Law Library Stacks

Back to Index of of Legal Reports
Back to Comparative Summary

Full Report (PDF, 2.78MB)
Map: COVID-19 Contact Tracing Apps (PDF, 550KB)

Jurisdictions Surveyed:
The Americas: Argentina | Brazil | Mexico
East Asia, South Asia and Pacific: Australia | China | India | Japan | South Korea | Taiwan
Europe and Central Asia: European Union | England | France | Iceland | Italy | Norway | Portugal | Russia | Spain | Turkey
Middle East and Africa: Iran | Israel | South Africa | United Arab Emirates

Taiwan

Under Taiwan’s Personal Data Protection Act 2015 (PDPA), the collection, processing, and use of personal data must be carried out in an honest and good-faith manner that respects the data subject’s rights and interests, does not exceed the necessary scope of the specific purposes, and has a legitimate and reasonable connection with the purposes of collection. Both government and nongovernment agencies are required to delete personal data when the specific purpose of data collection no longer exists or the retention period ends.

In response to COVID-19, Taiwan launched the Digital Fence Intelligent Monitoring System, known as the “digital fence,” in February 2020, to monitor the location of those required to undergo home quarantine via their own cellphones or government-issued cellphones, with the goal of preventing their movement and stopping the spread of the infection. Taiwan implemented a mandatory 14-day home quarantine for the contacts of confirmed cases and all overseas arrivals.

The government has acknowledged that cellphone location data is protected by the PDPA. It reportedly argues, however, that it is within the necessary scope of the government’s performance of its statutory duties to subject location data to regulation in the current circumstances; it notes that telecom companies are “furthering the public interest” by participating in the tracking effort and therefore are also exempt from liability. The tracking system will be discontinued after the pandemic passes and all stored personal data will be deleted at that time.

I. Introduction

Taiwan has won global praise for its effective control of the COVID-19 pandemic. As of May 22, 2020, a total of 441 confirmed cases of COVID-19 had been reported in Taiwan, including seven deaths, out of a population of almost 24 million.[1]

A highly tech-savvy democracy, Taiwan is believed to have implemented the first phone-based tracking system to enforce quarantine in the current pandemic. It began working on the system, described as a “digital fence,” as early as in late January 2020, a week after Taiwan recorded its first imported case of the novel coronavirus from China.[2] Although there have been concerns over data privacy, the public opinion in general firmly supports the government in its handling of the pandemic. A telephone poll conducted in mid-February by the Taiwanese Public Opinion Foundation found that people on average gave the government a score of 84 points out of 100 for its epidemic response.[3] In terms of smartphone usage, over 98% of the Taiwanese population owned smartphones as of 2019.[4]

II. Legal Framework

A. Privacy and Data Protection

The primary Taiwanese legislation governing the collection, process, and use of personal data is the Personal Data Protection Act 2015 (PDPA).[5] The PDPA provides two sets of data protection rules applying to government agencies and nongovernment agencies, respectively. Government agencies include central and local government and administrative entities that are authorized to exercise public authority. Nongovernment agencies include individuals, legal persons, and other entities that are not government agencies.[6]

Personal data under the PDPA include names, dates of birth, ID Card numbers, passport numbers, characteristics, fingerprints, marital status, family, education, occupation, medical records, medical treatment, genetic information, sexual life, health examinations, criminal records, contact information, financial situation, social activities, and other information or data that may be used to identify a natural person, directly or indirectly.[7]

According to the PDPA, the collection, processing, and use of personal data must be carried out in an honest and good-faith manner that respects the data subject’s rights and interests, does not exceed the necessary scope of the specific purposes, and has a legitimate and reasonable connection with the purposes of collection.[8]

Sensitive data under Taiwanese law may refer to medical records, medical treatment, genetic information, sexual life, health examinations, and criminal records. According to the PDPA, these data may not be collected, processed, or used unless expressly required by law or within an exception specified by the PDPA. One such exception concerns those cases where collection, processing, or use of sensitive data is within the necessary scope for a government agency to perform its statutory duties or for a nongovernment agency to fulfill its statutory obligations, provided that proper security and maintenance measures are adopted prior or subsequent to such collection, processing, or use of personal data.[9]

B. Data Retention and Location Tracking

Although location data is not specified by the PDPA as a form of personal data, it may be deemed “other information or data which may be used to identify a natural person,” and therefore subject to the requirements of the PDPA on the collection, processing, and use of personal data.  

