Day 2 · R4 Where Does Good Data Come From
A workshop bringing together four cross-disciplinary scholars and practitioners to discuss how Taiwan can obtain and govern good data, covering privacy enhancing technologies, social science data sharing, open legislative data, and data governance law.
At a glance
| Speaker | Talk | In one sentence |
|---|---|---|
| Hou Yi-hsiu (侯宜秀), moderator | Opening | Introduces the workshop's theme, "Where does good data come from," and the four panelists. |
| Yu Chia-mu (游家牧) | Balancing Data and Privacy | Uses privacy enhancing technologies (PET) such as differential privacy and synthetic data to demonstrate how to release high-value sensitive data while protecting privacy. |
| Pien Chung-pei (卞中佩) | Putting Social Science Data to Work | Taiwan lacks high-quality social-science/Chinese-language corpora; existing AI project data across industries should be inventoried, with cross-institutional sharing mechanisms considered. |
| Wang Hsiang-jung (王向榮) | Traditional Chinese AI Open Source Practice Grant: Legislative Yuan Data | Converts the Legislative Yuan's scattered, unstructured (PDF/Word) bills, gazettes, and interpellation video/audio into structured APIs and open-source datasets. |
| Chiu Wen-tsung (邱文聰) | Draft Data Governance Act | Criticizes how "data altruism" blurs the line between personal and non-personal data, and argues for a "rights management system" that lets data subjects dynamically exercise consent. |
| All panelists | Cross-Discussion and Q&A | Focuses on the disputes over natural-person vs. legal-entity data, and the legality of cross-agency government data linkage. |
5 of 5 talks
1Balancing Data and PrivacyYu Chia-mu (游家牧), Associate Professor, National Yang Ming Chiao Tung University
Using privacy enhancing technologies (PET) to protect personal data and trade secrets while still allowing high-value data to be released for model training.
Key points
- Deep learning is highly dependent on data volume, but the most industrially valuable data — in semiconductor process engineering, healthcare, finance, and similar fields — is often also the most sensitive and least shareable; the speaker cited a Hsinchu Science Park manufacturer that wanted to upload process parameters it had spent tens of millions of NT dollars tuning to a crowdsourced platform to improve a model, but did not dare release the raw data directly.
- Traditional "de-identification"/K-anonymity is the only technique explicitly recognized by law (Taiwan's Personal Data Protection Act, GDPR), but the speaker argued that it performs poorly on both privacy protection and data usability, and cases of de-identified data being re-identified have repeatedly surfaced over the past decade or so.
- Introduced the "Privacy Enhancing Technologies" (PET) family, including differential privacy, synthetic data, homomorphic encryption, secure multi-party computation, and federated learning, comparing their performance, security, and practicality: homomorphic encryption has the highest security but extremely poor performance and remains confined to academia; federated learning does not release raw data but still has privacy loopholes.
- The core idea of differential privacy: adding noise to query results so that whether or not a specific record exists in the database does not affect the result, mathematically guaranteeing that no single record's existence can be inferred. The amount of noise needed depends on the dataset's outliers and is inversely related to data usability.
- Proposed a rule of thumb: when using differential privacy, the dataset should ideally have at least 10,000 records (5,000 is also workable); otherwise the noise cannot cancel out in statistical computation, and usability drops noticeably.
- Differential privacy already has real-world applications: the US government has used it to release census data since 2020; Uber and LinkedIn use it for internal engineers querying company databases, to prevent departing employees from leaking sensitive information.
- The principle of synthetic data: assuming a probability distribution underlies the real data, a generative model (such as a GAN or diffusion model) learns that distribution and resamples from it to produce a new dataset that is "different in origin but statistically similar," which is then released; however, according to results from a competition held by NIST, deep learning models actually synthesize tabular data less effectively than image data (the speaker speculated this is because tabular data lacks the "locality" features common in images).
- Shared an actual case working with a county/city government: the police department, fire department, and health department each held data on different stages of traffic accidents (accident location, ambulance pickup, injuries on arrival at hospital); by law they could not exchange data with each other directly, so each had to apply privacy enhancement (differential privacy) first and then link the data ("enhance-then-link"), rather than linking first and enhancing afterward ("link-then-enhance").
