The Ministry of Transportation and Communications ('MOTC') announced, on 9 February 2023, that it had fined Heyun Mobile Service Co., Ltd. ('iRent') TWD 200,000 (approx. €5,900) for violations of Articles 27(1) and 27(2) of the Personal Data Protection Act 2010 (as amended in 2015) ('PDPA'), following a data breach.

Background to the case

Following from a data breach of iRent's users' personal information, the MOTC detailed that it had dispatched staff to conduct an inspection of iRent.

Findings of the MOTC

Following the inspection, the MOTC highlighted that iRent did not take appropriate security measures in accordance with the PDPA and the Personal Data File Security Maintenance Plan and Handling Methods for the Automobile Transportation Industry, resulting in the personal data breach. Moreover, the MOTC explained that due to iRent's failure to make corrections within the necessary time period, the number of individuals exposed to risks reached 400,000, and the circumstances were serious.

Outcomes

Consequently, the MOTC determined that iRent has violated Articles 27(1) and 27(2) of the PDPA and issued the maximum fine of TWD 200,000 (approx. €5,900) in accordance with Article 48(4) of the PDPA. Furthermore, the MOTC requested that iRent implement the relevant provisions of the PDPA and submit a complete and corrected supporting material before 28 February 2023, noting that if there is any violation of the PDPA in the subsequent investigation, a fine will be imposed on a case-by-case basis.

You can read the press release, only available in Chinese, here.