December 2025
Legal Boundaries for Employers When Collecting Personal Data of Job Applicants or Employees (Taiwan)
When recruiting or hiring personnel, employers may conduct background checks on job applicants or newly hired employees for business management purposes or to prevent occupational accidents. However, if such background checks intrude into personal privacy beyond what is necessary for employment, applicants or employees are under no obligation to provide such information. Employers who unlawfully collect such data may face administrative fines, as well as potential civil and criminal liabilities.
To assist employers and recruitment professionals in understanding the legal boundaries for collecting employees’ personal and privacy-related information, this article provides an overview as follows.
1. Information Employers Are Required to Maintain
When hiring employees and throughout the duration of the employment relationship, employers are legally required to maintain records of certain employee information:
(1) Basic employee information
Employers must maintain employee rosters recording the employee’s name, sex/gender, date of birth, place of ancestral origin, education background, address, national identification card number, employment starting date, wage, labor insurance starting date, merits and demerits, injuries and diseases, and other significant facts of each employee (Article 7 of the Labor Standards Act).
(2) Physical and health examination records
Employers must retain records of certain physical and health examinations (Article 20, Paragraph 2, of the Occupational Safety and Health Act).
2. Information Employers May Request from Job Applicants or Employees
During the recruitment or employment process, employers may request job applicants or employees to provide employment-necessary personal information, provided that the following conditions are met (Article 5, Paragraph 2, Subparagraph 2 of the Employment Service Act (“ESA”); Article 1-1 of the Enforcement Rules of the Employment Service Act (“Enforcement Rules”)):
(1) The request does not violate the will of the job applicant or employee;
(2) The request serves a legitimate and necessary purpose:The collection of personal information must be limited to what is necessary for a specific purpose, such as economic needs (e.g., improving productivity, reducing insurance costs, or avoiding employer tort liability) or the protection of public interests; and
(3) The collected personal information must have a legitimate and reasonable connection to the specific purpose.
“Personal information” includes the following categories (Article 1-1, Paragraph 1 of the Enforcement Rules):
(1) Physiologic information: genetic tests, medication tests, medical treatment tests, HIV tests, intelligence quotient tests and fingerprints.
(2) Psychological information: psychiatric tests, loyalty tests and polygraph tests, etc.
(3) Personal lifestyle information: financial records, criminal records, pregnancy plans and background checks.
3. Representative Cases
(1) Health Information Unrelated to Job Requirements
In practice, it is not uncommon for employers, during the recruitment process, to request job applicants to provide health-related information beyond the scope of statutorily required physical examinations, such as pregnancy test results, an individual’s personal or family medical history, or information regarding whether the individual has previously been diagnosed with a notifiable infectious disease. However, the Ministry of Labor (“MOL”)’s Administrative Appeal Review Committee (“Committee”) has taken the position that, in light of the industry in which the position is offered and the nature of the position itself, such information lacks a legitimate and reasonable connection to the position being recruited for and the personal information requested. Accordingly, the Committee has rendered decisions unfavorable to employers (the Lao-Dong-Fa-Su-1130007598 Appeal Decision of October 14, 2024; the Lao-Dong-Fa-Su-1100020805 Appeal Decision of April 8, 2022; and the Lao-Dong-Fa-Su-1030034299 Appeal Decision of June 4, 2015, from the MOL).
(2) Information Related to Job Capability
Information related to job capability generally refers to an employee’s past experience, including educational background, prior positions held, duration of employment, and years of service. When employers request such information, courts have typically found it to constitute employment-necessary personal information and have ruled in favor of employers (the 110-Lao-Shang-17 Civil Decision of the Taiwan High Court Taichung Branch).
(3) Police Criminal Record Certificate
Whether a Police Criminal Record Certificate (“Criminal Records”) constitutes employment-necessary personal information must be assessed on a case-by-case basis, taking into account the nature of the position and applicable laws.
For example, under Article 10-1, Paragraph 1 of the Private Security Service Act, individuals who have committed certain crimes are prohibited from serving as security personnel. Accordingly, to ensure that candidates meet these statutory qualifications, an employer requesting for the Criminal Records from job applicants does not violate the ESA.
Similarly, before hiring teaching or administrative staff, short-term tutorial centers are required to submit documentation such as academic and employment credentials, identification documents, and the Criminal Records issued within the past three months to the local education authority for approval. In such cases, the requested information constitutes employment-necessary personal information.
Furthermore, for certain positions, such as human resources roles, courts have emphasized the importance of an applicant’s past conduct, given that such roles involve recruiting employees, drafting internal policies, and handling sensitive personnel data. Consequently, the court affirmed that where the applicant has provided written consent, and the scope of information collected does not exceed what is necessary for a specific economic purpose and maintains a legitimate and reasonable connection to that specific purpose, employers may lawfully request Criminal Records (the 110-Lao-Shang-129 Civil Decision of the Taiwan High Court).
Aside from the above circumstances, courts and the MOL generally take the position that Criminal Records are not employment-necessary personal information, and employers may not arbitrarily require employees to provide such information.
4. Legal Risks and Practical Recommendations
If an employer requests personal information that is not necessary for employment during recruitment or hiring, the employer may be subject to administrative fines ranging from NTD 60,000 to NTD 300,000 (Article 5, Paragraph 2, Subparagraph 2 of the ESA; Article 1-1 of the Enforcement Rules; Article 67, Paragraph 1 of the ESA). If such conduct also constitutes a violation of the Personal Data Protection Act, constitutes a civil tort, or a criminal offense, the employer may incur additional civil, criminal, or administrative liabilities.