- The case data contained many missing values, and the client insisted on filling them all with 999 (rather than using statistical imputation); linking the data was also limited to the intersection of the three parties because their hash IDs did not match, sharply shrinking the sample size. As a result, the differential privacy outcome after linking was worse than using the intersected data alone, highlighting how critical data volume is to differential privacy's effectiveness.
- For non-numeric fields, noise was added using "Randomized Response," a technique originating from a 1965 US method for sensitive survey questions (such as "are you gay" or "are you a Communist Party member"): the respondent flips a coin first, answering randomly on heads and truthfully on tails, so every individual's answer has "plausible deniability" while the true proportion can still be statistically inferred.
- Conclusion: privacy enhancing technologies are becoming more widespread (both government and startups are investing in them), but there is no "one-size-fits-all solution" — the right technique must be chosen based on the downstream application (statistical computation vs. deep learning modeling); not every combination of PET and AI produces the best results.
Tech, products & figures
- Differential Privacy
- Adds noise to query results to mathematically protect the privacy of whether an individual record exists.
- Synthetic Data (including GANs and diffusion models)
- Learns the underlying data distribution and resamples it to generate fabricated data.
- K-anonymity
- A traditional de-identification technique explicitly recognized by law, but weak in both privacy protection and usability.
- Homomorphic encryption, secure multi-party computation, and federated learning
- Other PET techniques, each with its own performance/security trade-offs.
- Randomized Response
- A noise-adding technique used in sensitive surveys since 1965, applied here to add differential privacy to non-numeric fields.
- Ministry of Digital Affairs (moda) Guidelines on the Application of Privacy Enhancing Technologies (published 2024, co-authored by the speaker)
- An official document promoting the adoption of PET techniques.
Notable quotes
What this talk is about is whether there's some way I can encourage people to release data that's very valuable but also very sensitive, without it hurting the value of the data itself.
If you want to use differential privacy, your dataset should really have at least 10,000 records — that's a fairly safe range.
Q&A
- There was no separate Q&A session; the moderator asked the speaker to wrap up due to time constraints, and related discussion is folded into the cross-discussion in segment 5.
Fact-check notes
- Yu Chia-mu is currently a joint-appointment associate professor in the Department of Electrical Engineering and the Department of Information Management and Finance at National Yang Ming Chiao Tung University. He holds a PhD in Electrical Engineering from National Taiwan University, and his research focuses on AI security, data privacy, and cybersecurity. He received the 2022 K.T. Li Rock Award and holds a Yang Ming Chiao Tung University Young Chair Professorship.Sources：國立陽明交通大學電機系李國鼎磐石獎 2022 得獎資料
- The "Guidelines on the Application of Privacy Enhancing Technologies" mentioned by the speaker is indeed a document promoted in 2024 by moda's Department of Digital Innovation, and its content matches the speaker's description, but an official link could not be obtained to verify the exact wording of the version described (unverified).
2Putting Social Science Data to WorkPien Chung-pei (卞中佩), Assistant Professor, International College of Innovation, National Chengchi University
Argues that nearly all the data used to train large language models is, in essence, social science data, and that Taiwan should inventory and share existing data rather than duplicating annotation efforts.
Key points
- Opened with a reflection: rather than asking "where can I find good social science data," we should first ask "why do we need good social science data, and what counts as 'good'" — because large language models are, at their core, simulating and learning human behavior, so almost all training data can be considered social science data in a broad sense.
- Pointed out that social science research has long suffered from a data shortage (even survey research lacks data), and the machine learning era faced the same shortage; but after generative AI emerged (ChatGPT / GPT-3.5, from 2022 onward), "both the quality and quantity of data needed changed," amplifying the sense of anxiety.
- Reminded the audience that LLMs suffer from "hallucination": even though they can generate content freely, imprecise training data still leads to inaccurate outputs, so precise data is still needed for retrieval-augmented generation (RAG) and fine-tuning.
- Highlighted the competitive pressure from China's "data element" policy: data exchanges in Beijing, Shanghai, Shenzhen, and Guizhou released a first batch of 100 "high-quality datasets" in April 2024 for training large language models; questioned why Taiwan currently has no equivalent "national/industry data team."
- Shared a case from an ESG-report AI project undertaken by NCCU's International College of Innovation: it involved summarizing entire ESG reports and converting them into press-release format (with the speaker personally rewriting sentences to provide human feedback, i.e. RLHF-style data annotation), producing specified-format summaries of large numbers of ESG reports, and extracting statistics from ESG reports; reflected that such "contractor" units are effectively duplicating labor for multiple "client" firms, and called for building an industry-wide shared ESG training database.
