> Information and Communication Law
Back
Previous Introduction to the compulsory licensing mechanism of US music copyrights Next The Coverage and Policies of Critical Infrastructure Protection in U.S.

Introduction to Critical Infrastructure Protection

The security facet of cyberspace along with a world filled with CPU-controlled household and everyday items can be examined from various angles. The concept of security also varies in accordance with different stages of national conditions and industrial development in different nations. As far as our nation is concerned, the definition of security industry is "an industry offering protection for human bodies, important infrastructure, information, financial system, as well as offering equipment to defend the security of national lands and the service"1 as initially defined by "Security Industry Program Office." Judging from the illustration of the definition, the security industry should be inter-disciplinary and integrative, which covers almost all walks of life and fields, such as high-tech industrial security management, traffic & transportation security management, fire control and prevention against natural calamities, disaster relief, information security management, security management in defense of national borders, and prevention of epidemics.

After the staged mission, "e-Taiwan program", was accomplished in 2007, our government hoped to construct a good surrounding by creating a comfortable life from a user’s point-of-view. This was hoped to be achieved by using "the development of a high-quality internet society" as a main source by using innovative services, internet convergence, perceptive environment, security, trust, and human machine linkage. At the Economic Development Vision for 2015: First-Stage Three-Year Sprint Program (2007~2009) formulated by the Executive Yuan, wireless broadband, CPU computer-controlled items all have become part of our every day lives, and healthcare, along with the green industry are listed as the next emerging industries; whereby the development of relevant critical technologies is hoped to be promoted to create higher industrial values and commercial opportunities. However, from a digitally-controlled-life viewpoint, the issue concerned by all walks of life is no longer confined to the convenience and security of personal life but gradually turns to protection of security of a critical infrastructure (CI) run by using information technology. For instance, finance management, stock market, communication network, harbors and airports, high speed rail, R&D of important technology, science parks, water purification facilities, water supply facilities, power, and energy facilities. 2Because security involves resources related with people's most fundamental living needs and is the most elementary economic activity of the society, it is regarded as an important core objective to promote the modern social security system. Therefore, critical infrastructure protection requires more dependence on information and communication technology to maintain the stability of finance and communication, as well as the security of facilities related with supply and economy of all sorts of livelihoods in order to ensure regular operation.

With the influence of information and communication technology on the application of critical infrastructure on the increase, the society has increasingly deepened its dependence on the security of our cyber world. The concept and connotation of information security also keep extending with it toward the aforementioned critical infrastructure protection planning, making critical information infrastructure protection (CIIP) and critical infrastructure protection (CIP) more inseparable in concept3 , and becomes an important goal of policy implementation to achieve the vision of a digital lifestyle which is secure for every nation. In recent years, considerable resources have been invested to complete an environment whereby a legal system of “smart lifestyle” is developed. However, what has been done for infrastructure protection continues to appear as not being comprehensive enough. This includes vague definitions, scattered regulations and policies, different protection measures taken by different authorities in charge, obvious differences in relevant risk management measures and in the magnitude of management planning of information security and so on. These problems all influence the formation of national policies and are the obstacles to the promotion of relevant industrial development. In view of this, the 2008/2009 International CIIP Handbook will be used as the cornerstone of research in this project. After the discussion on how critical infrastructure protection is done in America, Germany and Japan, the contents of norms of regulations and policies regarding critical infrastructure protection in our nation will be explored to make an in-depth analysis on the advantages and disadvantages of relevant norms. It is hoped to find out what is missing or omitted in the regulations and policies of our nation and to make relevant amendments. Suggestions will also be proposed so that the construction of a safe environment whereby the digital age of our nation can be expanded to assist the “smart lifestyle” to be developed further.

1.See http://tsii.org.tw/modules/tinyd0/index.php?id=14 (last visited May 24, 2009)
2.For "2008 International Conference on Homeland Security and Application of Technology in Taiwan ~ Critical Infrastructure Protection~", please visit http://www.tier.org.tw/cooperation/20081210.asp (last visit date: 05/17/2009).
3.For critical infrastructure protection, every nation has not only proceeded planning for physical facilities but put even more emphasis on protection jobs of critical information & communication infrastructure maintained via the information & communication technology. In the usage of relevant technical terms, the term "critical infrastructure" has also gradually been used to include the term "critical information & communication infrastructure". Elgin M. Brunner, Manuel Suter, Andreas Wenger, Victor Mauer, Myriam Dunn Cavelty, International CIIP Handbook 2008/2009, Center for Security Studies, ETH Zurich, 2008. 09, p. 37.

