The eIDAS is technology neutral regarding trust service security requirements, without specifying any technology. In other words, TSP can achieve the level of security required by the eIDAS with different technologies. In fact, the European Union hopes to drive standardization with common grounds gradually formed with industry self-regulation in the legal framework and the trust framework under the eIDAS[3].   Since 2009, the European Union has been formulating the standardisation framework related to electronic signatures with the assistance from standardization bodies such as European Committee for Standardization (CEN) and European Telecommunications Standards Institute (ETSI). The vision is to establish a comprehensive standardization framework to resolve the problems of using electronic signatures across borders within the European Union. A series of standards on electronic signatures and relevant trust services have been put in place, to meet the international requirements and the eIDAS[4]. The ETSI/CEN standards of digital signatures related to QTSP are as follows[5]: 1. Provision of qualified certificates for electronic signatures (Article 28 of the eIDAS)   ETSI EN 319 411-2 (and in adherence to EN 319 401, EN 319 411-1, EN 319 412-2 and EN 319 412-5). 2. Provision of qualified certificates for electronic seals (Article 38 of the eIDAS)   ETSI EN 319 411-2 (and in adherence to EN 319 401, EN 319 411-1, EN 319 412-3 and EN 319 412-5). 3. Provision of qualified certificates for website authentication (Article 45 of the eIDAS)   ETSI EN 319 411-2 (and in adherence to EN 319 401, EN 319 411-1, EN 319 412-4 and EN 319 412-5). 4. Qualified electronic time stamping service (Article 42 of the eIDAS)   ETSI EN 319 421 (and in adherence to EN 319 401), EN 319 422. 5. Qualified validation service for qualified electronic signatures (Article 33 of the eIDAS)   ETSI TS 119 441 (and in adherence to EN 319 401), TS 119 442, EN 319 102-1, TS 119 102-2 and TS 119 172-4. 6. Qualified validation service for qualified electronic seals (Article 40 of the eIDAS)   ETSI TS 119 441 (and in adherence to EN 319 401), TS 119 442, EN 319 102-1, TS 119 102-2 and TS 119 172-4. 7. Qualified preservation service for qualified electronic signatures (Article 34 of the eIDAS)   ETSI EN 319 401, TS 119 511 and TS 119 512. 8. Qualified preservation service for qualified electronic seals; (Article 40 of the eIDAS)   ETSI EN 319 401, TS 119 511 and TS 119 512. 9. Qualified electronic registered delivery service (Article 44 of the eIDAS)   ETSI EN 319 401, EN 319 521, EN 319 522, EN 319 531 and EN 319 532. III. Comment and Analysis   The ENISA recommendations demonstrate the European Union’s intention to encourage ICT service providers to become QTSPs by introducing relevant standards in electronic signatures formulated by the European Union standardization bodies. The purpose is to provide companies and users in the European Union with more secure and trustworthy services in relation to electronic signatures. This enhances the confidence of users and promotes the vibrant development of electronic transactions throughout the European Union.   Over recent years, Taiwanese companies have been proactively involved in digital transformation. The process toward digitalization often requires assistance from external ICT service providers. However, the unfamiliarity in ICT makes it difficult for companies to judge the professional expertise of providers. Perhaps companies can refer to the introduction above to understand whether a provider meets the requirements of the European Union standards. This serves as a basis for the selection of ICT service providers to ensure a certain level of competences. This will be beneficial to the digital transformation and entrance in the European Union market for companies. [1] Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2014.257.01.0073.01.ENG (last visited Jun. 24, 2022). [2] European Union Agency for Cybersecurity [ENISA], Recommendations for Qualified Trust Service Providers based on Standards (2021), https://www.enisa.europa.eu/publications/reccomendations-for-qtsps-based-on-standards (last visited Jun. 24, 2022). [3] id. at 8 [4] id. at 8-9. [5] id. at 11-12

