Newsletter
NDC Promulgated the Guidelines on Refusal to Commercial Marketing for Non-Government Agencies’ Reference
According to Paragraphs 2 and 3, Article 20 of the Personal Data Protection Act, where a non-government agency uses a data subject’s personal data for marketing purposes for the first time (regardless of whether or not such use is compatible with the purposes for which the data was collected), it should provide a mechanism for the data subject to object to the marketing free of charge and then cease to use his/her personal data for marketing purposes upon his/her objection.
Considering that it is common for non-government agencies to use personal data to promote specific products/services and to seek trading opportunities from data subjects (“Commercial Marketing”), on June 13, 2023, the National Development Council (“NDC”) promulgated the Guidelines on Refusal to Commercial Marketing, identifying the matters that require non-government agencies’ attention before, during, and after data subjects exercise their rights to refuse Commercial Marketing as follows:
1. Before data subjects exercise their right to refuse Commercial Marketing
Where non-government agencies use personal data for Commercial Marketing purposes for the first time, the non-government agencies shall proactively disclose their names and provide data subjects with free, fast, and easy ways (e.g., toll-free numbers, text messages, e-mail addresses, customer service URLs on their website, or an opt-out mechanism in their application) to express their refusal to Commercial Marketing. Non-government agencies should still proactively disclose their names when conducting subsequent Commercial Marketing and are recommended to continue to disclose the information on refusal to Commercial Marketing in a clear and easy-to-understand way and placed in a prominent and easy-to-access position (e.g., disclosing such information on their website).
2. When data subjects exercise their right to refuse Commercial Marketing
Where a non-government agency uses a data subject’s personal data for Commercial Marketing purposes, the data subject has the right to refuse such Commercial Marketing without any reason and at any time; such right to refusal will not be limited to the first time that the non-government agency uses the data subject’s personal data to conduct Commercial Marketing. Non-government agencies shall respect data subjects’ intention to refuse Commercial Marketing and then cease Commercial Marketing based on their will and the scope of their refusal. Unless data subjects indicate otherwise to non-government agencies or change their minds, such non-government agencies shall no longer use their personal data to conduct any Commercial Marketing. In addition, the methods by which data subjects can exercise the right to refuse Commercial Marketing shall not be limited to those provided by non-government agencies, and such non-government agencies shall not refuse to cease Commercial Marketing even though the data subjects did not use the methods to refuse Commercial Marketing provided by them.
3. After data subjects exercise their right to refuse Commercial Marketing
Non-government agencies shall record, update, and compile data subjects’ requests to refuse Commercial Marketing and reply to the data subjects that they have received their requests. At the same time, non-government agencies should inform their personnel and/or commissioned agencies at the earliest that they shall no longer use those data subjects’ personal data to conduct Commercial Marketing.
Besides the abovementioned significant matters, if a non-government agency commissions others to use personal data for Commercial Marketing purposes, such non-government agency should take appropriate supervision measures (such as including clauses regulating Commercial Marketing in the commission contract) to ensure that the commissioned agency handles data subjects’ refusal to Commercial Marketing accordingly.