※Introduction to Critical Infrastructure Protection,STLI, https://stli.iii.org.tw/en/article-detail.aspx?no=55&tp=2&i=169&d=6127 (Date:2026/01/16)
Quote this paper
Release： 2013/04
Tag
Read with phone
Back
Previous Introduction to the compulsory licensing mechanism of US music copyrights Next The Coverage and Policies of Critical Infrastructure Protection in U.S.
You may be interested
The approaches to promote critical infrastructure protection in Japan

The approaches to promote critical infrastructure protection in Japan are illustrated below: 1. Coverage of Critical Information Infrastructure In the "Action Plan on Information Security Measures for Critical Infrastructure" promulgated by the Information Security Policy Council (ISPC) in 2005, critical infrastructure is defined as: Critical infrastructure which offers the highly irreplaceable service in a commercial way is necessary for people's normal lives and economic activities, and if the service is discontinued or the supply is deficient or not available, it will seriously influence people's lives and economic activities. Based on the definition of the action plan, the critical infrastructure contains: telecommunication systems, administration services of the government, finance, civil aviation, railway, logistics, power, gas, water, and medical services 2. Promoted Relevant Policies of The Past The issues regarding the CIIP are gradually being developed with the norm of information social security policy in Japan. Adopting the Action Plan of the Basic Guidelines Toward the Promotion of an Advanced Information and Telecommunications Society of 1998 proposed by the Japanese government in 1998 as a basis. The Japanese government keeps presenting polices of improvement for the relevant issues in order to acquire the stable development of telematics and telecommunications. Several years later, the Ministry of Economy, Trade, and Industry (METI) announced the Comprehensive Strategy on Information Security in 2003. The formulation of the strategy not only emphasizes the possible telematics-related risks and protection against threats that may be encountered in the information society, but it also enhances the level of information security to the level of national security and presents a comprehensive information security improvement program. Furthermore, the submission of the strategy has identified government’s responsibility in the development of information security Therefore, a division which is solely responsible for information security was established in the Cabinet Secretariat and is devoted to the development of it. In 2005, the Ministry of Economy, Trade, and Industry (METI) amended the Comprehensive Strategy on Information Security and announced the First National Strategy on Information Security based on the creation of a policy of a long-term information security task in Japan which is also the foundation for the policy of guidelines and action security concerning critical information infrastructure. This is in addition to being the most important basis for the policy of information security development. The strategy is different from the Comprehensive Strategy on Information Security in connotation. In the range of information security protection, it not only maintains information security from the perspective of the government; for instance, to divide the rights and duties on information security protection practices between the central government and the local government, and to strengthen the capacity of the government to solve emergencies such as cyber attacks, but it also tries to employ the public-private partnership on the CIIP issue to construct an extensive information security protection and to develop a Capability for Engineering of Protection, Technical Operation, Analysis and Response (CEPTOAR): one similar to the ISAC of America, to strengthen the information sharing and analysis of information security of all industry involved. According to the strategy, the METI established the Information Security Policy Council (ISPC) and the National Information Security Center (NISC) under the subordination of the Cabinet Secretariat in order to reach a goal of dependable society of information security.1 Finally, the information security policies more directly related with the CIIP are the Action Plan on Information Security Measures for Critical Infrastructure and the Standards for Information Security Measures for the Central Government Computer Systems, both of which regulate CI-related threats, information security standards, public-private partnership information sharing system, and the levels of information security standards between different governments and critical infrastructures, respectively. 3. Oraganization Framework Generally speaking, the Cabinet Secretariat is the main division of the CIIP and the information security for the Japanese government, while the ISPC and the NISC established under the Cabinet Secretariat in 2005 are the core organizations for the development of the CIIP policy. In addition, the National Policy Agency (NPA) and the Ministry of Internal Affairs and Communications (MIC) also played an important role in assisting the Cabinet Secretariat with critical infrastructure protection. The part of public-private partnership is covered by the CEPTOAR which takes the responsibility for information sharing and analysis of information security between the government and private organizations. 