Personal Data Protection Act Article 37

An incorporated foundation or an incorporated charity that has been delegated litigation rights by data subjects shall be entitled to implement any and all acts pertaining to the lawsuit. However, the data subjects may set restrictions on the abandonment, withdrawal, or settlement relating to such lawsuit.The restrictions set by one of the data subjects referred to in the preceding paragraph have no effect on the other data subjects.The restrictions referred to in paragraph 1 shall be specified in the documents identified in paragraph 1 of Article 34, or shall be submitted to the court in writing.
中文原文 個人資料保護法第37條
財團法人或公益社團法人就當事人授與訴訟實施權之事件,有為一切訴訟行為之權。
但當事人得限制其為捨棄、撤回或和解。
前項當事人中一人所為之限制,其效力不及於其他當事人。
第一項之限制,應於第三十四條第一項之文書內表明,或以書狀提出於法院。

English translation for reference only; the Chinese text prevails. Not legal advice.