社會福利機構個人資料檔案安全維護計畫實施辦法

The Regulations are enacted in accordance with Paragraph 3, Article 27 of the Personal Data Protection Act (herein after referred to as the “Act”).

For purposes of the Regulations, the term “competent authority” shall mean the Ministry of Health and Welfare at the central government level, the municipal governments at the municipal level, and the county/city governments at the county/city level.

1The terms used herein are defined as follows:

2I. The social welfare organizations refer to the following organizations:

3(1) Organizations established pursuant to the Regulations for the Establishment and Permission of Private Children and Youth Welfare Institutes, equipped with more than 95 authorized beds.

4(2) Organizations established pursuant to the Regulations for the Permit and Management Regulations for the Establishment of Private Senior Citizens’ Welfare Institutions, equipped with more than 200 authorized beds.

5(3) Organizations established pursuant to the Regulations for the Permit and Management Regulations for the Establishment of Private Mental and Physical Disabilities Welfare Organizations, equipped with more than 200 authorized beds.

6II. Responsible Person: Personnel designated by the social welfare organizations to be responsible for establishing and implementing personal information file security and maintenance plans (herein after referred to as the “Security and Maintenance Plan”).

7III. Subordinate: Personnel of the social welfare organizations that come in contact with personal information in the course of performing professional duty.

8IV. Auditor: Personnel designated by the social welfare organizations to be responsible for auditing the implementation and results of the Security and Maintenance Plan.

1The social welfare organizations shall establish the Security and Maintenance Plan specifying the following matters in accordance with the Regulations:

2I. The internal control procedures for the collection, processing, and use of personal information.

3II. The scope and items of personal information.

4III. The management of information security and personnel.

5IV. The mechanisms of preventing, reporting, and responding to information leakage.

6V. Management of facility security.

7VI. The audit mechanisms of data security.

8VII. Preservation of access records, log files, and relevant evidence.

9VIII. Measures for processing personal information upon termination of the business.

10

The social welfare organizations shall make reasonable distribution of operational resources for planning, establishing, reviewing, and revising the security and maintenance measures based on the scale and characteristics of their business and include these measures in the Security and Maintenance Plan to ensure the security maintenance and management of personal information and prevent personal information from being stolen, altered, damaged, destroyed, or disclosed.

The responsible person is responsible for planning, establishing, revising, and implementing the Security and Maintenance Plan, the measures for processing personal information upon termination of the business and related matters. The responsible person shall periodically submit a report to the social welfare organizations.

1The social welfare organizations shall identify the specific purpose and necessity of collecting the personal information, define the category or scope of personal information collection, processing, and use, and periodically check the status of personal information in its keeping, while establishing the internal control procedures for the collection, processing, and use of personal information in Article 4, Subparagraph 1, as well as the scope and items of personal information in Subparagraph 2.

2If the social welfare organizations find personal information that is not within the necessary scope for the specific purpose or the specific purpose has disappeared, or that no longer needs to be retained due to expiration of the retention period, then said information shall be deleted or destroyed, or collection, processing or use thereof should be discontinued, or the information shall be handled in any other manner.

1The social welfare organizations shall comply with the category and scope specified in Paragraph 1 of the preceding article while collecting personal information.

2The social welfare organizations shall take necessary protection measures to prevent information leakage while transferring personal information.

The social welfare organizations shall comply with the obligation of notification specified in Articles 8 and 9 herein when collecting personal information, and shall also establish the notification method, contents, and notices for direct collection or indirect collection, and shall require their subordinates to comply with the same.

1Before transferring the personal information internationally, the social welfare organizations shall check whether it is restricted by the central authority, and inform the subject of the country or region to which the information is intended to be transferred:

2I. The planned scope, category, specific purpose, time period, territory, recipient, and method for processing or use of personal information.

3II. Matters related to the concerned party's exercise of the rights set forth in Article 3 herein.

1The management measures of information security and personnel established by the social welfare organizations in Article 4, Subparagraph 3 herein shall include the following matters:

2I. Establish management mechanisms based on business needs, set different access rights for subordinates to control their access to personal information, and periodically verify the appropriateness and necessity of access rights.