4. Notification System For critical infrastructure protection, Japan has set up a warning and notification system in addition to the emphasis on fundamental information security protection. With the concept of public-private partnership, various messages related with information security are analyzed and shared in order to prevent information security incidents from occurring. The network of notification system in Japan mainly consists of several organizations as listed below. (1) National Incident Response Team The National Incident Response Team (NIRT) which is the information security office under the Cabinet Secretariat in the organization framework belongs to the Computer Emergency Response Team (CERT)2 and is first in line in the government to handle internet emergencies. According to the Action Plan for Ensuring e-Government's IT Security, the NIRT which consists of 17 experts from the government and the private organizations is responsible to (1) accurately understand and analyze emergencies, (2) develop technical strategies to solve and rehabilitate emergencies to prevent incidents from reoccurrence, (3) provide other governmental organizations the assistance to solve the information security issue, (4) collect and analyze information or intelligence so that effective solutions and strategies may be provided when an incident happens, (5) provide the governmental organization with professional knowledge and information, and (6) enhance and improve all knowledge pertinent to information security. The Japan Computer Emergency Response Team Coordination Center (JPCERT/cc) is the first Computer Security Incident Response Team (CSIRT) established in Japan. It consists of internet service suppliers, security products/service suppliers, governmental agencies, and associations of industry & commerce. The JPCERT/CC is also a member of the Asia Pacific Computer Emergency Response Team (APCERT) and a member of the Forum of Incident Response and Security Teams (FIRST). It coordinates and integrates prevention measures pertinent to information security and is consistent with other CSIRTs. (3) Telecom Information Sharing and Analysis Center In Japan, besides the mechanism responsible to notify the government, which functions as a bridge for communication between it and all those outside of it, the mechanism of information sharing and notification is also established among industries to provide each with a channel for information exchange and consultation. In 2001, Japan established the Telecom Information Sharing and Analysis Center Japan (Telecom-ISAC Japan). In addition to real-time inspection for computer intrusion incidents and conducting information collection and analysis, the Telecom-ISAC Japan proposes to e-government many suggestions related with the Transact-SQL issue as well. The reasons for launching the Telecom-ISAC are to instantaneously detect a computer intrusion incident, and to instantaneously gather and analyze its information, and then exchange this with other telecom carriers and offer them relevant countermeasures for precaution; so that in can reach the goal of ensuring telecom security since it is an important infrastructure concerning social economy. (4) Cyber Force The reasons for launching the Cyber Force are to maintain the security to use the internet by regularly "patrolling" it, searching for evidence of internet crime, and to notify the critical infrastructure operators about any unusual internet use so as to prevent the occurrence of cyber terror attacks. The Cyber Force also assists operators to solve and diminish the damage and influences when an incident occurs. (5) Portal Site of National Police Agency The National Police Agency owns the portal site "@police". It exists to prevent large-scale cyber emergencies and to provide gathered information concerning information security to government. In addition to providing the techniques related with the safe use of computer networks, @police is also dedicated to educating internet users about the concept of information security and to increase security awareness. (6) Ministry of Economy, Trade and Industry Since 1990, the Ministry of Economy, Trade and Industry (METI) has cooperated with the JPCERT/CC and the Information Technology Promotion Agency (IPA) to provide reports on virus, intrusion, and the damage caused by them, to remind the public to pay attention. 5. Legal Norms The laws regarding critical infrastructure protection in Japan are illustrated as follows: (1) Unauthorized Computer Access Law of 1999 The Unauthorized Computer Access Law includes various conducts such as cyber intrusion, and data thefts, into the norms of criminal punishment to deter cyber crimes from spreading in order to ensure the safety of the critical information infrastructure. (2) Act on Electronic Signatures and Certification Business of 2000 With the formulation of the Act on Electronic Signatures and Certification Business, the smooth promotion of the electronic signature system is ensured and the circulation and process of electronic communication can be fostered further. (3) Basic Law on Formation of an Advanced Information and Telecommunication Network Society of 2001 Through the formulation of the Basic Law on Formation of an Advanced Information and Telecommunication Network Society, the legal basis to execute an information technology policy is enhanced, and the direction and job content for the government to execute this policy is explicitly stated. 1.http://www.nisc.go.jp/eng/pdf/national_strategy_001_eng.pdf(last accessed date: 2009/07/20). 2.http://www.nisc.go.jp/en/sisaku/h1310action.html(last accessed date: 2009/07/20).

