RESTRICTED  
  
S/C/W/360  
 
13 May 2015  
(15-2524)  Page: 1/3  
Council for Trade in Services  Original: English  
 
 COMMUNICATION FROM THE SEPARA TE CUSTOMS TERRITORY OF  
TAIWAN, PENGHU, KINMEN AND MATSU 
PROTECTION OF PERSONAL INFORMATION AND THE DEVELOPMENT OF ELECTRONIC COMMERCE 
The following Communication from the delegation of the Separate Customs Territory of Taiwan, 
Penghu, Kinmen and Matsu, dated 11 May 2015, is being circulated to the Members of the Council for Trade in Services. 
 
_______________ 
  
1  INTRODUCTION 
1.1.  The new business mode of electronic commerce has in recent years rapidly become a major 
conduit for trade and commerce across the globe. In the case of the Separate Customs Territory of 
Taiwan, Penghu, Kinmen and Matsu, the sale s value of Business-to-Consumer (B-2-C) and 
Consumer-to-Consumer (C-2-C) electronic commerce (mainly on-line shopping) grew over 16% in 2013, reaching a total of US$25.5 billion. It is expected that the sales value will exceed US$30 
billion in 2015. Industry surveys suggest that grow th will remain strong in the foreseeable future, 
and this forecast does not yet include other new developments in our domestic market, such as cloud computing services and mobile applications. 
1.2.  To support the working program on electronic commerce, we circulated a proposal 
(JOB/SERV/140) on 13 March 2013 in order to share our experiences with a newly established 
regime for regulating and protecting the cross-border transmission of personal information. In the proposal document that we have submitted, we raise the following questions: (1) What are the 
experiences and best practices in international cooperation on the cross-border transfer and 
protection of personal information? (2) What are the criteria for deciding whether adequate and comparable levels of protection exist in the re ceiving member? Are there any exceptions to the 
principle of comparable level of protection? This concern on the protection of personal information 
is also shared by other WTO Members, as partially reflected in Document S/C/W/359 circulated by the United States in 2014. 
1.3.  The growing importance of mobile broadband in e-commerce was repeatedly highlighted 
during the Workshop on e-commerce in June 2013. To support an ultra-high-speed and ubiquitous 
wireless broadband environment and enhance the experience of mobile application services, we completed the auction for the 4th Generation (4G) mobile broadband service licenses in October 
2013. A total of six licenses were issued with a combined auction value of around US$3.96 billion. 
The first 4G operator launched services in May 2014, and the rest began offering services in the second half of 2014. We believe that as more and more people use these 4G services, the 
development of e-commerce, especially for mobile devices in our market, will be elevated to 
another level. 
1.4.  We created an “E-Commerce Development Ta skforce” in 2014. The task force consists of 
deputy ministers of 15 related ministries and engages in cross-ministerial coordination, resource 
integration, and legal and regulatory adjustments. In its first two meetings in 2014, the committee 
endorsed the “Action Plan on the Development of  E-commerce,” since this would help make us a 
hub for e-commerce innovation and crowdfunding. Meanwhile, the task force has been exploring 
new online services and nurture businesses that have a development niche in the virtual world as S/C/W/360  
 
