Newsletter
MOHW proposes restrictions on cross-border transfer of personal data to China by Drug Wholesalers and Retailers
The Taiwan Personal Data Protection Act (“PDPA”) generally permits cross-border transfers of personal data. Nonetheless, Article 21 of the PDPA authorizes industry regulators to restrict cross-border transfers of personal data under certain circumstances. On February 19, 2024, the Ministry of Health and Welfare (“MOHW”) proposed a draft ruling prohibiting drug wholesalers and retailers from transferring personal data to China due to the inadequacy of its personal data protection laws, except under any of the following circumstances:
1. The data subject cannot be identified directly or indirectly by the personal data.
2. The personal data is not obtained for conducting pharmaceutical business.
3. The data subject is an employee of the drug wholesaler /retailer, or the drug wholesaler/retailer obtained the personal data while dealing with its service providers/business partners or handling intra-company affairs.
4. The drug wholesaler’s/retailer’s headquarters or parent company has in place binding corporate rules, standard data protection clauses, or codes of conduct, or has obtained specific certification in accordance with the EU General Data Protection Regulation.
5. The drug wholesaler/retailer collected or processed the personal data while performing clinical trials, or the personal data was obtained by the drug wholesaler/retailer for clinical trials of Taiwan-developed products and transferred to Chinese institutions for them to collect, process, or use for performing clinical trials, and in compliance with the relevant regulations.
6. The drug wholesaler/retailer collected or processed the personal data for drug safety reporting, or the personal data was obtained by the drug wholesaler/retailer for drug safety surveillance requirements in Taiwan and transferred to Chinese institutions for them to collect, process, or use for drug safety surveillance, and in compliance with the relevant regulations.
7. The personal data was collected or processed by the drug wholesaler/retailer to report to Chinese health authorities as required by such authorities or according to drug-administration laws or regulations in China.
8. The drug wholesaler/retailer has mandated Chinese institutions to comply with the PDPA and other relevant regulations through standard contractual clauses.
9. The data subject has commissioned the drug wholesaler/retailer in writing to do so.
The draft ruling is now at the stage of public consultation but will take effect one year after its official promulgation. To avoid any potential disruption of cross-border data transfers in the future, drug wholesalers and retailers should be prepared in advance.