On May 30, 2023, the Ministry of Digital Development announced that it issued a fine of TWD 100,000 (approx. $3,250) to Eslite Life for violations of the Personal Data Protection Act 2010 (as amended in 2015) (PDPA), following a data breach.

Background to the case

In particular, the Ministry conducted an administrative inspection in accordance with Article 22 of the PDPA regarding the incident of personal information leakage involving Eslite Life.

Findings of the Ministry

Following its investigation, Eslite Life was instructed by the Ministry to make necessary corrections within a specified timeframe. Following the inspection, the Ministry found that Eslite Life failed to implement appropriate security measures as required by the PDPA and failed to rectify the situation within the given timeframe, thereby violating Article 27(1) of the PDPA.

Outcomes

Consequently, the Ministry fined Eslite Life TWD 100,000 for deficiencies in account management and incomplete personal information inventory. The inadequate supervision of outsourced manufacturers led to the penalty under Articles 48(4) and 50 of the PDPA.

In addition, the Ministry emphasized that it directed Eslite Life to comply with the provisions of the PDPA and instructed it to make corrections within the given timeframe. Moreover, the Ministry emphasized that failure to do so will result in further penalties. The Ministry also stressed the importance for all e-commerce operators to prioritize personal information protection. Additionally, the Ministry noted that it will introduce related solutions such as cryptographic technology and collaborate with e-commerce operators to continuously strengthen personal information protection measures.

You can read the press release, only available in Chinese, here.