3II. Examine the nature of businesses and designate personnel responsible for personal information collection, processing, use, and other procedures.

4III. Require subordinates to properly retain storage media containing personal information and agree on safekeeping and confidentiality obligations.

5IV. Cancel the ID number of subordinates upon termination of employment; require subordinates to hand over documents and information obtained from performance of job duty and prohibit them from taking away or using the documents and data upon termination of employment; and also require them to sign the non-disclosure agreement.

1The social welfare organizations shall establish a mechanism for prevention, notification, and response to incidents in accordance with Article 4, Paragraph 4, which shall include the following matters:

2I. Take appropriate measures to control the damage caused by the accident and notify the competent authorities of the municipal city, city, or county (city) competent authorities and the central government within 72 hours from the time the accident is discovered.

3II. Identify the cause of the incident and the damage, and notify the parties involved or their legal representatives.

4III. Formulate improvement measures to prevent recurrence of the incident.

5In the event of theft, disclosure, tampering, or other infringement of personal information, the social welfare organizations shall follow the mechanism for prevention, notification, and response to incidents referred to in the preceding paragraph to promptly address the situation and protect the rights and interests of the parties involved.

6In the event of the incident referred to in the preceding paragraph, the competent authorities shall, in accordance with the provisions of Article 22, Paragraph 1 herein, enter the organizations for inspection, order the relevant personnel to provide the necessary explanation, ask for cooperation or provision of relevant evidence, and take further actions depending on the inspection result.

7

1The management measures of equipment security established by the social welfare organizations in Article 4, Subparagraph 5 herein shall include the following matters:

2I. Security protection facilities and management procedures for hard copies of data files.

3II. Security systems or encryption mechanisms installed on computers or automated machines for storing electronic files.

4III. Establish procedures for destroying hard copies of documents.

5IV. Suitable measures for preventing personal information from being disclosed must be taken when computers, automated machines, or other storage media is to be discarded, replaced, or used for other purposes.

Auditors shall regularly or irregularly audit the implementation status and results of the Security and Maintenance Plan in accordance with Article 4, Subparagraph 6, and report audit results to the social welfare organizations, if necessary.

1The preservation measures of access records, log files, and relevant evidence established by the social welfare organizations in Article 4, Subparagraph 7 herein shall include the following matters:

2I. Retention of personal information access records.

3II. Retention of log files of automated machines or other relevant evidence.

4III. Measures for preservation of the logs and evidence referred to in the preceding two subparagraphs.

1The measures for processing personal information upon termination of the business established by the social welfare organizations in Article 4, Subparagraph 8 herein shall include the following matters:

2I. Destruction: Method, time, place, and proof of destruction.

3II. Transfer: Reason, subject, method, time, place, and legal basis for the transferee to retain the personal information.

4III. Delete or Discontinue to Process or Use: Method, time, or place.

5The measures in the preceding paragraph shall be documented, and retained for at least five years, unless otherwise provided by laws.

The social welfare organizations shall take into account the implementation status of the Security and Maintenance Plan, technological developments, amendments to laws and regulations, or other factors when establishing the integrated and persistent improvement plan on the security and maintenance of personal information in accordance with Article 4, Subparagraph 9. The social welfare organizations shall examine the appropriateness of the Security and Maintenance Plan regularly and revise it when necessary.

1The social welfare organizations which use any cyber security service system to collect, process, and use personal information shall adopt the following information security measures:

2I. User identity confirmation and protection mechanism.

3II. Data masking mechanism for personal information display.

4III. Security encryption mechanism for Internet data transmission.

5IV. Access control and protection monitoring measures for personal information files and databases.

6V. Prevention mechanism of external network intrusion.

7VI. The monitoring and response mechanism against illegal or abnormal access to the system.

8The countermeasures and mechanism referred to in Paragraph 1, Subparagraphs 5 and 6 shall be regularly practiced and reviewed for improvement.

The social welfare organizations shall complete the establishment and implementation of the Security Maintenance Plan within one year upon promulgation and implementation of the Regulations. The competent authorities may send their personnel to conduct inspection periodically.

The Regulations shall be enforced as of the date of promulgation.