Accordingly, when conducting background checks or collecting personal information from job applicants or employees, employers should respect individual privacy, assess the scope of employment-necessary personal information based on their industry and the nature of the position, and ensure compliance with the ESA, Personal Data Protection Act, and other applicable laws in order to mitigate legal risks.
To assist employers and recruitment professionals in understanding the legal boundaries for collecting employees’ personal and privacy-related information, this article provides an overview as follows.
1. Information Employers Are Required to Maintain
When hiring employees and throughout the duration of the employment relationship, employers are legally required to maintain records of certain employee information:
(1) Basic employee information
Employers must maintain employee rosters recording the employee’s name, sex/gender, date of birth, place of ancestral origin, education background, address, national identification card number, employment starting date, wage, labor insurance starting date, merits and demerits, injuries and diseases, and other significant facts of each employee (Article 7 of the Labor Standards Act).
(2) Physical and health examination records
Employers must retain records of certain physical and health examinations (Article 20, Paragraph 2, of the Occupational Safety and Health Act).
2. Information Employers May Request from Job Applicants or Employees
During the recruitment or employment process, employers may request job applicants or employees to provide employment-necessary personal information, provided that the following conditions are met (Article 5, Paragraph 2, Subparagraph 2 of the Employment Service Act (“ESA”); Article 1-1 of the Enforcement Rules of the Employment Service Act (“Enforcement Rules”)):
(1) The request does not violate the will of the job applicant or employee;
(2) The request serves a legitimate and necessary purpose:The collection of personal information must be limited to what is necessary for a specific purpose, such as economic needs (e.g., improving productivity, reducing insurance costs, or avoiding employer tort liability) or the protection of public interests; and
(3) The collected personal information must have a legitimate and reasonable connection to the specific purpose.
“Personal information” includes the following categories (Article 1-1, Paragraph 1 of the Enforcement Rules):
(1) Physiologic information: genetic tests, medication tests, medical treatment tests, HIV tests, intelligence quotient tests and fingerprints.
(2) Psychological information: psychiatric tests, loyalty tests and polygraph tests, etc.
(3) Personal lifestyle information: financial records, criminal records, pregnancy plans and background checks.
3. Representative Cases
(1) Health Information Unrelated to Job Requirements
In practice, it is not uncommon for employers, during the recruitment process, to request job applicants to provide health-related information beyond the scope of statutorily required physical examinations, such as pregnancy test results, an individual’s personal or family medical history, or information regarding whether the individual has previously been diagnosed with a notifiable infectious disease. However, the Ministry of Labor (“MOL”)’s Administrative Appeal Review Committee (“Committee”) has taken the position that, in light of the industry in which the position is offered and the nature of the position itself, such information lacks a legitimate and reasonable connection to the position being recruited for and the personal information requested. Accordingly, the Committee has rendered decisions unfavorable to employers (the Lao-Dong-Fa-Su-1130007598 Appeal Decision of October 14, 2024; the Lao-Dong-Fa-Su-1100020805 Appeal Decision of April 8, 2022; and the Lao-Dong-Fa-Su-1030034299 Appeal Decision of June 4, 2015, from the MOL).
(2) Information Related to Job Capability
Information related to job capability generally refers to an employee’s past experience, including educational background, prior positions held, duration of employment, and years of service. When employers request such information, courts have typically found it to constitute employment-necessary personal information and have ruled in favor of employers (the 110-Lao-Shang-17 Civil Decision of the Taiwan High Court Taichung Branch).
(3) Police Criminal Record Certificate
Whether a Police Criminal Record Certificate (“Criminal Records”) constitutes employment-necessary personal information must be assessed on a case-by-case basis, taking into account the nature of the position and applicable laws.
For example, under Article 10-1, Paragraph 1 of the Private Security Service Act, individuals who have committed certain crimes are prohibited from serving as security personnel. Accordingly, to ensure that candidates meet these statutory qualifications, an employer requesting for the Criminal Records from job applicants does not violate the ESA.
Similarly, before hiring teaching or administrative staff, short-term tutorial centers are required to submit documentation such as academic and employment credentials, identification documents, and the Criminal Records issued within the past three months to the local education authority for approval. In such cases, the requested information constitutes employment-necessary personal information.
Furthermore, for certain positions, such as human resources roles, courts have emphasized the importance of an applicant’s past conduct, given that such roles involve recruiting employees, drafting internal policies, and handling sensitive personnel data. Consequently, the court affirmed that where the applicant has provided written consent, and the scope of information collected does not exceed what is necessary for a specific economic purpose and maintains a legitimate and reasonable connection to that specific purpose, employers may lawfully request Criminal Records (the 110-Lao-Shang-129 Civil Decision of the Taiwan High Court).
Aside from the above circumstances, courts and the MOL generally take the position that Criminal Records are not employment-necessary personal information, and employers may not arbitrarily require employees to provide such information.
4. Legal Risks and Practical Recommendations
If an employer requests personal information that is not necessary for employment during recruitment or hiring, the employer may be subject to administrative fines ranging from NTD 60,000 to NTD 300,000 (Article 5, Paragraph 2, Subparagraph 2 of the ESA; Article 1-1 of the Enforcement Rules; Article 67, Paragraph 1 of the ESA). If such conduct also constitutes a violation of the Personal Data Protection Act, constitutes a civil tort, or a criminal offense, the employer may incur additional civil, criminal, or administrative liabilities.
Accordingly, when conducting background checks or collecting personal information from job applicants or employees, employers should respect individual privacy, assess the scope of employment-necessary personal information based on their industry and the nature of the position, and ensure compliance with the ESA, Personal Data Protection Act, and other applicable laws in order to mitigate legal risks.
