The Act includes two sets of information privacy rules, one for `public institutions', and the other for all `non-public institutions'. All private sector organisations are covered if they collect or process by computer personal data. The information privacy rules are very similar to those found in the OECD guidelines, EU Directive and many national laws. In relation to each of the public and private sectors, articles of the law cover specification of system purposes, collection limitations, use limitations (`use' being defined to include disclosure), openness (registration and publication of system details), individual access, correction rights, accuracy obligations, and an obligation to appoint a data controller. Unlicensed businesses cannot be involved in the collection or use of personal information.
The enforcement provisions seem quite strong. Individuals can obtain compensation for breach of the information privacy rules, including for damage to reputation. Where public institutions are involved, the only defences are `acts of god, accidents, or other causes of force majeure', whereas with the private sector the defendant may prove `that it has no intention or fault'. Complaints are made to the supervising authority for the particular sector, as there is no single `privacy authority' under the Act. Sixty five professional institutions have been appointed to act as infringement verification institutions. Numerous criminal offences are also included (Chapter 5). The Ministry of Justice is responsible for overall coordination (A 41). There is provision for audits of private organisations (A 25). Organisations generally have one year to obtain any registrations or permissions under the law (A 42).
[82] Derived from an English translation and comments by Lee and Li, lawyers, Taiwan