The Central Election Commission recently released the property declaration information of candidates for county and city chiefs and parliamentarians. However, the Taiwan Forward Front disclosed today (28th) that the candidates’ ID card numbers were also leaked. Afterwards, the Selection Committee said it was "a mistake made by the outsourced manufacturer when producing the advertisement", and yesterday it blocked the further outflow of data. In this regard, Democratic Progressive Party legislator Chen Guanting said that management responsibilities should not be passed on to outsourced manufacturers, and the election committee is requested to clarify the possible scope of data exposure as soon as possible and review how to eliminate relevant risks to avoid the recurrence of personal data outflow incidents.
The Selection Committee explained today that in response to the personal information leakage incident raised by the outside world, after the Selection Committee learned the results, it was initially determined that the outsourced manufacturer included the identity card number in the non-public inquiry file when announcing the production information. The file was presented in a garbled format and could not be read by ordinary people. Regarding the cause and scope of the outsourced manufacturer's negligence, the Winning Select Committee has launched an investigation process and will conduct a more in-depth understanding. Subsequent handling will be carried out in accordance with the provisions of the Personal Data Protection Act.
Democratic Progressive Party legislator Chen Guanting said that government information systems involve a large amount of personal data, and information security protection cannot only rely on post-mortem repairs, nor can management responsibilities be passed on to outsourced vendors. He requested the Selection Committee to clarify as soon as possible the scope of possible exposure of the data, whether it has been obtained externally, as well as the management responsibilities of outsourced vendors and competent authorities, and comprehensively review the system acceptance and information security audit mechanisms. Even if the winning association has completed the system correction, it does not mean that the relevant risks have been completely eliminated. The government must confirm whether data may have been improperly accessed and identify the cause of the problem in order to prevent similar incidents from happening again.
Chen Guanting pointed out that information security and sensitive information protection have always been issues that he continues to pay attention to in the Legislative Yuan. As early as April 2024, when it was reported that confidential documents from the Ministry of Foreign Affairs were suspected to be peddled on the dark web, he asked the government to actively investigate and strengthen inter-ministerial information security management. In October of the same year, the Ministry of National Defense experienced a leak of personal information of military intelligence personnel. He also demanded a thorough investigation of the time of the leak, the number of people involved, and the scope of the impact, and to hold relevant management and supervision responsibilities accountable. Instead of just dealing with those directly involved in the case.
Chen Guanting said that he also promoted system improvement through legal amendments. In April 2025, he took the lead in proposing the "Draft Amendment to Certain Articles of the Information Security Management Law", which requires outsourced construction and maintenance of information systems by government agencies to establish effective information security management mechanisms and implement supervision by the competent authorities. At the same time, the rights and obligations of both parties and liability for breach of contract are clearly regulated through written contracts. The bill has now completed its third reading.
Chen Guanting said that the core of these amendments is to require the government to establish a complete information security responsibility system from system design, outsourcing management to accident response. In particular, during the development and testing stages of government information systems, the principle of data minimization and access rights management should be implemented. We should not wait until problems are exposed to the outside world to discover that unnecessary sensitive information is still retained in the system.
Chen Guanting emphasized that there is no conflict between the disclosure of election information and the protection of personal information. The government has the responsibility to take into account the transparency of elections and the basic rights and interests of candidates. "Information security is the most basic responsibility of government governance." Only by implementing the existing legal system and strengthening daily supervision can the people's trust in government information security and election work be truly maintained.