From the Expansion of WAGRI, Japan's Agricultural Data Collaboration Platform, into a Smart Food Chain to Discuss Smart Measures in Responding to the Pandemic

From the Expansion of WAGRI, Japan's Agricultural Data Collaboration Platform, into a Smart Food Chain to Discuss Smart Measures in Responding to the Pandemic Yu Yu Liu I. Introduction   For the past few years, Taiwan has been progressively developing smart agriculture. During this process, general agricultural enterprises and farmers are challenged with and discouraged by expensive equipment installations and maintenance costs. The creation of a new business model which facilitates the circulation and application of agricultural data may lower the threshold of intellectualization acquisition, and become the key to the popularization and implementation of smart agriculture. This article shall analyze the strategy of promoting the use of data circulation for smart agriculture in Japan, which has a similar agricultural paradigm as Taiwan, and provide a reference for the development of smart agriculture in Taiwan.   Japan is facing the same problems as Taiwan, in terms of the aging farmers and low birth rates, that lead to the lack of successors. The Japanese government proposed the concept of Society 5.0 in 2016, expecting to use information and communication technology (ICT) to drive the development of various fields of society[1]. In the agricultural field, the use of ICT in agriculture can facilitate the transmission of experience by turning the tacit knowledge of experienced farmers into externalized data.   At that time, there were many ICT system service technologies developed by private companies In Japan, but the system services provided by various companies were not compatible with each other due to the lack of collaboration, and the data formats and standards produced by ICT system providers were varied; furthermore, the data in the public sector (research and administrative agencies) was also divided and managed independently. To facilitate the integration, management, and circulation of agricultural data, the Japanese Agricultural Data Collaboration Platform (WAGRI[2]) was born. II. The Development of WAGRI 1. Japan's Prime Minister directed the construction of a data platform   The Japanese government held the 6th Future Investment Conference[3] on March 24, 2017, chaired by Prime Minister Shinzo Abe, who mentioned that in order to cultivate safe and tasty crops, the government and the private sector should provide each other with updated information on crop growth conditions, climate, maps, etc., and build an information collaboration platform that can be easily used by anyone by mid-2017, with all the necessary data fully disclosed. The project was handed over to the IT General Strategy Headquarters[4] to realize the above-mentioned platform.   At the 10th Future Investment Conference, held on June 9, 2017, the Future Investment Strategy 2017[5] was announced with the goal of realizing "Society 5.0". During the conference, it was mentioned that the "Japanese Agricultural Data Collaboration Platform (hereinafter referred to as WAGRI), which is based on publicly available information from the agriculture, forestry, and water industries, such as agricultural, topographical, and meteorological data held by the public sector, that can be shared and used for a variety of purposes, would be constructed in 2017. 2. The Trial Run of WAGRI   WAGRI is supported by the Cabinet Office's Phase 1 of the Strategic Innovation Promotion Program (SIP), under one of the 11 projects entitled "Next Generation Innovation Technologies for Agriculture, Forestry and Water Industries"17[6] (which is managed by The National Agriculture and Food Research Organization [NARO]17[7]). The platform was constructed by the SFC Research Institute of Keio University17[8] in collaboration with an alliance of 23 organizations that participate in SIP research, including agricultural production corporations, agricultural machinery manufacturers, ICT providers, universities, and research institutions (e.g., Japanese IT companies NTT - Nippon Telegraph and Telephone Corporation, Fujitsu Limited, major agricultural machinery manufacturer- Kubota Corporation, Yanmar Holdings Co., Ltd.)17[9]. WAGRI has three major functions: "cooperation" (breaking down the barriers between different systems so that data is compatible and interchangeable), "sharing" (data is shared in a way chosen by the providers, so as to facilitate the establishment of a business model for data exchange and use), and "provision" (soil and meteorological data are provided by public and private sectors to help facilitate data acquisition and subsequent circulation). During the trial run, there were practical cases that demonstrated that after the implementation of WAGRI, the costs of labor and time spent on data collection and utilization had been significantly reduced17[10]. 