- Shared a case of a customer-service chatbot for a small/medium enterprise (a southern-Taiwan lighting manufacturer referred to only as "Wuguang" (五光), full name not given): without sufficient RAG/fine-tuning data on specialized terminology (such as fixture model numbers and spec wording), chatbot quality would be poor; called for companies in the same industry to share baseline data to lower the cost of AI adoption for SMEs.
- Shared their own research project, the "Taiwan Climate Change Attitude Bot": using real 2020 phone-survey data commissioned from a polling firm (including real respondents' demographic characteristics and attitudes toward climate change) as a baseline, compared ChatGPT's answers under the same persona conditions against real human answers, and attempted to fine-tune the model using the human-answer data (including the latest GPT-4o fine-tuning API), aiming to make the model's outputs increasingly match Taiwan's real public opinion distribution; as of the talk, fine-tuning results were not yet fully available.
- Cited Academia Sinica's "Taiwan Social Change Survey" database as a high-quality social science data source usable for similar projects.
- Cited a 2024 Chinese study comparing how different social-media text sources affect large language model training performance, which unexpectedly found that the best results came not from "refined" content like Zhihu or Xiaohongshu (RED), but from posts in the style of Ruozhi Ba (弱智吧) — full of puns, irony, and slang — speculating that the multiple layers of meaning in such language help models learn deeper structures of language and culture.
- Shared their own experience implementing text classification (sentiment analysis: positive/negative/neutral): Taiwan currently lacks large ready-made Chinese text-classification annotation datasets, so when testing they even had to borrow a Chinese Weibo dataset first to validate the method's feasibility, before spending budget to hire student workers to annotate Taiwanese (e.g. Facebook) corpus.
- Concluding call to action: since Taiwan's resources (especially compute) are limited, we should instead start from what precise task the LLM needs to perform, work backward to determine the input/output data required, and systematically evaluate the effects of training on different data, rather than blindly feeding data into models.
Tech, products & figures
- Beijing Data Exchange (北數所) / Shanghai, Shenzhen, and Guizhou data exchanges
- Released a first batch of about 100 "high-quality datasets" in April 2024, for training Chinese large language models.
- ESG report AI interpretation and production project
- A corporate-commissioned project undertaken by the NCCU team, covering summarization, format conversion, and statistics extraction.
- Taiwan Climate Change Attitude Bot
- The speaker's own research project, combining real 2020 polling data with ChatGPT/GPT-4o fine-tuning.
- Academia Sinica's Taiwan Social Change Survey database
- A high-quality social science data source recommended by the speaker.
- Study on the effectiveness of Ruozhi Ba (弱智吧) corpus (2024 Chinese study)
- Cited by the speaker without naming the source (unverified; only the finding is described).
Notable quotes
Some scholars say bias is actually good, because with a well-crafted prompt, it can surface the opinions and views of a specific group.
Don't worry about Xiaohongshu, don't worry about Zhihu... the best one is 'Ruozhi Ba'.
Whatever precise task you want the LLM to do, whatever it needs to produce, what input goes in and what output you need out — that's the data you actually need.
Q&A
- There was no separate Q&A session; in the cross-discussion in segment 5, Pien Chung-pei proactively raised a question for Chiu Wen-tsung about the distinction in data rights and obligations between natural persons and legal entities.
Fact-check notes
- Pien Chung-pei is currently an assistant professor at the International College of Innovation, National Chengchi University, and received a PhD in Sociology from Texas A&M University. Their research covers political sociology, environmental sociology, organizational theory, and computational social science, and they received NCCU's Outstanding Mentor Award in 2024 — consistent with the speaker's self-description of "environmental sociology, political sociology, computational social science, and organizational theory."Sources：政大創新國際學院師資頁
- The speaker's mention of the Beijing Data Exchange (北數所) and the Shanghai, Shenzhen, and Guizhou data exchanges releasing about 100 high-quality datasets in April 2024 is content that has been publicly reported within the context of China's "data element" policy, but this fact-check could not obtain a corresponding official press release to verify it word for word (unverified).
