March 2022
Teresa Huang and Lilian Hsu
The Financial Supervisory Commission (hereinafter, the “FSC”) and the Joint Credit Information Center (hereinafter, the “JCIC”) announced the rollout of a “convenient forwarding mechanism for personal credit score and data” at the end of January 2022 so that eligible financial technology operators (“FinTech operator”) may, with the consent of their customers, obtain from the JCIC their credit score data, including credit card data, credit data, and credit scores obtained by calculating data such as their payment behavior and indebtedness. This mechanism, which not only accelerates financial innovation but further realizes the autonomy of consumer data and enhances the efficiency and quality of financial services, is expected to be formally operated in the second quarter of 2022.[1] According to related news reports and the verbal confirmation with JCIC, the criteria required for an operator to participate in the convenient data forwarding mechanism, and the explanation of the points to note for personal information protection are summarized as below.
I. Qualifications for joining the convenient forwarding mechanism for personal credit scores and data are provided as follows:[2]
(1) Organizational qualifications
1. A juristic person organization legally incorporated and registered for at least three years.
2. A paid-in capital of at least NT$100 million or a paid-in capital of at least NT$20 million with ISO20771 certification.
(2) Cybersecurity qualifications
There have been no personal data leakage incidents in the last three years.
(3) Qualifications for the responsible persons and actual beneficiaries
1. The responsible persons and managerial officers not subject to the circumstances set forth in Article 3, Paragraph 1, Subparagraphs 1 through 12 of the Regulations Governing the Qualification Requirements, Concurrent Service Restrictions, and Compliance Matters of the Responsible Persons of Banks
2. Not a business in Taiwan that is invested by investors from mainland China (including Hong Kong and Macao).
3. Willingness to accommodate the JCIC’s review to determine if the responsible person, shareholders holding over 10% of the total outstanding shares or total capital, and the ultimate beneficiary are persons or enterprises in mainland China (including Hong Kong and Macao).
II. Points to note for FinTech operators
Since the convenient forwarding mechanism for personal credit scores and data involve the use of the consumers’ personal information, FinTech operators should pay attention to related compliance issues when using the consumers’ personal information.
Pursuant to the definition under Article 2, Subparagraph 1 of the Personal Data Protection Act (hereinafter, the “PDPA”), the credit score data of consumers can be deemed to fall within the scope of personal information. A FinTech start-up should take proper safety measures when obtaining the personal information of consumers to prevent it from being stolen, altered, damaged, lost, or leaked (see Article 27, Paragraph 1 of the PDPA).
In addition to being liable for damages in accordance with Article 29, Paragraph 1 of the PDPA, the operator that leaks personal information due to its violation of the provisions on the protection of consumers’ personal information will also be disqualified from participating in the convenient forwarding mechanism for personal credit score data. In the event of personal information leakage by an operator that has already joined, the JCIC is currently planning to set up a disciplinary committee to consider the disciplinary measures, including the imposition of a default penalty, suspension of the data exchange business, and even termination of cooperation.[3] Therefore, it is recommended that FinTech operators should pay attention to the corresponding personal information protection measures when obtaining consumers’ credit information and expanding their credit business for the sake of legal compliance.
[1] See the FSC’s Newsletter of January 25, 2022, https://www.fsc.gov.tw/ch/home.jsp?id=2&parentpath=0&mcustomize=news_view.jsp&dataserno=202201250002&dtable=News
[2] Chiao-yi Wei and Chen-ling Peng, Eight P2Ps Are Planning to Join the New JCIC Mechanism to Obtain Personal Credit Rating Information in Two Minutes, January 25, 2022, Chinatimes.com, https://www.chinatimes.com/realtimenews/20220125004764-260410?chdtv
[3] Pei-Chun Liao, FSC Oked the Release of Citizens’ Credit Rating Information for P2Ps; JCIC: Release Will Be Terminated in Case of Personal Information Leakage, Chinatimes.com, January 25, 2022, https://udn.com/news/story/7239/6060322