3. The Independent Operation of WAGRI   In April 2019, WAGRI, which was originally supported by the SIP program, was transferred to NARO to be the main operating body and officially start the operation.   With the updated use of the information required to operate the WAGRI platform independently, starting in April 2020, the original no-fee approach has been changed. Organizations wishing to use WAGRI are required to pay variable fees according to the following two methods of using the platform [11]: (1)Data users (those who use WAGRI data), data users-and-providers (those who use WAGRI data and provide data to WAGRI) ·Monthly fee of 50,000 yen for platform use. ·If fee-based data is accessed, a separate data usage fee must be paid. (2)Data providers (those who provide data to WAGRI) ·Monthly fee of 30,000 yen for platform use. ·Proviso: If the data provided is free of charge, in principle, there is no requirement to pay the platform utilization fee. III. Application of WAGRI’s Expansion in Response to the Pandemic   The Smart Food Chain Alliance[13], which is supported by one of the 12 projects of the SIP Phase 2 program - "Smart bio industry / basic agricultural technology[12]", will expand WAGRI, which was established with the support of the SIP Phase 1 program, to build a smart food chain platform (WAGRI-dev for short).The main mission of the Smart Food Chain Alliance is to build a smart food chain (commercialized services are expected to begin in 2025) that enables the interoperability of data related to food processing, distribution, sales, and exports, to serve as a basis for fresh food logistics in Japan. This platform is built on the framework of WAGRI, and expanded to WAGRI-dev.   In response to the pandemic, the Food and Agriculture Organization of the United Nations (FAO) and the World Health Organization (WHO) jointly issued the "Interim guidance for COVID-19 and Food Safety for competent authorities responsible for national food safety control systems[14]" on April 7, 2020. Based on these guidelines, the Smart Food Chain Alliance of the Japanese SIP program "Smart bio industry / basic agricultural technology" has developed "Guidelines for the Novel Coronavirus (COVID-19) Countermeasures". As part of the above-mentioned program, the "Japanese Food Guidelines Collaboration System (WAGRI.info, in short)"[15] developed countermeasure applications to respond to the pandemic.   WAGRI.info opened its website on July 13, 2020 to accept food safety registrations from food and agricultural product related companies. This registration is not limited to those who meet the COVID-19 countermeasure guidelines, but also those who meet the existing quality and safety management guidelines (e.g. Hazard Analysis and Critical Control Points (HACCP), etc.). It also provides a corporate search function for general public use.   WAGRI.info is a part of WAGRI-dev, and will add various data collaboration functions and measures in the future to prevent data manipulation and unauthorized access. The Japanese government originally expected to build the world's first smart food chain platform that includes data from production to processing, distribution, sales and exporting by expanding WAGRI; in response to the pandemic, related functions were added to create a food safety information network.   