iRent's Data Leak Highlights Cybersecurity Issues 和泰iRent個資外洩 格上也傳資安問題

iRent is one of two car rental services dealing with massive data leaks. The other, Car Plus, says it looked at its database and found no abnormal inquiries or downloads but it will still take steps to improve customer data security. Lawmakers are calling for the establishment of a dedicated and independent data security agency.

Following iRent's data leak, in which the personal data of 140,000 customers were leaked, NPP lawmakers revealed Car Plus, another car rental service, had also suffered a personal data leak. The Directorate-General of Highways says it will launch an investigation as quickly as possible and it would ask the Ministry of Transportation and Communications to decide on iRent's penalty within three days of receiving the investigative report.

Chang Shun-ching, Deputy Director, Directorate-General of Highways: “We will launch a thorough investigation of this operator and we will be asking cybersecurity consultants to help.”

Chiu Hsien-chih, Legislator (NPP): “Taiwan still does not have a designated, (independent personal data) agency and also lacks the human resources for one. Before (incidents), they are given clear personal data protection guidelines. After (incidents), they are given clear operating procedures. They have to explain how such incidents should be handled.”

Personal data leaks happen very frequently, from government agencies to private businesses. DPP lawmakers say this is why scam organizations flourish in Taiwan and the problem has reached the level of sparking a national security crisis.

Hung Sun-han, Legislator (DPP): “Personal data leaks and breaches happen way too frequently. This is where scam and fraud organizations get their information from.”

Kao Shien-quey, Deputy Minister, National Development Council: “(A dedicated public authority) would require the entire structure of the Executive Yuan to be overhauled. Nothing will be done until the Executive Yuan convenes a cross-ministry meeting to, for example, form a task force or a council to see how such an agency would be set up.”

The National Development Council says a dedicated public authority overseeing personal data is in the works and the government is looking at what other countries have in place. In addition, cybersecurity will be stepped up at government agencies and the new agency will be tasked with monitoring NGOs. In the meantime, iRent's data leak is being handled in accordance with regulations.

上週才傳出租車業者和泰iRent外洩14萬筆個資事件，時代力量立委又揭露，另一家業者格上租車，也有資安外洩疑慮。針對連續兩家租車業者發生資安問題，公路總局強調，將積極主動辦理業者清查；至於iRent的行政處分，會在收到複查報告後3天內，報請交通部處分。

公路總局副局長張舜清表示：「要去針對這個類似的一個業者，做一個全面的主動去清查。相關的清查作業，在辦理的時候，我們會邀請相關的資安顧問來協助。」

時代力量立委邱顯智批評：「到現在為止，沒有一個指定的（個資獨立）專責機關，也沒有給予專業的人力，事前就給予明確的個資保護指引、事後給予明確的處理原則。到底要怎麼處理，要講清楚。」

近期個資外洩事件頻傳，從戶政資料、健保個資到租車業者用戶。民進黨立委直言，公私部門個資外洩，不但助長詐騙，資安漏洞還可能成為國安危機。

民進黨立委洪申翰指出：「我們的個資保障，個資的外洩，非常的氾濫。這形成了重要的詐騙的源頭。」

國發會副主委高仙桂表示：「（獨立專責機關）涉及到行政院整體組織改造，這個還是需要行政院來召集相關部會，譬如說成立專案小組或相關會議，來進行後續的研議。」

國發會說，個資獨立專責機關目前正在規劃進行，已經有參考其他國家，會盡速落實各機關個資安全辦法，也會研議提升對非公務機關的監管量能。至於iRent事件，則是有依照通報機制處理。