- For the Ruozhi Ba (弱智吧) corpus-effectiveness study and the southern-Taiwan lighting manufacturer "Wuguang" chatbot case, the speaker gave limited detail (neither the company's full name nor the study's title was clearly stated), so these are recorded as verbal sharing and were not further verified.
3Traditional Chinese AI Open Source Practice Grant: Legislative Yuan DataWang Hsiang-jung (王向榮), Founder, OpenFun Ltd. (歐噴有限公司)
Converts the Legislative Yuan's bills, gazettes, and interpellation video/audio — scattered across multiple agencies in unstructured PDF/Word formats — into structured APIs and open-source datasets.
Key points
- Moderator's introduction: Wang Hsiang-jung has long been involved in the open government and open parliament movements, having launched civic tech projects such as "Political Donations Transparency" (crowdsourcing the digitization of paper political-donation filings) and "Job Search Helper" (a browser extension showing employers' labor-law violation records), and currently leads the "Taiwan Legislative Yuan API" project.
- The project shared today originates from the "Traditional Chinese AI Open Source Practice Grant" (funded through g0v's Summer of Hacks/0Sch1, which selected 6 projects and awarded roughly NT$300,000 in total, focused on areas such as healthcare, law, education, Taiwanese-language text, and legislative data).
- The project's actual lead is a data journalist at The Reporter (報導者); Wang proactively proposed collaborating and jointly applying for the grant. It grew out of an analysis The Reporter had produced: using text-mining to process all interpellation records in the Legislative Gazette from the 113 legislators of the 10th Legislative Yuan over the previous four years, tagging each legislator's top five issues of concern (manually classified into over 100 labels) to help voters review legislators' policy focus; but such reporting is only done once every four years, so the two of them wanted to make it more real-time (annually, per legislative session, or even weekly).
- Used a "university system" analogy to explain how the Legislative Yuan operates: the 113 legislators are like the entire student body, serving 4-year terms (like a 4-year university program); the 8 standing committees (finance, interior, social welfare, etc.) are assigned by lottery and can be traded with other legislators; there are two sessions per year (February–May and September–December, with this conference falling exactly in the opening week of a new session).
- Explained the division of labor between the "plenary session" (the full assembly of all 113 legislators, which decides whether bills go to committee and handles the final second and third readings) and "committees" (which review specific ministries' bills/budgets); also introduced the "National Affairs Forum" (a 15-minute individual free-speech slot before each session begins, which officials have no obligation to respond to — similar to a legislator's personal channel/YouTube, but still fully recorded in the Gazette), "questioning officials" (interpellating ministry heads over legislative amendments or current events — e.g. incidents like covert filming of minors can trigger interpellations), and the amendment process (a comparison table listing current provisions, proposed amendments, and rationale; the same amendment often has multiple versions presented side by side, most are ultimately passed by consensus, with only a few sent to a plenary vote — a session typically has only two or three actual votes).
- Inventoried the types of data the Legislative Yuan currently produces: bill data (about 7,000–8,000 proposals per year, surging to over 13,000 in 2023, covering both legislative bills and budget proposals, all in Word format); meeting video/audio (over 300 meetings per year, cut into thousands of clips by legislator's remarks); the Gazette (the most legally authoritative document, a verbatim record of every legislator's and official's remarks, published daily, about 150–200 issues a year, but with a 2-week to 1-month lag before publication because legislators must confirm the transcript); and research reports from the Legislative Yuan's Legal Affairs Bureau (法制局) (over 2,000 accumulated, relatively neutral issue research for legislators' reference).
- The Legislative Yuan's various units (Information Office, Procedure Office, Congressional Library, etc.) operate in parallel and each publish their own data, which leaves data scattered across multiple websites in inconsistent formats; although the Information Office actively promotes open data, it cannot compel other parallel units to release data or standardize formats.
- Shared the tools used to clean the data: Apache Tika (converts Word/PDF into HTML that preserves the original style classes, such as Heading 1 or Heading 2, allowing accurate segmentation of paragraph structure — for example identifying "cross-caucus negotiation" sub-headings), LibreOffice (soffice, which exports HTML that matches the original Word layout almost exactly, for direct online reading without downloading), and another tool that converts PDF to text while preserving layout; the processed results are uniformly encoded (legislative term, session, committee code, sequence number) and consolidated into an Elasticsearch database, chosen because the fields need flexible extension and the data is rarely modified but must be highly searchable.
