Enquiry Case Notes

編號: 0017/2014/PA

標題: Online inquiry system


    Bureau A enquired the Office for Personal Data Protection (GPDP) for its Authorization X, an online system checking application progress, to be added to its website in order to enhance timeliness and accuracy of its publishing of information.


    According to Article 4(1)(1) and Article 3(1) of the Personal Data Protection Act (PDPA, or Law 8/2005), processing of the related data should be governed by the same Law.
  As Bureau A failed to provide the information according to Article 23 of the PDPA, the GPDP will provide a general reply only.
  The GPDP is in the opinion that Bureau A satisfied the condition of legitimacy, based on the consent of the data subjects, given in Article 6 of the PDPA.
  According to the information provided by Bureau A, the result of the online check only revealed the ID number, date of birth and application progress, in addition to the data inputted and the progress, which did not violate the principle of proportionality as specified in Article 5(1)(3) of the PDPA.  However, according to Article 15 of the same Law, Bureau A should adopt proper technical and organizational measures to protect the personal data processed by the system.  To reduce the risk of damages to its data subjects should data leaks occur, Bureau A, for better protection, may consider the progress to be checked by inputting the receipt number or other preset passwords, instead of the ID numbers. 
  According to Article 21(1) of the PDPA, a data controller should notify its processing of personal data by automatic means to the GPDP, but Bureau A has not made any notifications for the said processing until now.  To this, Bureau A may notify the GPDP by completing the document Notification Form for Personal Data Processing - First Application.  On the other hand, it could update the registered notification with the Simplified Notification Form – Renewal or Update.

Please refer to "Personal Data Protection Act", articles 3, 4, 5, 6, 15, 21 and 23.