Regulations Governing Security Protection Plans for and Processing of Personal Information Files by Tourist Amusement Enterprises Article 16

A tourist amusement enterprise shall adopt the following mechanisms for response to theft, alteration, damage, destruction, disclosure or other such accident happening to personal information in its keeping:1.Adopt proper emergency measures to control and reduce harm from the accident to the person concerned, and notify the Tourism Bureau of the Ministry of Transportation and Communications and the local government at the special municipality, county or city level.2.Investigate the circumstances of the accident and notify the person concerned by appropriate means in accordance with the provisions of Article 12 of the Act. The content of such notification shall include the facts of personal information disclosure, responsive measures already taken, and the provision of a service line for telephone inquiry.3.Examine deficiencies and formulate preventive mechanisms to avoid the reoccurrence of such kind of accident.A tourist amusement enterprise shall notify the Tourism Bureau of the Ministry of Transportation and Communications and the local government at the special municipality, county or city level within three days of the occurrence of an accident as referred to in the preceding paragraph; and shall submit a report on its method of dealing with the accident and the outcome thereof to the Tourism Bureau of the Ministry of Transportation and Communications and the local government at the special municipality, county or city level, for reference filing, within one month of completing its response to the accident.