With the increasing frequency of global data exchange, the importance of personal data protection has become more prominent. The Institute for Information Industry (III) serves as the Accountability Agent for the Cross-Border Privacy Rules (CBPR), being the only organization in Taiwan responsible for conducting third-party verifications for CBPR. Using the "Taiwan Personal Information Protection and Administration System" (TPIPAS) as a foundation, III assists enterprises in gradually aligning with international privacy protection requirements under CBPR. Notably, III offers the service helping clients gain two certifications in one verification process. For instance, III helped Taiwan Depository & Clearing Corporation (TDCC) officially pass the Cross-Border Privacy Rules (CBPR) verification on 12th April, 2023, making it the first enterprise in Taiwan to obtain both CBPR and TPIPAS certifications. A certification ceremony for the Cross-Border Privacy Rules (CBPR) was held on 7th July to mark this achievement.
The Science and Technology Law Institute (STLI) of the Institute for Information has long studied issues related to privacy law compliance. Since 2010, III has implemented the TPIPAS verification mechanism, serving as a regular check-up for enterprises to evaluate the effectiveness of their personal data systems. This provides credible evidence of an enterprise's data management capabilities. Under the TPIPAS standards, enterprises can easily align with CBPR, obtaining both domestic and international data privacy certification through a single verification process.
CBPR is an international personal data protection standard that is conducive to the establishment of common data privacy regulations in regional markets and beneficial to member countries in building secure and reliable cross-border privacy rules (CBPRs). As the sole accountability agent in Taiwan responsible for conducting CBPR verifications, the Institute for Information Industry (III) helps enterprises diagnose and optimize their processes. Through regular verifications, impartial external experts provide annual data privacy assessment reports, identifying areas that need improvement. By obtaining the CBPR certification, enterprises can demonstrate their data management capabilities on par with internationally renowned companies.
Since October 2012, Taiwan Depository & Clearing Corporation (TDCC) has proactively implemented Taiwan Personal Information Protection and Administration System (TPIPAS). On December 12, 2013, it was awarded the "Data Privacy Protection Mark" by the Ministry of Economic Affairs, becoming the first enterprise in the domestic securities and futures market to adopt the TPIPAS system. With over a decade of TPIPAS implementation experience as the foundation, TDCC has prioritized personal data protection as a critical task, providing fundamental safeguards for the stable operation of Taiwan's capital market and establishing a comprehensive risk management framework to oversee risk management affairs.
With the increasing demand for global cross-border data transmission and data sharing, Global CBPR Forum officially announced on April 30th this year that it will accept privacy enforcement authorities (PEA) from outside APEC to join the global privacy enforcement cooperation framework. New members include the UK Information Commissioner's Office, the Bermuda Privacy Commissioner's Office, and Dubai International Financial Centre Authority's Data Protection Commissioner’s Office. The Institute for Information Industry (III) will provide more diverse services regarding personal data privacy in the future, helping enterprises obtain global CBPR certification and align with international privacy protection standards.