- Has written about 20–30 programs that automatically fetch, clean, and import the latest data daily from various sources (Open Data, committee meeting minutes, the Gazette, etc.), packaged into two services: the govapi.tw family of APIs (the old version is no longer updated; the new version at v2.ly.govapi.tw covers JSON APIs for bills, meetings, legislators, etc.) and the data.ly showcase site (which visualizes various Legislative Yuan data and notes the corresponding API endpoint at the bottom of every page so users can trace it back).
- Also built a Whisper speech-recognition bot: about 10 minutes after the Legislative Yuan's official IVOD video is released, the bot automatically fetches it, runs it through Whisper to produce a transcript, and stores it on data.ly, providing a "usable but imprecise" transcript within about 30 minutes of an interpellation ending, to be replaced later once the Gazette's official verbatim record (which takes 2 weeks to 1 month) is published; also proposed an idea that, since a meeting's topic and attendees are known in advance, this context could in future be used to improve Whisper's recognition accuracy for specialized terminology.
- API application examples: collaborated with Citizen Congress Watch (公督盟) to automate, in real time, metrics such as legislator attendance rates and number of interpellations that previously required manual work (student workers tallying figures by hand from the Gazette); built an interface that automatically compares multiple versions of amendment text (previously researchers had to print out a dozen or twenty Word versions and compare them clause by clause; now they can simply select versions to compare differences online); converted the plain-text Gazette into a reader-friendly interface that distinguishes remarks by chair, questioner, and official; and reused g0v's existing voting-record visualization tool.
- Because the grant program requires data to be released on Hugging Face, two datasets have already been uploaded: (1) each legislator's interpellation clips from IVOD (including the legislator's identity, meeting subject, time range, and the full verbatim transcript of the interpellation and official's response, updated automatically on a regular basis); and (2) the full text of Legislative Yuan Legal Affairs Bureau research reports (extracted and cleaned from PDFs); the goal is to eventually upload and auto-update all datasets — bills, meetings, legislators, and more — to Hugging Face, so that large-scale data researchers won't need to write their own scrapers.
- Invited the audience to join the "g0v Congress Hackathon" (a monthly hackathon focused on legislative data and issues) and subscribe to its Substack newsletter; the Congress Hackathon community is also collaboratively producing an introductory guide to legislative knowledge (first/second/third readings, committee and plenary procedures, etc.), aiming to let newcomers get up to speed on legislative data within thirty minutes to an hour.
Tech, products & figures
- Apache Tika
- Converts Word/PDF into HTML that preserves style classes, enabling structured parsing.
- LibreOffice (soffice)
- Exports HTML matching the original layout, for online viewing.
- Whisper (OpenAI's speech recognition model)
- Powers a self-built bot that generates transcripts in real time after IVOD videos are released.
- Elasticsearch
- Stores the integrated Legislative Yuan database, which needs flexible fields and high searchability.
- govapi.tw / v2.ly.govapi.tw
- JSON APIs for Legislative Yuan data.
- data.ly (an OpenFun product)
- A showcase website visualizing Legislative Yuan data, with API-source annotations on every page.
- Hugging Face open-source datasets
- Legislators' IVOD interpellation clips, and the full text of Legislative Yuan Legal Affairs Bureau research reports.
- The Reporter's interactive report on "what the 113 legislators care about"
- The original report that sparked this collaboration (the exact title and link could not be verified).
Notable quotes
I don't think I'm as expert as the two speakers before me, because with privacy issues I just find it... really troubling, I think it's hard to solve, so that's exactly why I love working with government open data — government open data has no privacy problems at all, because anything with privacy concerns just doesn't get opened.
I think overseeing legislators shouldn't be something we do once every four years... we should really be doing it anytime, anywhere — whenever a legislator does something that affects you, it feels like we should be watching them.
Q&A
- There was no separate Q&A session; the moderator closed with the remark that this could soon be used to train a legislator "avatar bot" and moved straight on, with related discussion folded into the cross-discussion in segment 5.