In Taiwan, there are also data platforms related to smart agriculture that provide OPEN DATA interface functions[16], and the development of food safety traceability integrated application systems to provide information on the flow of school lunch ingredients. In addition to Japan's WAGRI model of data integration and sharing that, can be used as a model for the development of smart agriculture in Taiwan, WAGRI.info's approach can also be used as a reference for domestic food safety policies, in response to the pandemic. [1]"The Science and Technology Basic Plan", Cabinet Office of Government of Japan website: https://www8.cao.go.jp/cstp/kihonkeikaku/index5.html (last viewed on 07/12/2021). [2]WAGRI is a data platform that consists of a variety of data and services connected to form a wheel that coordinates various communities and promotes "harmony", with the anticipation of leading innovation in the field of agriculture. The word is formed by the combination of WA + AGRI (WA is the Japanese word for harmony + AGRI for agriculture). WAGRI website, https://wagri.net/ja-jp/ (last visited on 07/12/2021). [3]As the command headquarters of the Japanese government for implementing economic policies and realizing growth strategies, the Headquarters for Japan’s Economic Revitalization has been holding a "Future Investment Conference" session approximately every month since 2016, to discuss growth strategies and accelerate social structural reforms, so as to expand future investment. "Headquarters for Japan’s Economic Revitalization", Prime Minister of Japan and His Cabinet website, http://www.kantei.go.jp/jp/singi/keizaisaisei/ (last visited on 07/12/2021). [4]The Japanese government has been actively promoting the use of IT as a means of helping to solve social issues in various fields. In 2000, the IT Basic Act (Basic Act on the Formation of an Advanced Information and Telecommunications Network Society) was enacted in Japan, and in the following year, the IT Strategy Headquarters (Strategic Headquarters for the Promotion of an Advanced Information and Telecommunications Network Society) was established in accordance with the said laws. In 2013, in accordance with the Government Chief Information Officer (CIO) Act, the Cabinet Secretariat established the position of Deputy Chief Cabinet Secretary for Information Technology Policy (Government CIO, in short), and IT Strategic Headquarters was integrated with the GCIO to be the IT Comprehensive Strategy Headquarters (Strategic Headquarters for the Promotion of an Advanced Information and Telecommunications Network Society, IT Comprehensive Strategy Headquarters) to rapidly promote the key policies for an advanced telecommunications network society, and to break the vertical gap of the ministries and departments, and to connect the entire government horizontally. "Strategic Headquarters for the Promotion of an Advanced Information and Telecommunications Network Society" (IT Comprehensive Strategy Headquarters), Prime Minister of Japan and His Cabinet website, https://www.kantei.go.jp/jp/singi/it2/ (last visited on 07/12/2021). [5]Hsu, Yu-Ning, "The 10th Future Investment Conference, held at the Prime Minister's Residence of Japan, proposing Japan's "Future Investment Strategy 2017”, to realize "Society 5.0" as its goal", Science & Technology Law Institute website, https://stli.iii.org.tw/article-detail.aspx?no=64&tp=1&i=72&d=7844, (last visited on 07/12/2021). [6]Focusing on the important issues of "Society 5.0" in conjunction with the key areas of governance of the Future Investment Conference, the Cabinet Office set up an annual budget for science and technology to help create and promote the "Strategic Innovation Promotion Program (SIP)". The first phase of the SIP is a five-year program running from FY2014 to FY2018. "Strategic Innovation Promotion Program (SIP)", Cabinet Office website, https://www8.cao.go.jp/cstp/gaiyo/sip/index.html (last visited on 07/12/2021). Qiu, Jin-Tien (2017), "Technology Innovation Strategy for Realizing the Super Smart Society (Society 5.0) in Japan", National Applied Research Laboratories website, https://portal.stpi.narl.org.tw/index/article/10358 (last visited on 07/12/2021) [7]The National Agriculture and Food Research Organization, NARO in short, is a national research and development corporation for agricultural and food industry technology. [8]The SFC Research Institute, located on the Shonan-Fujisawa campus of Keio University, is a research institute affiliated with the Graduate School of Policy and Media Studies, the Department of General Policy, and