Challenges and Opportunities from Digital Convergence

Preface With the blooming of IT technologies, the term of “digital convergence” represents the whole atmosphere at this moment. “Digital convergence”—means that after telecommunication and broadcasting systems are following the IP based framework, contents and services, those were easy to define, turn to be confused. Relying on the uniform platform, operators are able to provide services to different systems. Services containing VoIP, IPTV or the latest terms of “Multi-screen Ecosystem” and “Connected TV” are all involved in the “digital convergence” notion. Today, no matter the service of “check in” or “watching TV programs on Smartphone,” any figures about multiple services on different devices are presenting the “digital convergence” effect. On the consumer side, “digital convergence” brings a fascinating imagination of life. Time and space are no more limitations to people for getting information. Consumers select services only depending on the quality of each service. However, the fascinating imagination of customers becomes a pressure to the relative industries. In the past, because of distinctive transmission technique, services of television, internet and information were regarded as in different industries. Effective competitors only appeared in the same industry. However, today “digital convergence” effect results in crossing-industries competition and customer immigration. To accommodating and pursue the new trend, only unique ideas and novel services can help incumbents to survive. “Digital convergence” brings not only a challenge but also an opportunity. Today, user-friendly application services are cumulatively created and accommodated in the mature broadband network. For examples, high quality entertainment services occur after communication and multimedia broadcasting techniques are improved, “Near Field Communication” technology rising causes new types of cash flow services. Otherwise, Cloud Computing technique enables people easily to access tele-healthcare services and Telematics services. Certainly, digital convenience accelerating industries transformation and value-added services is now taking place around us. According to ITU reports, every 10% increase of broadband infrastructure extension might cause 0.255 to 1.38% GDP growth rate. High penetration of broadband infrastructure might lead a significant influence on economy growth. Take South Korean experiences as an example, by owing a complete broadband infrastructure, on-line game industry and national digital content industry in this country are individually possessing $8.3 billion and $ 3.4 billion output value. By sensing the potential possibilities, governments in different countries propose their own national industry policies, including American government proposed “National Broadband Plan”, the “Digital Britain White Paper” formulated by United Kingdom, “Hikari no Michi”(光の道, which means fiber superhighway) in Japan and the “Ultra-Broadband Convergence Network Plan (UBcN plan)” in South Korea, moreover, the “Tri-networks Integration Plan” in China. And Taiwan does not absent in this moment. In order to stand firmly in this trend, we also formulate “Digital Convergence Development Program 2010-2015 (DCDP 2010-2012)” in 2010. Below, we are going to make a briefly and neat description of “DCDP 2010-2012”. 1.INTRODUCTION For assisting national relative industries to smoothly transform and enhancing Taiwan’s international competitiveness, Executive Yuan admitted the “Digital Convergence Development Program 2010-2015 (DCDP 2012-2015)” in 2010. In this program, there were six main goals containing: (1) complement the broadband superhighway infrastructure; (2) initiate the convergence of telecommunication services; (3) accelerate the process of Television digitization; (4) develop emerging internet video services; (5) improve communication industries; and (6) establish an integrity regulation framework, as well as twenty-one improving tactics and seventy-eight measures for crossing- administrations cooperation and negotiation to be declared. Otherwise, Executive Yuan also established DCTF to be responsible for coordinating every effort from every administration and facilitate digital convergence tasks. Latter, we will make further descriptions for the six main goals, we just mentioned above: A.Complement the broadband superhighway infrastructure According to the Global Information Technology Report 2010-2011, proposed by World Economic Forum (WEF), Taiwan on the Network Readiness Index (NRI) item was been ranked at 6th place and at 5th place on another item of highest FTTH/FTTB penetration. However, though our coverage of broadband network was high, the total bandwidth was still insufficient to contain all the new creating services. To resolving the shortage of bandwidth, including Ministry of the Interior (MOI), Ministry of Economic Affairs (MOEA), Ministry of Transportation and Communications (MOTC) and National Communications Commission (NCC) were convened to extend the national fiber coverage and facilitate the installation upgrade. Regarding wireless broadband construction, administrations including MOEA, MOTC and NCC were under obligation to energetically detect the latest developments of wireless telecommunication technologies as well as proposed guidelines from other countries, concerning about the allocation of spectrum, telephone numbers and IP address resources. Through crossing-administrations cooperation and coordination, in December 2011, the total of national subscribers applying fiber network service had achieved 3.31 million houses, besides, there were 24.58% houses in Taiwan possessed 100Mbps broadband network services. Totally, there were 7.88 million wireless broadband accounts being applied. B.Initiate the convergence of telecommunication services Smartphone booming brought an emerging mobile entertainment life style, furthermore, it also accelerated the rising