Fact-check notes
- Wang Hsiang-jung is indeed the founder of OpenFun Ltd. (歐噴有限公司), with the g0v community ID Ronny Wang, and has long been involved in civic tech projects such as Political Donations Transparency and Job Search Helper; OpenFun's products include government budget lookup, legislative tracking, and a Legislative Yuan AI transcription service, consistent with the speaker's description.Sources：歐噴有限公司官網天下雜誌專訪
- The "Traditional Chinese AI Open Source Grant" is hosted by the Frontier Foundation for Education and Culture and administered through g0v's Summer of Hacks (0Sch1). The program ran from 3 Jan 2023 to 18 Apr 2024 (across three application rounds), with each project awarded NT$200,000–500,000, focused on traditional Chinese corpus collection, traditional Chinese benchmarks, language models for law/healthcare/education, traditional-Chinese-first open-source models, and multilingual considerations such as Taiwanese Hokkien, Hakka, and Indigenous languages; the speaker's mention of "six projects, about NT$300,000 in grants" broadly matches this program's direction, though the speaker's description of the grant amount was fairly general — refer to the official announcement for details.Sources：開拓文教基金會計畫頁g0v 零時小學校計畫看板
4Draft Data Governance ActChiu Wen-tsung (邱文聰), Research Fellow, Institute of Law, Academia Sinica
Argues for a "rights management system" that lets data subjects dynamically exercise consent, replacing the "data altruism" approach that blurs the line between personal and non-personal data.
Key points
- Opened by positioning himself as "the legal scholar here to stir things up": the previous three speakers offered technical solutions (how to use privacy-protection technology to encourage open data), whereas he would approach it from the legal/institutional side, tackling problems technical solutions cannot solve.
- Explained that this draft originates from a National Science and Technology Council (NSTC) research project on AI, humanities, and the rule of law, led by Liu Ching-yi (劉靜怡) as principal investigator with Chiu Wen-tsung as co-principal investigator; while surveying the EU's legal framework, the research team found that data governance is an unavoidable prerequisite legal issue for AI development, which is what gave rise to the draft Data Governance Act.
- Used the EU's "Digital Decade (2030)" pyramid framework to explain the EU's overall approach: the top layer is "Guidance" (value principles such as democracy, human-centeredness, social solidarity, and freedom of choice); the middle layer is "Rules" (legal norms such as AI rules, data governance rules, and data space rules); the bottom layer is "cutting-edge technology" (technologies such as digital twins, quantum computing, and digital wallets). The EU has progressively advanced this policy since 2018, formally proposing the Digital Decade 2030 blueprint in 2020.
- Further explained the five policy/legal pillars supporting this pyramid: the Digital Services Package, the AI strategy (corresponding to the AI Act), the cybersecurity strategy, the data strategy (corresponding to the Data Act and the Data Governance Act), and digital privacy (corresponding to the GDPR and the E-Privacy Regulation); argued that a legal framework must exist above the technology layer before digitalization consistent with democratic and human-rights values can develop, with the Data Governance Act being the most critical piece.
- Contrasted this with Taiwan's situation at the time: the Legislative Yuan had already introduced a draft Artificial Intelligence Basic Act, but it only addressed "application-layer" rules (risk control, liability allocation, rights remedies) and still lacked the foundational data governance framework; the Personal Data Protection Act also needed simultaneous amendment, and copyright disputes involving LLM training text needed to be addressed. Since the draft AI Basic Act's provisions already showed an awareness that "personal-data protection measures should be included," the research team went further and proposed the draft Data Governance Act.
- Core argument: rebutting the ideas that "as long as you don't touch personal data you're fine" or "once it's been processed with PET, it's safe to open up." Under the Personal Data Protection Act's definition, whether data counts as personal data hinges on whether it is "linkable" and "inferable," or whether it has been thoroughly aggregated so as to lose individual identity; as long as records can still be linked back to an individual via a hash ID or code, the data remains personal data under the law even after de-identification — so regardless of whether it's "enhance-then-link" or "link-then-enhance," as long as linkage remains possible afterward, it is still, in substance, personal data.
- Explicitly named and criticized two problems with moda's "data altruism" concept: (1) it fails to clarify what counts as "non-personal data" — simply labeling something "data" cannot remove it from the legal definition of personal data; (2) moda envisions the contributing party as the data holder volunteering to provide the data, but in the EU's original concept of data altruism, the contributing party should be the data subject themself, not "someone else taking my data to do good on my behalf."
