E-commerce technology service provider 91APP*-KY (6741) suffered a data security leak last month, involving a total of 1,329 brands and 4.798 million consumers. The Small and Medium Enterprise Administration of the Ministry of Economic Affairs warns that management consultants have a large amount of business customer operational data and should deploy protection mechanisms in advance to avoid incidents before taking remedial measures. They can first use the "Personal Data Security Self-Checklist" in the "Personal Data Protection and Management Practical Guidelines for the Management Consulting Industry" compiled by the Ministry of Economic Affairs last year to take stock of the current situation and strengthen gaps as preparation for administrative inspections.
The Enterprise Administration of China of the Ministry of Economic Affairs stated that in order to help management consultants respond to the new personal data protection law and the needs of customers' personal information protection, the "Personal Information Promotion and Seminar for the Management Consulting Industry" was held yesterday (4th), inviting experts in the information security and personal information fields to share and help the industry grasp the key points of fraud prevention, information security and personal information protection in the AI era.
The Enterprise Administration of China emphasized that the order database of a large e-commerce service platform has recently been illegally accessed, and many partner brands and consumers' personal information are at risk of leakage and fraudulent use. This shows that entrusting e-commerce platforms, information systems or personal information processing operations to external vendors does not exempt the company from its own personal information protection responsibilities. Business operators should still fulfill their responsibilities in selecting and supervising outsourced vendors, regularly review their information security protection, account permissions, vulnerability repairs, and incident reporting and response mechanisms, and ensure that outsourced vendors implement security maintenance through contractual agreements and inspections. In addition, as legal requirements, administrative supervision, and court judgments tend to increase corporate personal data protection obligations, management vendors have access to a large amount of corporate customer operational data, and should deploy protection mechanisms in advance to avoid incidents before taking remedial measures.
The Enterprise Agency of China stated that the management consulting industry has long been assisting small, medium and micro enterprises in upgrading and transforming, and is also an important partner in promoting the protection of corporate personal information. Since the Enterprise Agency of China compiled the "Personal Data Protection and Management Implementation Guidelines for the Management Consulting Industry" last year and made it publicly available online, as of the end of October 2015, it had been viewed by more than 40,000 people and downloaded by 3,031 people. The guidebook is compiled based on the practical experience of the counseling industry, taking into account the practical situations of large consulting organizations and small and medium-sized consulting companies. It can help the industry establish a compliance system and effectively implement the protection of client personal information.
The Enterprise Administration of China pointed out that in the process of providing services to small, medium and micro enterprises, the management consulting industry often handles cross-field customer operational information such as marketing, finance, sustainable development, international verification and human resources. As tools such as big data, generative AI, and agent-based AI are gradually introduced into consulting services, the scale, speed, and complexity of personal information processing are simultaneously increasing. While using AI to improve service efficiency, operators must also pay attention to new risks such as improper disclosure of data, content authenticity, permission control, and the use of AI by fraud groups.
In accordance with the provisions of Article 12, Paragraph 2, of the Personal Data Protection Act and its implementation rules, management consultants should establish 11 security maintenance measures including management staffing, risk assessment, accident prevention notification and response, internal management procedures, personnel and equipment safety management, education and training, and data security audits.
The Enterprise Administration of China explained that the guidebook is based on 11 security maintenance measures, introduces the PDCA (Planning, Execution, Review, and Continuous Improvement) method, and provides 5 examples of security maintenance plans, self-inspection checklists, personal data incident notification documents, and business outsourcing contracts. After the Personal Information Act was revised in May 2012, the penalty method for companies that violate safety maintenance obligations has been changed from "prior to ordering correction within a time limit" to "immediate penalty and ordering correction". For serious cases, the upper limit of fines has been increased to NT$15 million. Failure to make corrections within the expiration date will result in a penalty. In order to impose penalties, the Executive Yuan has also instructed ministries and commissions to set up personal information administrative inspection teams to prioritize high-risk businesses to strengthen inspections every year. Businesses can first use the "Personal Data Security Self-Checklist" in the manual to take inventory of the current situation and fill in the gaps as preparation for accepting administrative inspections.