of mobile value-added application services. To this trend, administrations containing MOEA, Financial Supervisory Commission (FSC) and NCC all devoted to establishing a constructive environment, with providing assists and building up a complete regulation framework. For examples, up to the end of 2011, national telecommunication operators had signed a memorandum with EasyCard Corporation to develop a mobile cash flow platform, which allows cash flowing through the Internet, for giving people a more convenient experience. C.Accelerate the process of Television digitization Within various emerging application services, “Television digitization” might be the most important one in people’s life. “Television digitization” service brought not only a higher quality experience of watching programs, but also created extra demands of relative application services. Furthermore, increasing demands also bought an improvement to the industry and simultaneously accelerating the development of digital content industry. Nationwide terrestrial TV signal switching program, a fully signal switching from analog to digital, has accomplished in July 2012. In order to achieve 90% coverage rate of digital signal transmission, accommodations containing Council of Indigenous People (CIP) and NCC were not only devoted to establishing a Digitization Improvement Station, but also attempt to integrate all signals from original terrestrial TV stations into one satellite to transmit. To accomplish this signal switching program, government had cultivated for many years and try to increase people’s acceptance level of high definition (HD) TV service. Before receiving this success, NCC had spent a long time devoting itself to integrating containing every effort from many administrations and associations, such as the local governments, national industry associations and operators of household application, moreover, as well as Public Enterprises, including Taiwan Power Company, Chunghwa Post Corporation and Taiwan Water Corporation to popularizing this program. Nevertheless, about the digitization program of cable TV, up to 2010, though there were already 60% of houses in Taiwan possessing cable TV service, only 5.55% of cable TV houses switched into digital. As a result, we found that no incentive measures might be the crucial reason. To reverse the impasse, our strategy was to amend the current laws, through adjusting the regulation framework we could facilitate the market into effective competition. In addition, to accelerate the cable TV digitization process, government also regarded the Olympic relaying in England as a turning point to create the demands of HD TV service. After getting the franchise, people are able to watch Olympic Games through any platforms, including terrestrial TV, cable TV and even IPTV. As the demands arising, it would also encourage operators to produce more HD programs afterward. D.Develop emerging internet video services Digital convergence effect also caused the emerging internet video services booming. In order to encourage the crossing-platforms video services and achieve 50% user rate in 2015, there were three guidelines been proposed. The first one was emerging video service regulation reforming, the second one was facilitating integration between emerging accessing approaches and distribution channels, and the third one, developing a rational regulation on contents management. In synchromesh with terrestrial TV signal switching program, emerging internet video services were also assigned to provide HD Olympic Games programs. In that period, the subscribers of Chunghwa Telecom’s MOD (Multimedia on Demand) service were able to watch the Olympic Games relaying on 14 free HD channels and 1 free 3D channel, which is provided by ELETA TV. Moreover, they could also receive the programs on demand through internet or Smartphone. Afterward, from the collected data, we found that even though the rate of new subscribers only had a few rise, an obviously rose presented on the turning on rate. Depended on those data, we believe that people had already been more familiar with IPTV and HD programs. Besides, this relaying program totally attracted 95 individual advertising and the total revenue from advertising was NT$ 80 million dollars. E.Improve communication industries Producing prolific contents is the key element for attracting customers and stabilizing the development of digital convergence industry. To facilitate the contents producing, DCDP proposed three elements to be improved: fund, talent and marketing. And the tasks of these three elements were including investment facilitation, marketing skill reinforce, personal training as well as culture protection, consumer’s right protection, technique standardization and transnational cooperation. To assist in industries transformation, MOEA focused on promoting the APP design and upgrades. Recently, measures provided by MOEA, such as transformation counseling, R&D subsidies, drive-by VC investment, personal training and even the R&D loan had already taken effect. In addition, to create a virtuous investment circles in contents industry, government also considered to release more subsidies to encouraged those superior producers and movie makers. F.Establishing an integrity regulation framework Digital convergence effect accelerated the competition in the market, including communication or relative contents industries were enter a transformation era. In this period, it was essential to have a practical and integrity regulation framework. Recently, NCC hastened to undertake the amendments of three Acts, containing Radio and Television Act, Cable Radio and Television Act and Satellite Broadcasting Act. Actually, the expectation of this undertaking was to adopt the adjustment of digital convergence in 2014. In addition, Fair Trade Commission (FTC) and Intellectual Property Office (IPO) would also continue to observe the digital convergence influences in 4C (telecommunication, cable television, computer network and e-commerce) and contents (copyright) industries. 