Change data-protection law: Cabinet

Despite the outcry by the Taipei City Government, the Cabinet yesterday approved amending a data-protection law to entrust local governments with the responsibility of helping implement the law.

Claiming the city lacks funding and manpower, Taipei Deputy Mayor King Pu-tsung (金溥聰) told the weekly Cabinet meeting yesterday that it was not fair to ask the city to shoulder the responsibility of implementing the amended Computer-Processed Personal Data Protection Law (電腦處理個人資料保護法), as approved by the Cabinet.

"It not only violates the Law on Local Government Systems (地方制度法) but also the Constitution, which guarantees special municipalities administrative autonomy," Cabinet Spokesman Chen Chi-mai (陳其邁) quoted King as saying during a press conference after the Cabinet meeting.

According to King, personal data protection does not fall into the city's legal obligations mandated by the Law on Local Government Systems, but that of the Cabinet.

The amended law also violates the Law Governing the Allocation of Government Revenues and Expenditures (財政收支劃分法), King argued, because the amended law was not drafted by the city but by the Cabinet.

The law stipulates that the central government should shoulder the expenses incurred while implementing laws enacted by the Central Government, while local governments do so while carrying out by-laws legislated by the local governments.

King argued that it only makes sense and runs in accordance with the law if the Cabinet covers the full expenses should the city be charged with the responsibility of implementing the revised law.

While King claimed that the city lacks money and professionals necessary to help carry out the task, he proposed that the Cabinet consider establishing an institution staffed with professionals specializing in personal data protection.

Under the Cabinet's draft law, penalties for businesses and individuals leaking personal information would be toughened.

While the current maximum sentence for those who release personal information for commercial purposes is a two-year jail term or a NT$40,000 fine, the draft law increases this to up to five years imprisonment or a maximum fine of NT$1 million.

Such personal data as medical records, genetic information, sex life, health check-ups and criminal records would be banned from being collected, processed or used unless under certain circumstances. Violators would face a fine of between NT$50,000 and NT$500,000.

Groups presently enjoying the prerogative to obtain personal information would also have that privilege revoked.

Workers in eight professional fields are allowed to collect personal information for business purposes. These eight professions are: Private detective agencies, banks, hospitals, schools, telecom and Internet service providers, insurance companies, the media and stock-exchange companies.

In addition, the law would cover all personal information which could be deemed private and deserve protection. The law now protects only personal information which is managed, processed, stored or distributed by computers.