Explanation by the Ministry of Justice concerning whether a government agency may impose a period when a company under investigation for its alleged violation of the Personal Data Protection Law should provide relevant materials (Taiwan)

2018.9.10
Yi-Shan Cheng

The Ministry of Justice issued the Fa-Lu-10703511710 Circular of September 10, 2018 (hereinafter, the “Circular”) to communicate that a government agency investigating a company’s alleged violation of the Personal Data Protection Law may request the company to provide necessary documents, materials or items in accordance with Article 40 of the Administrative Procedure Law.  If the company refuses while the agency believes that such provision is necessary or such company is likely to have violated the Personal Data Protection Law, the relevant provisions of the Personal Data Protection Law may be followed.

The Circular first pointed out that an administrative agency exercising government authority by engaging in all kinds of administrative acts is required to first determine the factual relationship it is seeking to regulate, and the determination of the factual relationship relies on the investigation of facts and evidence.  The Administrative agency shall investigate evidence ex officio without being constrained by any party’s claims and shall pay attention to matters both favorable and unfavorable to the parties (compare Article 36 of the Administrative Procedure Law).  An administrative agency may require a party or any third party to provide necessary documents, materials or items out of the need to investigate facts and evidence (compare Article 40 of the Administrative Procedure Law).  However, this merely requires a party to assist with the administrative procedure but does not impose an collaborative “obligation” on the party to accommodate the investigation.  Therefore, if a party fails to accommodate the investigation, the administrative agency shall not forcefully investigate pursuant to the above Administrative Procedure Law and may do so only when another legal basis exists.

This Circular further pointed out that Article 22, Paragraphs 1, 2 and 4 of the Personal Data Protection Law (hereinafter, the “Law”) provides: “If central competent authorities for specified industries, municipalities under the direct jurisdiction of the central government, or county (city) governments believe it is necessary to carry out methods for ensuring the security of data files, handling data after termination of business, limitation of international transmission, other routine examinations, or if this Law may be potentially violated, they may send their personnel who should carry identification papers for the performance of their duties to enter and perform an inspection and may ask relevant personnel to provide necessary explanation, take accommodating measures or provide relevant supporting documents (Paragraph 1). When conducting the inspection set forth in the preceding paragraph, the central competent authorities for specified industries or municipalities under the direct jurisdiction of the central government, or county (city) governments may seize or duplicate personal data which may be attached or serve as evidence.  For objects that shall be seized or duplicated, the owners, possessors or custodians thereof may be requested to surrender or deliver the same; and in case of refusal to provide or deliver such objects or resistance to seizure or duplication, compulsory measures with minimum harm to the rights and interests of such non-public agency may be taken (Paragraph 2)… For the entry, inspection or disposition set forth in Paragraph 1 and 2, a non-public agency and its relevant personnel shall not evade, impede or refuse (Paragraph 4).”  Therefore, the government seeking to investigate violation of the Law by a specific company upon complaint by a citizen may request such company to provide necessary documents, data or items in accordance with Article 40 of the Administrative Procedure Law.  If it is deemed necessary or if such company is likely to violate the Law when it refuses to comply, the government may enter the premises of the company to investigate and render a disposition to preserve relevant evidence pursuant to Article 22, Paragraphs 1 and 2 of the Law.  If such company evades, impedes or refuses such investigation without justification, a fine of NT$20,000 to NT$200,000 may be imposed (compare Paragraph 4 of Article 22 and Article 49 of the Law).