- Added a note on differential privacy's special status: because differential privacy involves a "Curator" intermediary role (users can only query, not directly access the raw database), it does have the potential to turn personal data into non-personal data; but if it's opened up for the public to query freely without a Curator, the privacy budget can easily be broken through brute-force repeated querying, so it is not suitable as a directly open database for the public to train AI on — a Curator gatekeeper is still required.
- The draft divides personal-data use scenarios into four categories: (1) fully anonymized data (unlinkable, uninferable, or already aggregated) reverts to non-personal data; (2) reuse handled via a "rights management system" through which the data subject actively manages consent; (3) where a specific statute authorizes reuse, the data subject need not give prior consent but retains an opt-out mechanism afterward; and (4) the most compulsory category — reuse mandated by statute with no opt-out — limited to cases of major public interest authorized by individual legislation (such as compulsory expropriation).
- The core spirit of the "rights management system": reversing the information-engineering approach of "finding ways to tweak the data's properties so it counts as non-personal data and can be used," and instead using information technology to help data subjects more conveniently exercise their data rights (consent or withdrawal), so that even data that remains personal data can be dynamically and conveniently contributed to society, rather than "cutting the link the moment it's released"; paired with a "data intermediary service" role to lower the transaction costs of data users finding data and obtaining consent one by one.
Notable quotes
We're no longer working on the properties of the data itself — instead we flip it around and engage the data subject... they should be the one exercising their rights.
It doesn't suddenly stop being personal data just because you stick the label 'data' on it — that's not how it works.
I think PET technology should be understood as an information-security method, not necessarily as a method for turning personal data into non-personal data.
Q&A
- See the cross-discussion in segment 5.
Fact-check notes
- Chiu Wen-tsung is currently a Research Fellow at the Institute of Law, Academia Sinica, with research covering information law, constitutional law, privacy rights, science and law, and science and technology studies; an additional title mentioned at the event, "director of the '制裁技轉處'" (roughly, "Sanctions/Technology Transfer Office"), could not be verified as to the correct unit name (presumed to be a technology-transfer-related unit within Academia Sinica, but the exact full name and whether he currently holds a director role there could not be confirmed from an official source, so it is marked unverified).Sources：中研院法律所個人頁
- Status at the time of the conference (September 2024): the "draft Data Governance Act" Chiu Wen-tsung presented in this talk was a policy-proposal draft developed by the NSTC research project (AI, humanities, and the rule of law) that he co-led with Liu Ching-yi and others. At that time it had not yet been submitted for formal Legislative Yuan review; it was, in nature, a legislative proposal from an academic/policy research team drawing on the EU's Data Governance Act, meant to fill the gap in foundational data-governance law left by the draft Artificial Intelligence Basic Act the Legislative Yuan had already introduced.
- Subsequent development (as of August 2026): Taiwan's Legislative Yuan passed the third reading of the Artificial Intelligence Basic Act on 23 December 2025. The 20-article law designates the National Science and Technology Council (NSTC) as the competent authority and lists "privacy protection and data governance" as one of its 7 guiding principles, with the Ministry of Digital Affairs (moda) responsible for establishing a risk-classification framework, helping each competent authority identify high-risk applications, and promoting data governance mechanisms. However, this is the Artificial Intelligence Basic Act passed in 2025, not the separate, more detailed "Data Governance Act" that Chiu Wen-tsung advocated for in this talk. Fact-checking could not find any record that Chiu's version of the draft Data Governance Act itself has entered formal Legislative Yuan review or a third reading, so its subsequent legislative progress remains unverified — readers should not mistake the 2025 Artificial Intelligence Basic Act's third-reading passage for the "draft Data Governance Act" discussed in this panel having itself been enacted.Sources：法源法律網：人工智慧基本法三讀通過中央社報導未來城市＠天下解讀
- The speaker mentioned that the Executive Yuan was, around the same time, also pushing amendments to the Personal Data Protection Act and the establishment of an independent oversight agency (a Personal Data Protection Commission); fact-checking confirmed that the Executive Yuan did pass a draft Organic Act for a Personal Data Protection Commission and a draft partial amendment to the Personal Data Protection Act, a direction consistent with the speaker's account of the "data governance legal puzzle."Sources：行政院新聞稿
- Further discussion of pain points in government/public-sector AI adoption can also be found in the Day 2 R0 afternoon session (Chang Wen-hsi, Ministry of Finance, on using AI to select tax audit cases) and the Day 2 R2 Smart Healthcare session (Hsu Kai-cheng, Lai Lai-hsun, and Kang Shih-chung; which also supplements background on Chiu Po-huan's talk).
