Regulations Governing Personal Data File Security Maintenance Plans and Processing Methods After Termination of Business for Online Retail Industry and Online Retailing Service Platform Article 9
Unless otherwise provided by the law, online retail industry shall formulate specific procedures and mechanisms for the following matters, and produce effective ways to maintain the operation:1.Inspection to ensure that the collection and processing of personal data conform to the legitimate circumstances and specific purposes defined in these Regulations, Article 19, Paragraph 1 or conform to other lawful reasoning.2.Inspection to ensure that the use of personal data conforms to the specified purpose at the time of collection; or conforms to other specific purposes allowed by these Regulations; or conforms to other lawful reasoning. To use the personal data for purposes other than those to which the Parties have given written consent, the written consent shall be confirmed to comply with the Act, Article 7, Paragraph 2.3.Inspection to ensure that notification regarding obligations stipulated in Articles 8 and 9 of the Act are delivered via appropriate and convenient methods that are to the Parties. When there is an exemption from notifications, the legal basis for the exemption shall be verified.4.Inspection to ensure that, when using a Party’s data personal data for marketing purposes for the first time, the Party is provided with a channel to refuse marketing. The online retail industry shall pay all required fees for such.5.Inspection to ensure that when a Party refuses marketing, the use of the personal information for marketing is immediately terminated, and that relevant personnel are all notified or measures are adopted to prevent such personnel from reusing the data for marketing.6.Inspection to ensure that the collection, processing, and use of personal data comply with the provisions of the Act, Article 5.7.Before the international transfer of personal data, analysis of possible impacts and risks from the transfer shall be conducted, and appropriate security protection measures shall be taken.8.When the specified purpose no longer exists; the time limit expires; the circumstances defined in the Act, Article 19, Paragraph 2 apply; or the collection, processing, or use of personal data violates the provisions of the Act, then the collection, processing, or use of personal data shall be deleted or terminated in accordance with the law.9.If the specified purpose no longer exists or the time limit has expired but the processing or use of personal data is not to be deleted or stopped, the continuation shall be based on the necessity of conducting business and with the written consent of the Parties.10.Inspection to ensure that the personal data is correct. Disputes arising from the accuracy or incorrectness of data shall be handled in accordance with the provisions of the Act, Article 11, Paragraphs 1, 2, and 5.11.Regarding the exercise of the rights of the Parties listed in the Act, Article 3:(1)The means for the exercise of rights shall take into consideration the need for secure management of personal data and the convenience of the Parties.(2)Appropriate means of verification shall be adopted to confirm the identities of the Parties and their authorized representatives, or to require that the Parties or their authorized representatives provide explanations of their identities.(3)Fees may be charged for the cost of providing enquiries or making copies; however, the charges shall be stated in advance.(4)The deadlines stipulated in the provisions of these Regulations, Article 13 shall be observed.(5)In cases where the exercise of rights can be legitimately refused or the processing period can be extended, the Parties shall be provided with written notification regarding the reasons for the refusal or the reasons for the extension.12.Commissioning another party to conduct the collection, processing, or use of personal data in whole or in part, standards and evaluation mechanisms shall be in place for selecting and appointing the agents. In addition, appropriate methods of supervision shall be clearly stipulated in the agent contract or related documents and shall be implemented accordingly.13.When ommissioning by others to process personal data in whole or in part, and if the instruction of the entrusting organization violates the Act or other personal data protection laws and regulations, the entrusting organization shall be notified immediately.Online retail industry that transfer Parties’ personal data internationally shall check whether restrictions by the Ministry apply, and shall inform the Ministry regarding the region where the personal data is to be transferred. In addition, they shall supervise the data recipients with regard to the following:1. The planned scope, category, specific purpose, time period, territory, recipients, and methods of the processing or use of personal data.2. Matters related to the Parties' exercising of rights prescribed in the Article 3 of the Act.