2.Second Edition of DCDP and Primly Policies Indicators Advance Since DCDP was launched, it has caused a tremendous response. Nevertheless, rapidly advanced ICT technologies inspire people’s expectations. Recently, it has already overtaken the anticipations of used DCDP. Therefore, to formulate a prescient version, Executive Yuan adopted the second edition of DCDP 2010-2015 in May 2012. In the second edition, an item of “producing prolific TV programs” is added to be the seventh main subjects, in addition, there are five extra items added in the improving tactics part; moreover, the number of measures increased to 107 items. Digital convergence indicators are also reformulated. First, 100Mbps wired broadcasting service should achieve 100% in 2013, and the second, accomplishing 100% digitization of cable TV in 2014. To achieve these indicators, relative administrations decide to accelerate the network infrastructure complementing process and cable TV digitization process. Simultaneously, they also consider extending their regulatory scale from emerging internet video services to the connected TV industries, and enhancing superior programs producing by policy making. In point of accelerating network infrastructure complementing process, a complete broadband network is a foundation of digital convergence industry. However, a “complete” network indicates not only the non-discriminatory access to the hardware, but also mention about having reasonable prices to access broadband services. By considering of Telecommunication operators and cable TV operators are both provides of broadband services, the digitization issue of cable TV industry is also concerned in the DCDP. As a primary enemy to Telecommunication operators in the convergence market, cable TV operators’ competitiveness does not come from the their large share on the cable TV market, but from their possession of wide spread cable network. Otherwise, various new creating contents and application are also encouraged in the DCDP. With “Smart TV,” “HDTV” and “Connected TV” booming, “TV” has transformed from a passive receiving media to an information transport. Although, those emerging broadcasting techniques might threaten the traditional television industry, they bring positive influences to the media industry. By considering a well-run development must building on a integrity and friendly regulation framework. DCTF, an office established by Exclusive Yuan, will also take its responsible to assist NCC on the digital convergence regulatory issues. 3.Conclusion Digital convergence effect to us is a turbulence but also a moment. Today, this effect, which originally comes from the techniques convergence, has detonated in different nations and various places; crossing-industries competition turns to be more and more common around the world. To accommodate our nation to this trend, the primary strategy proposed by government is to integrate administrations’ effort. Through policies making, including DCDP upgrading and validly relative regulation frameworks amending, every relative industry is able to restore enough energy and seize the moment, further, naturally turns to be a domain of market competition.

The amendment of the Taiwanese Personal Data Protection Act

The amendment of the Taiwanese Personal Data Protection Act 2025/05/28 On March 27, 2025, the Executive Yuan released and submitted a draft partial amendment of the Personal Data Protection Act to the Legislative Yuan. The amendment aims to comprehensively enhance personal data protection by constructing the foundation for an independent supervisory agency[1]. Taiwan’s Personal Data Protection Act- legislative progress Taiwan’s Personal Data Protection Act (PDPA) has been amended three times since its release in 1995. In May 2023, the latest amendment to the PDPA introduced Article 1-1, designating the Personal Information Protection Committee as the competent authority under the Act. This legislative development was made in light of the Taiwan Constitutional Court Judgment 111-Hsien-Pan-13 (2022) (Case on the National Health Insurance Research Database)[2], which held that, to ensure the protection of personal information and the constitutional right to privacy under Article 22, the establishment of an independent data protection mechanism is required. In accordance with Taiwan Constitutional Court Judgment 111-Hsien-Pan-13 (2022), the Personal Data Protection Commission (PDPC) must be established by August 2025. To facilitate this, the Preparatory Office of the Personal Data Protection Commission was established in December 2023. This office is mainly responsible for drafting and establishing the regulations and organizational framework required to establish the independent authority, including drafting the Organization Act of the PDPC and the amendments to the PDPA. To develop the regulatory framework for an independent authority, the Preparatory Office of the Personal Data Protection Commission has planned a two-stage amendment process. The first phase seeks to establish the legal foundation of the PDPC, while the second phase will address other substantive issues of personal data protection. For the first stage, the Preparatory Office of the Personal Data Protection Commission drafted the Organization Act of the Personal Information Protection Committee in accordance with Article 1-1 of the PDPA and revised partial provisions of PDPA to reflect the function and duties of the PDPC. The Draft of Partial Amendment to the Personal Data Protection Act The key points of the amendment of PDPA are to empower the commission with essential regulatory functions, to strengthen the regulatory oversight and management of personal data within public sectors, and to set up a transition period to transfer regulatory authority over the private sectors[3]. 