Taiwan's new Personal Data Protection Act ("PDPA") has been in effect since 1 October 2012, but in practice, there are still very few cases in which individuals file claims against corporations for failure to comply with the PDPA requirements in processing their personal data.
In October 2014, a court judgment was rendered awarding nominal civil damages in the amount of NT$26,000 (approximately US$850) in accordance with the Taiwan Civil Code and the PDPA. Although the damage award is symbolic, what makes this case special is that the individual exercised his right to be forgotten. The case involved one of Taiwan's largest retailers of home improvement and construction products and services which regularly send out unsolicited advertisement emails to its store members. One of its members requested the store to delete his personal information from its mailing list. The store subsequently agreed to do so, yet it continued to send the complainant over 52 advertisement emails over a duration of 6 months after it had agreed to remove his email address from its mailing list.
Article 3 of the PDPA empowers an individual to request a store to delete his or her personal information from its system or database. Article 20(2) of the PDPA also stipulates that when an individual indicates his or her unwillingness to receive any marketing materials, the sending company must immediately cease using the individual's personal information in conducting its marketing activities. In failing to do so, the store may be subject to civil and/or administrative penalties and may even lead to criminal liabilities. Whether there will be similar cases following suit remains to be seen, but the above case demonstrates that Taiwan consumers sense the need and the right "to be forgotten" and that the court respects this right. For more information, please contact Henry Chang or Chris Tsai.