Complaint Case Notes

編號: 0109/2012/IP

標題: Duplicate copy of the old working permit placed inside the car

立案原因: Complaint


    The Office for Personal Data Protection (GPDP) has received J’s complaint, stating that according to his friends, two documents with his information were placed inside a car.  One of them is a copy of his old working permit, with his photo on it, and another one was his insurance document.  Therefore, J reported to the police. During investigation, a person who referred himself as K, the person in charge of Garage B, told the police that it was a second hand car purchased earlier.  However, he could not recall whether the two documents were already in the car during that time.
  J believed that Garage B publicly displayed the paper printed with his old working permit was actually the unlawful processing of his personal data, so he reported to the Office for Personal Data Protection (GPDP).


  The current case was referred by Department C to the GPDP.  The case information showed that after J’s report, the police came to the Garage to make a written record and took some photos. 
  When K, the person in charge of the Garage, was making the record, he expressed that he has not checked the identity of the car owner while purchasing the car.  He was not certain if the working permit was already in the car when he purchased it.  For the copy of the working permit, it was a scrap paper the staff used to label the price and no one noticed what was contained on it.  
  According to K, the staff only used the scrap paper, which contained J’s personal data, to label the car price. The staff did not notice what was contained therein.  Normally K used scrap papers to label car prices, and would stick these papers inside the car.  Thus, no evidence showed that Garage B has recorded J’s personal data, in addition that the present information was insufficient to prove that Garage B would automatically process all of, or part of, J’s personal data, nor it would prove that non-automatic means were used to process J’s personal data which has already existed or will exist in manually operated databases.  In this case, Garage B’s processing of personal data of J, which contained on the scrap paper, did not conform with the application scope of Article 3 of the Personal Data Protection Act (PDPA, or Law 8/2005), hence this Law does not apply to the current case.


    To sum up, since the PDPA does not apply to the how Garage B used the scrap paper, which contained the complainant’s personal data.  Furthermore, Garage B has already returned those papers to J, and also promised that scrap papers containing personal data would not be used anymore.  The GPDP has already reminded Garage B that any scrap papers containing personal data shall be handled properly, e.g. discarded documents that holds personal data should always be shredded.  Hence, this case has been closed.  The GPDP has already informed J and Garage B of the investigation result.  At the same time, J has been told that if he worried about any harm done to his portrait rights, he may seek the protections from court through civil actions on the legal grounds according to the Civil Code.

Please refer to "Personal Data Protection Act", articles 3 and 4.