1. Empower the commission with essential regulatory functions Due to the lack of a unified agency for receiving incident reports and the efficiency issues caused by the current decentralized legal enforcement, the amendment of PDPA designates the PDPC as the competent authority to receive the incident reports. Centralizing incident reporting under the PDPC facilitates a clearer understanding of the nature and status of related incidents. It also helps regulatory authorities to investigate and handle problems quickly. The rules for reporting data breach incidents are set out in Article 12 of the amended PDPA. According to Article 12 of the amended PDPA, both public sector and private sector entities are required to take appropriate actions and retain the records when a data breach occurs. In addition, public sector entities must report the incident to the PDPC and other relevant government agencies, while private sector entities are required to notify the incident to the PDPC, which will then inform its competent authority[4]. In terms of personal data security maintenance, the amended PDPA states that the competent authority is responsible for formulating regulations concerning security maintenance, governance mechanisms, protective measures, and other relevant matters[5]. Accordingly, PDPC, as the competent authority, will draft the Regulations Governing Security Maintenance and Administration to provide the legal basis for the conducting audits, inspections, and administrative sanctions[6]. 2. Strengthen the regulatory oversight and management of personal data within the public sector The amendment of PDPA designates the PDPC as the independent authority responsible for overseeing the overall personal data protection affairs, including supervision of public sectors. The PDPC is empowered to supervise the public sector entities regarding their compliance with personal data protection regulations. Therefore, the role of the Data Protection Officer (DPO) is introduced in Taiwan for the first time. Article 18 of the amended PDPA states that every public sector entity must appoint a DPO to promote and oversee matters related to personal data protection. This approach reinforces personal data protection from both internal and external perspectives[7]. In considering restructuring and resource allocation associated with introducing this new role, the DPO requirement in PDPA currently applies to the public sector entities. However, both the public and private sectors are required to designate specialists to be responsible for managing personal data protection and security affairs[8]. 3. Set up a transition period to transfer regulatory authority over the private sectors Under the current regulation framework, the supervision of personal data protection in the private sector is decentralized and supervised by different competent authorities. To address this gap, the amendment of PDPA clarifies that the PDPC will serve as the supervisory authority for these entities in the future. In terms of the private sector entities already under the supervision of specific competent authorities, supervisory arrangements will initially remain unchanged. However, to achieve regulatory consistency, the amendment introduced a six-year transitional period during which supervisory responsibility will be transferred to the PDPC. During this transition, the PDPC will collaborate with relevant agencies every 2 years to assess the implementation of the new framework of PDPC and the situation of supervision across the private sector[9]. The draft Organization Act of the Personal Data Protection Committee has also been released To complete the legal basis of PDPC, the draft Organization Act of the Personal Data Protection Committee (hereinafter referred to as the draft of the Organization Act) is released with the PDPA amendment. The draft of the Organization Act aims to formalize the PDPC as the independent central supervisory body. Additionally, it also clarifies the division of responsibilities among agencies on personal data-related matters. Once enacted, the PDPC will serve as Taiwan’s independent authority. According to the draft of the Organization Act, the PDPC is designed as a collegial system with 5-7 committee members, serving a term of 4 years, and members may be reappointed upon completion of their term[10]. As a central third-level agency, the committee members will exercise their powers independently. The draft of the Organization Act states that the PDPC is responsible for making the legislation and policies of personal data protection, the oversight of personal data protection, promoting and researching personal data-related technology, protecting cross-border transfer of personal data and the talent acquisition of personal data protection[11]. The draft of the Organization Act establishes the legal foundation for the PDPC, outlining its organization structure and core responsibilities. Additionally, it grants the PDPC the authority to supervise and enforce compliance with personal data protection regulations. Benefits of the legal reform of the Personal Data Protection Act and the next step The draft partial amendment to the Personal Data Protection Act, along with the draft Organization Act of the Personal Information Protection Committee, have been submitted to the Legislative Yuan for legislative review. This marks the first time that Taiwan has established an independent authority responsible for personal data protection. The PDPA amendment not only formalizes the legal status and authority of the Commission but also enhances the legitimacy and credibility of personal data collection and use. However, amendments to other substantial aspects of data protection will be introduced in the next phase. The Preparatory Office of the Personal Data Protection Commission has already initiated work on the second phase, which will focus on substantial personal data protection issues in the context of the digital era. Reference: [1]The Executive Yuan approved the draft Organizational Act of the Personal Data