台新金控

Taishin has a personal information protection policy in place to ensure legitimate collection and use of customers' and employees' personal data. This policy is constantly reviewed and revised in line with changes in regulation. In addition to conducting regular inspections on the security of personal information, Taishin  also assesses possible personal information risks and uses the findings to establish proper management practices, responses, reporting channels and preventions for incidents such as theft, alteration, destruction, loss or leakage of personal information, and thereby enforce the personal information protection system of the organization.

Taishin continues to execute training programs that are aimed at raising employees' awareness and respect towards personal information and promoting thorough understanding of relevant legal requirements, responsibilities, systems, procedures and measures the organization has in place for the protection of personal information.

Training for Protection of Personal Information in 2020

With regards to the handling of personal information incidents and employees' crisis awareness, Taishin has implemented "Management Regulations on Personal Information Misuse Incidents" to facilitate effective emergency response should an incident arise. If a personal information incident occurs, employees are required to report immediately to the line manager and complete risk assessment and incident classification within the given timeframe. Depending on the severity of the incident, an emergency response team may be assembled to execute response, coordination, communication and investigation in relation to the incident. In 2020, Taishin received no penalty from the authority for violation of personal information.

Furthermore, out of respect for customers' personal information and their rights, Taishin has implemented "Operation Regulations on the Exercise of a Party's Rights" to facilitate proper handling of customers' rights to inquire, review, make duplicate copy of, supplement, correct and delete their personal information maintained with Taishin, as well as their rights to stop Taishin from further gathering, processing and use of information.

The Handling of Each Level of Incident and the Reporting Level

Taishin places great emphasis on the protection of personal information. To enhance security management practices, Taishin Bank engaged certified public accountants to perform a special audit on personal information protection in 2020 for which the CPAs issued a statement claiming that the design and implementation of the internal control system for personal information protection are effective.

Information Security Measures for e-Commerce Services

Includes: User Identification and Authentication, Personal Information and Sensitive Data Masking, Network Encryption,  Secure Software Development Life Cycle, Access Control and Monitoring Management, Intrusion Prevention System Management, and Security Information Event Management.

We monitor the percentage of users whose customer data is used for secondary purposes

• Taishin has incorporated strict management approaches for 100% monitoring and protecting customer personal data which contains the use for primary and secondary purposes.
• In 2020, we conducted marketing contacts for secondary purposes with 5.51 million customers, which accounted for approximately 80.3% of our total customers. The scope of use is fully complied with the purposes agreed with customers (we only use the customer data that the customers agree for the purposes on the notification of the provided products and services, or agree with "Consent to Clients Data Cross-referencing"; and all the customers can go through a written "Declaration of not Accepting Marketing Information" to request discontinuing using their data at any time.)

Taishin attaches great importance to the protection of personal information, and customers can raise questions or file complaints through different channels. If the results of an investigation confirm a violation of personal information, we will take disciplinary actions (e.g., downgrading of performance evaluation, withholding of bonuses, and internal penalties). We shall also propose specific system and process improvements to address the root cause of the complaint and avoid the recurrence of similar situations. The cases are compiled and submitted to the Fair Customer Treatment and Consumption Review Committee and the Board of Directors each quarter. The management department unit shall continue to monitor improvements to ensure implementation.