the Department of Environmental Intelligence, and is an important research institute involved in the development of smart agriculture in Japan. Professor Atsushi Shinjo is the research director of WAGRI, and he is also the Deputy Government CIO of the Cabinet Secretariat and the Acting Director of the IT Strategy Office, contributing to the creation of the "Agricultural Information Creation and Distribution Promotion Strategy". He also serves as the President of the WAGRI Council and the Director of NARO's Agricultural Data Collaboration, and facilitates the coordination between WAGRI and Japan's smart agriculture empirical Project. He is a key player in the Japanese government's efforts to promote the flow of agricultural data, and is committed to promoting the development of smart agriculture in Japan. Keio Research Institute at SFC website, https://www.kri.sfc.keio.ac.jp/ (last visited on 07/12/2021). [9]IoTNEWS, Building an ‘Agricultural Data Collaboration Platform’ Using Microsoft Azure Through Industry-government-academia Collaboration to Realize Digital Agriculture" 05/15/2017, https://iotnews.jp/archives/56366 (last visited on 07/12/2021). [10]Shinjo, Atsushi, "ICT changes society: Development of agricultural data collaboration platform and future plans, Technology and Promotion : Journal of the National Council of Agricultural Promotion and Staff Council Organization, December, pp. 24-26 (2017); Technology Policy Office, Ministry of Agriculture, Forestry and Fisheries, "Construction of agricultural data collaboration platform", 2018/09,http://www.affrc.maff.go.jp/docs/smart_agri_pro/attach/pdf/smart_agri_pro-15.pdf .(last visited on 07/12/2021). [11]"The Use of the Agricultural Data Collaboration Platform (WAGRI) Since FY2019", NARO website https://www.naro.go.jp/project/results/juten_fukyu/2018/juten01.html (last visited on 07/12/2021). , NARO website https://www.naro.affrc.go.jp/laboratory/rcait/wagri (last visited on 07/12/2021). [12]Same as Note 6; The SIP Phase 2 plan runs for a total of approximately five years, from the end of FY2017 to FY2022. [13]The construction of a smart food chain is one of the main research topics of the project. The members of the Smart Food Chain Alliance include: the Cabinet Secretariat, the Cabinet Office, the Ministry of Agriculture, Forestry and Fisheries, and other government organizations as observers, and more than 70 organizations as participants, including local governments, academic and research institutions, agricultural production corporations, wholesale markets, mid-marketers, logistics industries, retail businesses, manufacturers, and ICT providers (The representative of the Alliance is the Keio Research Institute at SFC), reference Note 13. SIP vol. 2, [Symposium on "Smart Bio-industry and Agricultural Technology" 2020 - Aiming to build a new smart food chain] 03/10/2020, WAGRI website, https://wagri.net/ja-jp/News/generalnews/2020/20200310 (last visited on 07/12/2021). [14]See FOOD AND AGRICULTURE ORGANIZASTION OF THE UNITED NATIONS [FAO], COVID-19 and Food Safety: Guidance for Food Businesses: Interim guidance (Apr. 7, 2020), http://www.fao.org/family-farming/detail/en/c/1275311/ (last visited Oct. 8, 2020). Food and Agriculture Organization of the United Nations and World Health Organization jointly issued Interim guidance for COVID-19 and Food Safety for competent authorities responsible for national food safety control systems, Chinese Academy of Inspection and Quarantine, http://www.caiq.org.cn/kydt/902625.shtml (last visited 07/12/2021). [15]WAGRI.info Office, "WAGRI.info (Food Guideline Collaboration System) website launched and began accepting business registration", 07/13/2020, https://kyodonewsprwire.jp/release/202007131927 (last visited on 07/12/2021). Japanese Food Guideline Collaboration System WAGRI.info website, https://www.wagri.info/ (last visited on 07/12/2021). [16]Smart Agriculture Common Information Platform Website, https://agriinfo.tari.gov.tw/ (last visited 07/12/2021); "Smart Agriculture 4.0 Common Information Platform Construction (Phase II) Results Presentation", 12/12/2019, Smart Agriculture Website, https://www.intelligentagri.com.tw/xmdoc/cont?xsmsid=0J141518566276623429&sid=0J338358950611186512, (last visited on 07/12/2021).

