Article 6
Personal information of medical records, medical treatment, genetic information, sexual life, health examination and criminal records should not be collected, processed or used. However, the following situations are not subject to the limits set in the preceding sentence:
1. when in accordance with law;
2. when it is necessary for a government agency to perform its legal duties or for a non-government agency to fulfill its legal obligation, and proper security measures are adopted prior or subsequent to such collection, processing or use;
3. when the Party has disclosed such information by himself, or when the information concerned has been publicized legally;
4. where it is necessary to perform statistical or other academic research, a government agency or an academic research institution collects, processes, or uses personal information for the purpose of medical treatment, public health, or crime prevention.The information may not lead to the identification of a certain person after its processing by the provider, or from the disclosure by the collector;
5. where it is necessary to assist a government agency in performing its legal duties or a non-government agency in fulfilling its legal obligations, and proper security measures are adopted prior or subsequent to such collection, processing, or use;
6. where the Party has consented in writing; unless such consent exceeds the necessary scope of the specific purpose; the collection, processing or use merely with the consent of the Party is prohibited by other statutes; or such consent is against the Party’s will.
Article 8 and Article 9 shall apply mutatis mutandis to the collection, processing, or use of personal information in accordance with the preceding Paragraph; Paragraphs 1, 2 and 4 of Article 7 shall apply mutatis mutandis to the written consent specified in Item 6 of the preceding Paragraph. The notification should be in written form.

Article 7
The consent mentioned in Item 2 of Article 15 and Item 5 of Paragraph 1 of Article 19 means a declaration of intention made by the Party to allow the collection or processing of personal information after notification is given by the collector in accordance with this Act.
The consent mentioned in Item 7 of Article 16 and Item 6 of Paragraph 1 of Article 20 means a separate declaration of intention made by the Party to allow the use of personal information after the collector has expressly notified the Party of the purpose other than the originally-specified purpose, and the scope of use, and also the impact of whether consent is given or not on the Party’s rights and interests.
The Party’s consent may be presumed given pursuant to Item 2 of Article 15 and Item 5 of Paragraph 1 of Article 19 if the Party does not indicate any refusal, and also provides his/her personal information, when a government or non-government agency gives express notice to the Party in accordance with Paragraph 1 of Article 8.
The collector shall have the burden of proving that the Party has given the consent under this Act.

Article 8
The following items should be told precisely to the Party by a government agency or non-government agency, in accordance with Article 15 or Article 19:
1. the name of the government agency or the non-government agency;
2. purpose of collection;
3. classification of the personal information;
4. time period, area, target and way of the use of personal information;
5. rights of the Party and ways to exercise them as prescribed in Article 3;
6. the influence on his rights and interests while the Party chooses not to provide his personal information;
The following situations may be exempted from the notice prescribed in the preceding Paragraph:
1. when in accordance with law;
2. when the collection of personal information is necessary for the government agency to perform its official duties or the non government agency to fulfill the legal obligation;
3. when the notice will impair the government agency in performing its official duties;
4. when the notice will impair public interests.
5. when the Party should have known the content of the notification already;
6. when the collection of personal information is for non-profit purposes and clearly does not cause any detriment to the Party.

Article 11
The government agency or the non-government agency should ensure the accuracy of personal information, and correct or supplement it, ex officio or upon the request of the Party.
In the event of a dispute regarding the accuracy of personal information, its processing or use shall be ceased voluntarily or upon the request of the Party,unless the processing or use is either necessary for the performance of an official duty or fulfillment of a legal obligation,or agreed to by the Party in writing, and the dispute has been recorded.
The information collected should be deleted, discontinued to process or use, ex officio or upon the request of the Party when the specific purpose no longer exists or time period expires. However, the preceding sentence may not be applicable when it is necessary for the performance of an official duty or fulfillment of a legal obligation and has been recorded, or when it is agreed by the Party in writing.
The information collected should be deleted, discontinued to process or use, ex officio or upon the request of the Party in the cases where a violation of this Law occurred during collecting, processing or using that information.
In the cases where the government agency or the non-government agency should be attributed to of not correcting or supplementing personal information, persons to whom the personal information was provided should be notified after correction or supplement.