5Cross-Discussion and Q&AHou Yi-hsiu (侯宜秀, moderator), Pien Chung-pei (卞中佩), and Chiu Wen-tsung (邱文聰)
Focuses on the disputes over natural-person vs. legal-entity data, and the legality of cross-agency government data linkage.
Key points
- The moderator invited the earlier speakers to respond to Chiu Wen-tsung's draft Data Governance Act; Pien Chung-pei was the first to raise two questions.
- Natural-person vs. legal-entity distinction in data rights and obligations: Pien Chung-pei noted that when doing climate-change-related analysis, they often need to access corporate data (especially from major carbon emitters), but companies/agencies frequently refuse citing "privacy," when in practice they are using the personal-data-protection logic meant for natural persons to block the release of legal-entity data; questioned how the draft Data Governance Act intends to resolve this confusion.
- Legality of cross-agency government data linkage: using the linkage of police, fire, and health department data as an example, questioned whether it should be "link-then-enhance" (link the data first, then apply privacy enhancement overall) or "enhance-then-link" (each agency enhances its own data first, then attempts linkage), and noted that in practice frontline civil servants are highly sensitive about and reluctant to cooperate with data linkage, yet under strong policy pressure agencies still find ways to "link first"; Pien personally leans toward supporting "link-then-enhance, with full de-identification after linkage" as acceptable, especially for corporate data.
- Chiu Wen-tsung responded to the first point (corporate trade secrets): mandatory disclosure of a legal entity's trade-secret information requires explicit authorization through separate individual legislation, and cannot simply be blocked under a blanket claim of "privacy"; gave an example: information about hazardous chemicals at a chemical plant is extremely important for firefighting, so if legislation requires it to be consolidated through a chemical-information disclosure system, frontline firefighters could look it up instantly in the event of a disaster, avoiding casualties caused by unclear information — but outside the scope of such legislative requirements, companies can still refuse disclosure by citing trade secrets. As for administrative data originally collected for a specific regulatory purpose (such as TFDA requiring drug makers to submit new-drug clinical trial data for safety review), whether that data can be further disclosed after the review is complete still needs to be separately weighed against the original purpose of collection and the necessity claimed by the drug maker — it is not necessarily fully disclosable.
- Chiu Wen-tsung responded to the second point (cross-agency linkage): explicitly noted that "Germany, for example, strictly prohibits cross-agency data linkage"; while Taiwan has in practice grown more "accustomed" to cross-agency data flow, frontline data handlers remain somewhat sensitive and resistant to linkage, yet under strong policy demand agencies will still find ways to "link first." Chiu questioned this: even if data is immediately de-identified after linkage, as long as it remains "linkable" later, it is still, by legal definition, personal data — so whether "link-then-enhance" is truly lawful remains disputed, with the key question being "what is the legal basis for the linkage." He cited Nordic statistics law as an example: it explicitly authorizes cross-agency data collection and linkage for specific statistical purposes (such as Statistic A, B, or C), and because the scope of authorization is written very clearly, the linkage can proceed with confidence; by contrast, arbitrarily linking government data across departments without a clear legal basis easily triggers political concerns about "abuse of state power" and public backlash.
- With no further audience questions, the moderator declared the workshop concluded, noting that the day happened to be Teachers' Day and thanking the three panelists who had participated in their capacity as "teachers," while also previewing that at 15:30 the conference's final session, the Chi Sheng-Wei Memorial Lecture, would be held in the R0 International Conference Hall (speaker Chen Wei-chao, Chief Digital Officer and Senior Vice President of Inventec, on "Delivering Trust in the AI Era," 15:30–16:20; Chi Sheng-Wei was the founding CEO of the Taiwan AI Academy, who passed away in 2020, and the conference established this lecture in his memory).
Q&A
- After the moderator opened the floor for questions, they moved straight into closing remarks; there were no audience questions.
Fact-check notes
- The claim that "Nordic statistics law" authorizes cross-agency data linkage was a verbal example given by Chiu Wen-tsung, without a specific country or statute name provided; it is recorded here faithfully as the speaker's statement, but its legal basis could not be verified (unverified).