Under the PDPA, the collection or processing of personal data by a government agency must be for specific purposes and on one of the following bases:

1. where it is within the necessary scope to perform its statutory duties;

2. where consent has been given by the data subject; or

3. where the rights and interests of the data subject will not be infringed upon.[10]

The collection or processing of personal data by a nongovernment agency must be for specific purposes and expressly required by law, consented to by the data subject, necessary for furthering the public interest, or on others grounds specified by the PDPA.[11]

Furthermore, a government agency may only use personal data within the necessary scope of its statutory duties and for the specific purpose of collection. The use of personal data for any other purposes must be on the following grounds:

1. where it is expressly required by law;

2. where it is necessary for ensuring national security or furthering public interest;

3. where it is to prevent harm to the life, body, freedom, or property of the data subject;

4. where it is to prevent material harm to the rights and interests of others;

5. where it is necessary for statistics gathering or academic research by a government agency or an academic institution for public interests, provided that such data, as processed by the data provider or as disclosed by the data collector, may not lead to the identification of a specific data subject;

6. where it is for the data subject’s rights and interests; or

7. where consent has been given by the data subject.[12]

A nongovernment agency may only use personal data within the necessary scope of the specific purpose of collection, or if it is expressly required by law, consented to by the data subject, necessary for furthering public interests, or on other grounds specified by the PDPA.[13]

Both government and nongovernment agencies are required by the PDPA to delete personal data, voluntarily or upon the request of the data subject, when the specific purpose of data collection no longer exists or the retention period ends.[14]

III. Electronic Measures to Fight COVID-19 Spread

A. Digital Fence and Entry Quarantine System

In response to the pandemic, Taiwan implemented a mandatory 14-day home quarantine for contacts of confirmed cases and all overseas arrivals and launched the Digital Fence Intelligent Monitoring System, known as the “digital fence,” in February 2020. The system monitors the location of those required to undergo home quarantine via their own cellphones or government-issued cellphones to prevent their movement and stop the spread of the infection.[15]

The telecom companies track the quarantined individuals by triangulating the location of their phones relative to nearby cell towers. Venturing too far from homes triggers the alert system, and text messages are sent to the quarantined individuals, government civil affairs and health authorities, and local police to ascertain their whereabouts. The government also contacts those in quarantine on a daily basis to ensure they do not evade tracking by leaving their phones at home. Anyone caught breaching their quarantine can be fined up to NT$1 million (about US$33,000).[16]

Taiwan has also launched an Entry Quarantine System that seeks to expedite entry of all international arrivals by requiring them to scan a QR code upon entering Taiwan and fill out a health declaration. This system has been integrated with the digital fence system, allowing hospitals, clinics, and pharmacies to gain access to patients’ travel histories.[17]

B. Government Response to Data Privacy Concerns

In response to concerns arising from the tracking system over data privacy, the government has reportedly cited the Communicable Disease Control Act and the Special Act for Prevention, Relief and Revitalization Measures for Severe Pneumonia with Novel Pathogens, which authorize the government to impose “necessary measures” in epidemic control.[18] The government has acknowledged that cellphone location data is protected by the PDPA. It argues, however, that it is within the necessary scope of the government’s performance of its statutory duties to subject location data to regulation and asserts that telecom companies are “furthering the public interest” and therefore also exempt from liability.

The government has said the tracking system will be discontinued after the pandemic passes and all stored personal data will be deleted at that time.[19]

Back to Top

Prepared by Laney Zhang
Foreign Law Specialist
June 2020


[1] CECC Reports No New Confirmed Cases; 408 Patients Released from Isolation, Taiwan Centers for Disease Control (Taiwan CEC) (May 22, 2020), https://perma.cc/QR83-WPH4; Mary Hui, How Taiwan Is Tracking 55,000 People under Home Quarantine in Real Time, Quartz (Apr. 1, 2020), https://perma.cc/9LAF-C8M4.

[2] Yasheng Huang et al., How Digital Contact Tracing Slowed Covid-19 in East Asia, Harvard Bus. Rev. (Apr. 15, 2020), https://perma.cc/HW3C-VJ73.

[3] Hui, supra note 1.

[4] Samantha Wong, Smartphone Market in Taiwan – Statistics & Facts, Statista (Apr. 20, 2020), https://perma.cc/UC9J-XFRG.

[5] Personal Data Protection Act (promulgated Aug. 11, 1995, amended Dec. 30, 2015), https://perma.cc/WM7B-PNED (in Chinese), https://perma.cc/MTB4-D9LX (English translation).

[6] Id. art. 2.

[7] Id.

[8] Id. art. 5.

[9] Id. art. 6.

[10] Id. art. 15.

[11] Id. art. 19.

[12] Id. art. 16.

[13] Id. art. 20.

[14] Id. art. 11.

[15] Lawfully Comply with 14-Day Home Quarantine, Protect Health of People, Taiwan CDC (Mar. 27, 2020), https://perma.cc/687T-9QFB (in Chinese).

[16] Id.; Hui supra note 1; Huang et al., supra note 2.

[17] Huang et al., supra note 2; To Integrate Entry Quarantine System with Digital Fence Intelligent Monitoring System, Tracking Whereabouts through Cellphone Location, Ministry of Health and Welfare (May 14, 2020), https://perma.cc/7TWF-92TF (in Chinese).

[18] Pai-ching Hou, Is the Digital Fence that Other Countries Are Striving to Imitate Unconstitutional? Questioned by Legal Professionals, Government Has Something to Say, The Storm Media (Apr. 17, 2020), https://perma.cc/XD8G-69SB (in Chinese).

[19] Id.

Last Updated: 12/30/2020