Article 15
Except the information stated in Paragraph 1 of Article 6, the government agency should not collect or process personal information unless there is a specific purpose and should comply with one of the following conditions:
1. it is within the scope of job functions provided by laws and regulations;
2. consent has been given by the Party;
3. the rights and interests of the Party may not be harmed.

Article 16
Except the information stated in Paragraph 1 of Article 6, the government agency should use the personal information in accordance with the scope of its job functions provided by laws and regulations, and in compliance with the specific purpose of collection. However, the information may be used outside the scope upon the occurrence of one of the following conditions:
1. Where in accordance with law;
2. Where it is for national security or to promote public interests;
3. Where it is to prevent harm on the life, body, freedom or property of the Party;
4. Where it is to prevent harm on the rights and interests of other people;
5. Where it is necessary for public interests on statistics or the purpose of academic research conducted by a government agency or an academic research institution, respectively. The information may not lead to the identification of a certain person after the treatment of the provider or the disclosure of the collector;
6. Where such use may benefit the Party; and
7. A written consent of the Party has been obtained.

Article 19
Except the information stated in Paragraph 1 of Article 6, the non-government agency should not collect or process personal information unless there is a specific purpose and should comply with one of the following conditions:
1. it is in accordance with law;
2. there is a contractual or quasi-contractual relationship between the Parties, and proper security measures have been adopted;
3. the Party has disclosed such information by himself or when the information has been publicized legally;
4. it is necessary for public interests on statistics or the purpose of academic research conducted by a research institution. The information may not lead to the identification of a certain person after its processing by the provider, or from the disclosure by the collector;
5. consent has been given by the Party;
6. it is necessary to promote public interests;
7. the personal information is obtained from publicly available resources. However, it is exempted if the information is limited by the Party on the processing or use and the interests of the Party should be protected;
8. the rights and interests of the Party are not harmed.
By the time when the collector or processor realizes or has been notified of the provision in Item 7 of the preceding Paragraph by the Party, he should delete, stop processing or using the personal information, ex officio or upon the request of the Party.

Article 20
Except the information stated in Paragraph 1 of Article 6, the non-government agency should use the personal information in accordance with the scope of the specific purpose of collection provided. However, the information may be used outside the scope upon the occurrence of one of the following conditions:
1. it is in accordance with law;
2. it is necessary to promote public interests;
3. it is to prevent harm on the life, body, freedom or property of the Party;
4. it is to prevent harm on the rights and interests of other people;
5. it is necessary for public interests on statistics or the purpose of academic research conducted by a government agency or an academic research institution, respectively.The information may not lead to the identification of a certain person after its processing by the provider, or from the disclosure by the collector;
6. consent has been given by the Party;
7. such use benefits the Party.
When the non-government agency uses the personal information for the purpose of marketing pursuant to the preceding Paragraph and has been turned down by the Party, the agency should stop its action.
The non-government agency should notify the Party the measures of refusal at the first marketing action and should pay for fees necessary.

Article 41
Any person who, with the intention to acquire illegal profits for himself/herself or a third party, or to impair other person’s interests,violates Paragraph 1 of Article 6, Articles 15, 16, 17, 19, and Paragraph 1 of Article 20, or an order or disciplinary action of limitation on international transmission made by the competent authority in charge of the subject industry at the central government level in accordance with Article 21, which violation if sufficient to harm other people’s rights, shall be subject to imprisonment for not more than five years or a fine of not more than NT$1,000,000, or both.

Article 45
The offenses referred to in this Chapter should be instituted only upon a complaint, except offenses specified in Article 41 and those against a government agency in Article 42.

Article 53
The Ministry of Justice shall, in conjunction with the competent authority in charge of the subject industry at the central government level, prescribe, and provide government and non-government agencies for reference and use with, the specific purpose and the classification of personal information.

Article 54
After the enforcement of the amendments to this Act on December 15, 2015, any processing or use of personal information that was furnished before the amendments to this Act on May 26, 2010 not by the Party, shall be notified to the Party pursuant to Article 9 before such processing or use.
The notification prescribed in the preceding Paragraph may be given at the time where such personal information is first used after the enforcement of the amendments to this Act on 15 December, 2015.
Any use of personal information without notification given in accordance with the preceding two Paragraphs is deemed and punished as a violation of Article 9.