An Introduction to Taiwan’s Regulations Regarding the Security Maintenance and Administration of Personal Information Files in in Digital Economy Industries

An Introduction to Taiwan’s Regulations Regarding the Security Maintenance and Administration of Personal Information Files in in Digital Economy Industries 2023/11/29 I. Preface The Personal Data Protection Act (below, the “Act”), Article 27, paragraph 3 authorizes all central government authorities in charge of specific industries to formulate regulations regarding security standards and maintenance plans for their concerned industries. Beginning August 27, 2022, Taiwan transferred authority over information services, software publishers, businesses that do retail sales of goods purely via the Internet, third-party payment providers, and other businesses in digital economy industries from the Ministry of Economic Affairs to the newly-established Ministry of Digital Affairs (MODA). Businesses in the digital economy industries collect, process, and use large amounts of important personal data, and therefore bear a relatively heavy responsibility for maintaining the security of personal data. In light of this, and in accordance with the Act, Article 27, paragraph 3, the MODA therefore promulgated the Regulations Regarding the Security Maintenance and Administration of Personal Information Files in in Digital Economy Industries (below, the “Regulations”) on October 12, 2023. These Regulations specify the standards for digital economy industries’ personal data file security maintenance plans and rules governing the handling of personal data following a business termination (below, “security and maintenance plans”, or “SMPs”). These regulations apply to all businesses in the digital economy industries. In order to reinforce responsibility for personal data security maintenance in the digital economy industries, tiered management is applied to businesses at different scales. The key points of these Regulations are introduced below. II. Where the Regulations apply As stipulated in the Regulations, Article 2, the “digital economy industries” that these Regulations apply to refer to any natural person, private juridical person, or other group, that engages in any of the following business operations: 4871 Retail Sale via Internet (industries that engage in retail sales to others via the Internet, but not including television, radio, phone, or other electronic means, nor postal sales); 582 Software Publishing; 620 Computer Programming, Consultancy and Related Activities; 6312 Data Processing, Hosting and Related Activities (industries that engage in processing customers’ data, server & website hosting, and other related services, but not including online audio/video streaming services); 639 Other Information Service Activities; or 6699 Other Activities Auxiliary to Financial Service Activities Not Elsewhere Classified (third-party payment industries, but not including other fund management activities). For the specific industries covered, see Attachment 1 of the Regulations. III. Security maintenance and management measures The relevant measures are stipulated in Articles 3 to 17 of the Regulations. In consideration that the businesses so regulated may collect, process, or use large amounts of personal data as part of their business activities, they bear a larger responsibility for maintaining the security of personal data than does the average enterprise. In compliance with the Regulations, every such enterprise is required to formulate an SMP, the content of which shall comply with the specifications in Articles 5 to 17. This includes putting in place management personnel and relevant resources; defining and inventorying the scope of personal data; risk assessment; putting internal management procedures in place; and other such matters. These Regulations also adopt tiered management for businesses based on their capital levels, in order to reinforcement the frequency at which security maintenance measures are performed. The specific regulations for security maintenance measures are introduced below. 1. Formulating an SMP In accordance with the Regulations, Article 3, and in order to maintain the security of personal data, each enterprise shall, within three months of the date the Regulations take effect, plan and formulate their SMP. Every enterprise shall also cause all staff members to understand and fully implement the SMP. In order to monitor implementation, the MODA may require that each enterprise submit its implementation of SMP; the enterprise shall then submit their implementation status information in written form within the specified time limit. 2. Making the protection policy known internally In accordance with the Regulations, Article 4, and to make sure that everyone in the enterprise comprehends and implements personal data protection, each enterprise shall make its personal data protection policies known to all personnel within the enterprise. Matters that must be explained include Taiwan’s legal regulations and orders on personal data protection; how personal data may only be collected, processed, and used for specific purposes and in a reasonable, secure way; that protective technology must be at a level of security that could be reasonably expected; points of contact for rights relating to personal data; personal data contingency plans; and proper monitoring of outsourced service providers to whom personal data is outsourced. All of this must be done to make sure that every enterprise carries out their duty for comprehensive, continuous SMP implementation. 