中文原文 網際網路零售業及網際網路零售服務平台業個人資料檔案安全維護計畫及業務終止後個人資料處理作業辦法第9條
除法律另有規定外，網際網路零售業應就下列事項訂定具體程序或機制，並提出有效方式維持其運作：
一、檢視個人資料之蒐集、處理，符合本法第十九條第一項所定之法定情形及特定目的，或有其他合法事由。
二、檢視個人資料之利用，符合蒐集時之特定目的，或符合本法所定得為特定目的外利用之情形，或有其他合法事由；依當事人書面同意而為特定目的外利用者，應確認已符合本法第七條第二項有關書面同意之規定。
三、檢視已依便利當事人之適當方式，踐行本法第八條及第九條所定之告知義務；如有免為告知之情形，應確認其合法依據。
四、檢視已於首次行銷時提供當事人表示拒絕行銷之管道，並由網際網路零售業支付所需費用。
五、檢視當事人已拒絕接受行銷時，即停止利用其個人資料為行銷，並周知所屬人員或採行防範所屬人員再次行銷之措施。
六、檢視個人資料之蒐集、處理、利用與本法第五條之規定相符。
七、對個人資料進行國際傳輸前，應針對該次傳輸進行可能之影響及風險分析，並採取適當安全保護措施。
八、於特定目的消失、期限屆滿、有本法第十九條第二項所定情形，或有違反本法規定而為個人資料之蒐集、處理或利用時，應依法刪除或停止蒐集、處理、利用個人資料。
九、如於特定目的消失或期限屆滿，而未刪除、停止處理或利用個人資料時，須因執行業務所必須或經當事人書面同意。
十、檢視個人資料是否正確，有不正確或正確性有爭議者，應分別情形依本法第十一條第一項、第二項及第五項之規定辦理。
十一、關於本法第三條所列當事人權利之行使事宜：
（一）提供行使權利之方式應考量個人資料安全管理之必要性及當事人之便利性。
（二）應依適當之方式確認，或請求當事人或代為行使權利之人說明，其確為當事人本人或有權代為行使權利之人。
（三）於提供查詢或製給複製本時，得收取成本費用，但應先明確告知。
（四）應遵守本法第十三條有關處理期限之規定。
（五）於得合法拒絕權利行使或得延長處理期限之情形，應將拒絕之理由或延長之原因，以書面通知當事人。
十二、委託他人蒐集、處理或利用個人資料之全部或一部時，應有選任受託人之標準及評估機制，且應於委託契約或相關文件明確約定適當之監督方式，並確實執行。
十三、受他人委託處理個人資料之全部或一部時，如認委託機關之指示有違反本法或其他個人資料保護相關法令者，應立即通知委託機關。
網際網路零售業將當事人個人資料作國際傳輸者，應檢視是否受本部限制，並且告知其個人資料所欲國際傳輸之區域，同時對資料接收方為下列事項之監督：
一、預定處理或利用個人資料之範圍、類別、特定目的、期間、地區、對象及方式。
二、當事人行使本法第三條所定權利之相關事項。
一、檢視個人資料之蒐集、處理，符合本法第十九條第一項所定之法定情形及特定目的，或有其他合法事由。
二、檢視個人資料之利用，符合蒐集時之特定目的，或符合本法所定得為特定目的外利用之情形，或有其他合法事由；依當事人書面同意而為特定目的外利用者，應確認已符合本法第七條第二項有關書面同意之規定。
三、檢視已依便利當事人之適當方式，踐行本法第八條及第九條所定之告知義務；如有免為告知之情形，應確認其合法依據。
四、檢視已於首次行銷時提供當事人表示拒絕行銷之管道，並由網際網路零售業支付所需費用。
五、檢視當事人已拒絕接受行銷時，即停止利用其個人資料為行銷，並周知所屬人員或採行防範所屬人員再次行銷之措施。
六、檢視個人資料之蒐集、處理、利用與本法第五條之規定相符。
七、對個人資料進行國際傳輸前，應針對該次傳輸進行可能之影響及風險分析，並採取適當安全保護措施。
八、於特定目的消失、期限屆滿、有本法第十九條第二項所定情形，或有違反本法規定而為個人資料之蒐集、處理或利用時，應依法刪除或停止蒐集、處理、利用個人資料。
九、如於特定目的消失或期限屆滿，而未刪除、停止處理或利用個人資料時，須因執行業務所必須或經當事人書面同意。
十、檢視個人資料是否正確，有不正確或正確性有爭議者，應分別情形依本法第十一條第一項、第二項及第五項之規定辦理。
十一、關於本法第三條所列當事人權利之行使事宜：
（一）提供行使權利之方式應考量個人資料安全管理之必要性及當事人之便利性。
（二）應依適當之方式確認，或請求當事人或代為行使權利之人說明，其確為當事人本人或有權代為行使權利之人。
（三）於提供查詢或製給複製本時，得收取成本費用，但應先明確告知。
（四）應遵守本法第十三條有關處理期限之規定。
（五）於得合法拒絕權利行使或得延長處理期限之情形，應將拒絕之理由或延長之原因，以書面通知當事人。
十二、委託他人蒐集、處理或利用個人資料之全部或一部時，應有選任受託人之標準及評估機制，且應於委託契約或相關文件明確約定適當之監督方式，並確實執行。
十三、受他人委託處理個人資料之全部或一部時，如認委託機關之指示有違反本法或其他個人資料保護相關法令者，應立即通知委託機關。
網際網路零售業將當事人個人資料作國際傳輸者，應檢視是否受本部限制，並且告知其個人資料所欲國際傳輸之區域，同時對資料接收方為下列事項之監督：
一、預定處理或利用個人資料之範圍、類別、特定目的、期間、地區、對象及方式。
二、當事人行使本法第三條所定權利之相關事項。