Protection Commission and the draft of partial amendments to the Personal Data Protection Act, aiming to establish a comprehensive independent supervisory mechanism and enforcement authority, and to build robust data governance for the era of comprehensive AI application., Executive Yuan, https://www.ey.gov.tw/Page/9277F759E41CCD91/747cda78-926f-4205-99b3-1a735fc1b97b (last visited May. 19, 2025). [2]Constitutional Court Judgment 111-Hsien-Pan-13 (2022) (Case on the National Health Insurance Research Database). [3]Establish an independent supervisory authority for personal data protection to strengthen personal data safeguards. The Executive Yuan approved the draft Organization Act of the Personal Data Protection Commission and the draft partial amendments to the Personal Data Protection Act., Preparatory Office of the Personal Data Protection Commission website, https://www.pdpc.gov.tw/News_Content/20/907/ (last visited May. 19, 2025). [4]Partial Amendment Draft to the Personal Data Protection Act, the 8th meeting of the 3rd session of the 11th Legislative Yuan, General Bill No.20, Executive Yuan Proposal No.11010550, Art. 12. [5]Id. Art 18, Art 20-1. [6]Supra note 3. [7]Id. Art.18. [8]Id. Art. 20-1. [9]Id. Art.51-1. [10]Draft of the Organization Act of the Personal Information Protection Committee, the 8th meeting of the 3rd session of the 11th Legislative Yuan, General Bill No.20, Executive Yuan Proposal No. 1101052, Art. 3.Draft of the Organization Act of the Personal Information Protection Committee, the 8th meeting of the 3rd session of the 11th Legislative Yuan, General Bill No.20, Executive Yuan Proposal No. 1101052, Art. 3. [11]Id. at Art. 2.

The legal challenges of ubiquitous healthcare

Whereas the burden of private nursing for the elderly is getting heavier, industrialized countries with an aging society are endeavoring to seek possibilities of reducing the unit healthcare cost, such as technology assistance, and even the introduction of the brand new care type or model, which is an emerging application field of increasing importance. The development of such kind of healthcare industry not only is suitable for aging societies but also coincides with the growing health management trend of modern people. Also, while the focus on acute diseases in the past has changed to chronic diseases which are common to most citizens, the measuring and monitoring of physiological indicators, such as blood pressure, pulse, blood sugar and uric acid have critical effects on condition control. However, it will mean huge financial and physical burdens to the elderly or suffering from chronic diseases if they need to travel to hospitals to measure these physiological indicators. At this moment, an economical, reliable and timely physiological information collection and transfer system will be technology with good potential. For this reason, the purpose of this study is to investigate the potential business opportunities by applying the emerging information technology (IT) to the healthcare industry and the derivative legal and regulatory issues, with a focus on the seamless healthcare industry. It is hoped that by assessing the opportunity and risk in terms of legal and strategic analysis, we can single out the potential imbalance of fitting seamless healthcare, an IT-enabled service (ITeS), in the conventional control framework, and thereby establish a legal environment more appropriate for the development of the seamless healthcare industry. Referring to the existing electronic healthcare classification, the industry is divided into the following four blocks: electronic content provider, electronic product provider, electronic linking service provider and electronic passport service provider. Also, by depicting the outlook of the industry, the mode of application and the potential and common or special legal problems of different products are clarified. Given that health information collected, stored and transferred by electronic means involves unprecedented risk in information privacy and security, and that the appropriate control of such risk will affect the consumer’s faith in and willingness to subscribe seamless healthcare services, this study analyzed the privacy framework of the USA, the EU and Taiwan. Results indicate that future privacy legislation in Taiwan should include the protection for non-computer-processed personal information, expand the scope and occupation of applications, reinforce control incentives, and optimize the privacy protection mechanism. Further, only when service providers have the correct and appropriate concept of privacy protection can the watch-and-wait attitude of consumers be eliminated. These can help to promote subsequent development of the industry in the future. Due to the booming international trade as a result of globalization, and the gradual opening of the domestic telecommunication and healthcare markets following Taiwan’s entry into the WTO, transnational distance healthcare will gradually become a reality. However, the determination of the qualifications of practitioners is the prerequisite of transnational healthcare services. Taiwan may also consider lowering the requirements for physicians to practice in other countries and thereby to enhance the export competitiveness of Taiwan’s healthcare industry by means of distance healthcare via endorsement or reciprocity. Lastly, whereas the risks distance healthcare involves are higher than conventional healthcare services, the sharing of burdens and disputes over applicable laws in case of damages are the gray areas for executive control or judicial practice intervention. For this reason, service providers are unwilling to enter the market because the risks are too unpredictable. Therefore, this study recommends that the insurance system for distance healthcare should be the focus of future studies in order to promote the development of the industry.

Most read
[　X Close　]
Copyright © 2016 STLI,III. All Rights Reserved.
TOP