3. SMP content (1) Putting in place management personnel with relevant resources In accordance with the Regulations, Article 5; in accordance with both the Regulations as a whole and other laws and orders regarding the protection of personal data; and in order to implement personal data protection, each enterprise shall do the following things: Weigh the size and characteristics of their business to reasonably allocate operating resources; take responsibility for the personal data protection and management policy; and formulate, revise, and implement their SMP. Also, the enterprise’s representative or the representative’s authorized personnel shall carry out formulation and revision, in order to make sure that the SMP’s content is fully carried out. (2) Establishing the scope of personal data In accordance with the Regulations, Article 6, in order to define the scope of personal data to be included in the SMP, each enterprise shall periodically check the status of personal data that is collected, processed, or used. (3) Risk assessment and management mechanisms for personal data In accordance with the Regulations, Article 7, in a timely manner, and in accordance with their already-established personal data scopes and the processes in which their business involves the collection, processing, or use of personal data, each enterprise shall evaluate risks that may arise within their scope and processes. Based on the risk evaluation results, each enterprise shall then adopt appropriate security management and response measures. (4) Incident prevention, reporting, and response mechanisms In accordance with the Regulations, Article 8, and in order to reduce/control damages to data subjects resulting from personal data theft, tampering, damage, destruction, leakage, or other such security incidents, each enterprise shall formulate response, reporting, and prevention mechanisms: 1. Response mechanism: Methods to be followed after a security incident has occurred, to reduce/control damages to data subjects, and appropriate ways to notify data subjects after an incident investigation, as well as what such notifications shall contain. 2. Notification mechanism: Post-incident notifications to data subjects, in a form (such as email, text message, phone call, etc.) that makes it convenient for such subjects to learn what has occurred and what the incident handling status is; also, providing data subjects with a hotline or other way of seeking information later on. 3. Prevention mechanism: A post-incident mechanism for discussing and adjusting the prevention measures. Within 72 hours after an enterprise learns that a personal data security incident has occurred, the enterprise shall use Attachment 2, the Enterprise Personal Data Leak Reporting Form, to notify the MODA of matters such as: A description of what caused the incident; an incident summary; the damage status; possible results from the personal data leakage; proposed response measures; proposed method and time for notifying data subjects; etc. Alternately, the enterprise may notify the special municipality or county/city government to then notify the MODA. If the enterprise is unable to report the incident within the time limit or is unable to supply complete reporting information all at once, the enterprise shall attach explanation of the reasons for the delay, or provide the information in stages. After the MODA or the special municipality or county/city government receives a report, they may implement reasonable handling in accordance with Articles 22 to 25 of the Act. (5) Internal management procedures for personal data collection, processing, and usage In accordance with the Regulations, Article 9, in order to ensure that their collection, processing, and use of personal data complies with the laws and orders regarding the protection of personal data, each enterprise shall do the following: Formulate internal management procedures; assess whether the use, processing, or collection of special categories of personal data are involved; assess data subjects’ consent has been obtained; assess whether the legal circumstances create an exemption from the obligation to inform; etc. The internal management measures shall also include providing data subjects with information on their rights in accordance with the Act, Article 3; putting in place mechanisms for ensuring the accuracy of and inquiring regarding personal data; and periodically reviewing whether the specific purposes for collecting personal data still exist or have expired. (6) Limits, notifications, and monitoring for international transfers In accordance with Article 10 of the Regulations and Article 21 of the Act, when an enterprise’s transfer of personal data across a national border affects data subjects to the extent that there is a major national interests concern, the enterprise shall assess whether MODA restrictions apply to the transfer. The enterprise shall also notify the data subjects of the region(s) that the data is transferred to; perform appropriate monitoring of the data recipient; and provide the data subjects with information on their rights in accordance with the Act, Article 3. (7) Data, personnel, and equipment security management measures 1. Data security management measures: In accordance with the Regulations, Article 11, and when personal data is backup, kept confidential, or transferred by various means based on the risk assessment results, each enterprise shall put in place protective measures against abnormal access behaviors. When an enterprise provides information/communication technology services, the enterprise shall also put in place and regularly monitor intrusion countermeasures, abnormal access monitoring and contingencies, anti-malware mechanisms, account password verification, system testing, and other such data security management measures. 