- 2 - 
 
  well as the physical one by collecting industry opinions, in advance of adjusting and setting out 
policies. 
1.5.  E-commerce is essentially a mode of trans- border trading that uses the Internet as the 
enabling infrastructure. In our market, 20% of e- commerce suppliers have already expanded their 
serving areas to include overseas consumers, and some 16% more intend or plan to expand into 
cross-border provision in the next few years.  
1.6.  Cross-border provision of electronic commerce, including cloud computing and mobile 
application services, inevitably involves the movement of personal information from one territory 
to another territory. With the scope of services that can be offered electronically continuing to broaden, more and more sensitive personal information, such as financial data, personal IDs, education, employment and medical records, social  activities, and so on, will be transferred across 
different jurisdictions. This brings into the spotlight the issue of personal information and data 
protection across borders.  
2  PRIVACY PROTECTION INITIATIVES TO  ENHANCE CONFIDENCE IN E-COMMERCE  
2.1.  To regulate computer processing of personal  information, we brought into force the Computer 
Processing Personal Information Protection Act on  11 August 1995. The internationalization of e-
commerce had already become a global trend when we  recognized the importance of personal data 
protection during the e-commerce application process and made reference to the personal data 
regulation systems established in Japan, Korea, Germany, the UK, and other countries. In 2010, we began to promote the establishment of the Personal Information Protection and Administration System (PIPAS) as well as the certification mark for that system, “Data Privacy Protection Mark, 
DP Mark.” 
2.2.  However, because new technologies continued to emerge at a very rapid pace, it became 
necessary to enhance protections on personal information and privacy. We thus amended the 
Computer Processing Personal Information Protection Act, transforming it into the Personal 
Information Protection Act (PIPA) on 1 October 20 12. The PIPA regulates the collection, processing 
and use of personal information in order to prevent the violation of personal rights and to facilitate 
the proper use of personal information. 
2.3.  Among its requirements, the PIPA includes a provision regulating cross-border transmission 
of personal information. Specifically, Article 21 of  the PIPA stipulates that the transmission of 
lawfully obtained personal information by non-government agencies may be restricted if: (a) the 
country receiving the personal information lacks proper regulations aimed at the protection of 
personal information and the rights and interests of  the implicated party(ies) might be harmed, or 
(b) international transmission of personal information is made through an indirect method so as to 
circumvent the application of the Act. For the time being, decisions are determined on a case-by-
case basis by different competent authorities.  
2.4.  Our personal data protection laws stipulate that the gathering, processing, use, or 
international transmission of personal data must be done in an honest and trustworthy manner, 
may not exceed the scope that is necessary for the specified purpose, and must have a proper, reasonable connection with the purpose of the data collection. These are basic principles in the implementation of PIPAS, which embodies PIPA and relevant regulations. From the business 
perspective, PIPAS can help an enterprise conform to domestic personal data protection laws while 
meeting the demands of international organizations to protect personal data; it is conducive to the future expansion and implementation of cross-border e-commerce transactions. Meanwhile, among 
consumers, it can establish a sense of security with  regard to the gathering, processing, and use of 
their personal data and raise the level of their confidence and trust while using e-commerce. 
2.5.  The pilot program for PIPAS finished at th e end of 2012. In 2013, PIPAS started its formal 
implementation. At this stage, any enterprise can voluntarily apply for auditing as long as its 
internal personal information management systems have been established and met PIPAS requirements. As of February 2015, 17 enterprise s have received the authentication “DP Mark.” 
Furthermore, approximately 800 professionals ha ve received the “Certificate of Personal 
Information Management Professional,” and more than 200 of these gained further qualification as S/C/W/360 
 
- 3 - 
 
  “Internal Personal Information Management Auditors.” Meanwhile, more professionals are being 
trained to improve enterprises’ internal management of personal information. 
2.6.  In the process of promoting e-commerce, we find that e-commerce industries have to face 
diverse issues such as regulations, human resource s, policies, etc. Since these regulations include 
PIPA, we should assist these industries in adhering to it. Currently, we are mainly focused on 
promoting internet-retailing using PIPAS. To fulfill regulatory requirements, our domestic industries have established related procedures, especially when any controversy has occurred 
regarding a consumer’s personal data protection after PIPA’s enactment. The industries have 
accelerated their PIPAS establishment procedures. Besides using the services of professional consultants, they are also dispatching personnel to attend PIPAS training classes. They can go through the verification process and obtain the DP Mark in a short time. All of these measures can 
assist industries to understand what is permitted or not permitted in gathering, processing, or 
using personal data. Meanwhile, companies that have received the DP Mark authentication can also encourage their peers to use PIPAS as a way of avoiding controversies that can affect their 
reputations and consumer confidence. 
2.7.  As e-commerce becomes a mainstream of trade, there should be a balance between the 
development of e-commerce and the protection of consumers’ personal data; the public interest 
and commercial interests should both be taken into account. To adjust and develop relevant 
policies, we will continue to identify industries’ needs, evaluate trends in international e-commerce development, and adapt to new Internet and equipment technology. 
3   THE WAY FORWARD 
3.1.  In conclusion, we believe that the full potential of e-commerce has yet to be realized, and an 
appropriate policy environment is essential for that to happen. With the right policies in place, the 
benefits of e-commerce will definitely extend to the majority of consumers and industries. 
Furthermore, in addition to initiatives at the national level, multilateral coordination and 
cooperation will be equally important for the further promotion of e-commerce. 
 
__________