2. Personnel security management measures: In accordance with the Regulations, Article 12, each enterprise shall contractually specify the obligation to maintain confidentiality with all staff members; identify personnel who job duties involve collecting, processing, or using personal data; and periodically assess the appropriateness and necessity of personnel’s permissions to access personal data. 3. Equipment security management measures: In accordance with the Regulations, Article 14, and to prevent personal data being stolen, tampered with, damaged, destroyed, or leaked, each enterprise shall put in place appropriate media protection for personal data storage devices. The protection requirements include management measures such as technology, equipment and secured environments that meet a specific level of security. (8) Education and training In accordance with the Regulations, Article 13, each enterprise shall periodically use education and training to ensure that all staff members understand the following things: The laws and regulations pertaining to personal data protection; their personal duties and roles within their scopes of responsibility; and the requirements for all SMP management procedures, mechanisms, and measures. For any enterprise that engages in retail sales via the Internet, their SMP shall include user training and education regarding personal data protection and management; and the enterprise shall also formulate personal data protection rules for compliance. (9) Continuous audit, recording, and improvement mechanisms 1. Data security auditing mechanisms: In accordance with the Regulations, Article 15, each enterprise shall periodically do internal audits of personal data, then put the audit results into an evaluation report that reviews improvements to the enterprise’s protection policy, SMP, etc. If there are any deficiencies, the enterprise shall make corrections. 2. Use of records, tracking data, and retention of evidence: In accordance with the Regulations, Article 16, and as part of carrying out its SMP, each enterprise shall retain a minimum of five years of records on the collection, processing, and use of personal data; tracking data for automated machinery; and evidence of having implemented the SMP. After an enterprise’s operations cease, it shall retain records of the destruction, transfer, or other deletion of personal data for a minimum of five years. 3. Comprehensive, continuous improvement for personal data security maintenance: In accordance with the Regulations, Article 17, any time an enterprise’s SMP is not implemented, the enterprise shall adopt corrective and preventive measures. Also, based on the SMP’s implementation status, its handling methods/implementation status, developments in data technology, adjustments to the enterprise’s business, and changes in the law and regulations, each enterprise shall periodically review and amend its SMP. 4. Tiered management In accordance with the Regulations, Article 18, and to prevent relatively small businesses having to take on excessive personal data management costs, tiered management is applied. For an enterprise with a specific business scale (having capital of NT$10 million or more, or holding 5,000 or more personal data records), stronger security measure implementation is required, namely, the personal data security measures shall be implemented, reviewed, and improved at least once every twelve months. If an enterprise reaches NT$10 million or more in capital after the Regulations take effect, or if an enterprise’s number of personal data records held reaches 5,000 or more as a result of direct or indirect data collection, then within six months of meeting those conditions, the enterprise shall implement and review the improvement measures at least once every twelve months. 5. Outsourced personal data Commercial outsourcing in the digital economy comes in many forms. In light of this, and in order to make clear each enterprise’s security management obligations with regard to the collection, processing, and use of personal data, Article 19 of the Regulations clearly spells out what duties shall be carried out with regard to any outsourcing that touches on personal data. When an enterprise outsources the collection, processing, or use of personal data, it is considered equivalent to the enterprise’s own activity. Thus, the enterprise shall understand and follow the legal orders and regulations on personal data set by the central government authorities in charge of the outsourcing party’s industries. Any oversight responsibilities arising from outsourcing the collection, processing, or use of others’ personal data shall be clearly stipulated in the outsourcing contract or other such documents. IV. Conclusion The Regulations Regarding the Security Maintenance and Administration of Personal Information Files in in Digital Economy Industries are designed to balance development for Taiwan’s digital economy industries with comprehensive, continuous improvement of personal data security maintenance. In pursuit of those goals, the Regulations clarify what each enterprise must do: Plan, formulate, and carry out security maintenance plans for personal data that falls within the bounds of the enterprise’s business; ensure that all staff members receive training on personal data protection; provide personal data subjects with channels to file complaints and seek consultation on their rights; and inform the government authorities in charge of the digital economy about the enterprise’s SMP, including the status of any personal data security incidents. All this is done in hopes that the security measures will continuously improve the security of personal data in Taiwan’s digital economy industries.

TOP