Government agencies shall be liable for the damages arising from injury caused by any unlawful collection, processing or use of personal data, or other infringement on the rights of data subjects due to such government agency's violation of the PDPA, unless such injury was caused by any natural disaster, emergency or other force majeure event.
If an injury suffered by the victim is a non-pecuniary damage, he/she may request an appropriate amount of monetary compensation; if the injury suffered by the victim is damage to his/her reputation, the victim may request appropriate corrective measures to restore his/her reputation.
Under the circumstances identified in the preceding two paragraphs, if it is difficult or impossible for the victim to prove the monetary value of the actual damage, he/she may ask the court to award the compensation in the amount of not less than NT$500 but not more than NT$20,000 per incident, per person based on the severity of the damage.
Where the rights of multiple data subjects have been infringed upon due to the same incident, the total amount of compensation awarded to such data subjects shall not exceed NT$200 million. However, if the interests involved in the incident exceed NT$200 million, the compensation shall be up to the value of such interests.
If the total amount of damages for the injuries attributable to the same incident exceeds the amount referred to in the preceding paragraph, the compensation payable to each victim shall not be limited to the lower end of damages, i.e. NT$500, per incident as set forth in paragraph 3 of this Article.
The right of claim referred to in paragraph 2 above may not be transferred or inherited. However, this does not apply to the circumstances where monetary compensation has been agreed upon in a contract or a claim therefor has been filed with the court.

Non-government agencies shall be liable for the damages arising from any injury caused by any unlawful collection, processing or use of personal data, or other infringement on the rights of data subjects due to such non-government agency's violation of the PDPA, unless the non-government agency can prove that such injury is not caused by its willful act or negligence.
Paragraphs 2 through 6 of the preceding article apply to the damage claims raised in accordance with the preceding paragraph.

The right to claim damage compensation will be extinguished if the right-holder does not exercise such right within the two-year period after he/she becomes aware of his/her damage and the identity of the person(s) liable for the compensation, or the five-year period following the occurrence of the damage.

With regard to matters pertaining to damages, aside from the provisions of the PDPA, the State Compensation Law may be applied to a government agency and the Civil Code may be applied to a non-government agency.

An incorporated foundation or an incorporated charity that brings a case to the court in accordance with this Chapter shall fulfill the following criteria:
1. the total registered assets of an incorporated foundation shall be NT$10 million or more, or the total number of members of an incorporated charity shall be 100 or more;
2. the protection of personal data shall be set forth as one of its purposes in its charter; and
3. It shall have been established for more than three years following its receipt of the approval thereof.

The lawsuit filed with the court for damages against a government agency in accordance with the PDPA shall be subject to the exclusive jurisdiction of the district court where the agency is located. The lawsuit against a non-government agency is subject to the exclusive jurisdiction of the district court where its main office, principal place of business or domicile is located.
If the non-government agency referred to in the preceding paragraph is a natural person and has no place of domicile in the Republic of China, or the address thereof is unknown, such natural person's place of residence in the Republic of China shall be deemed to be the place of domicile. If the natural person has no place of residence in the Republic of China or the address thereof is unknown, his/her last known domicile in the Republic of China shall be deemed to be the place of domicile. If the natural person has no last known domicile, the district court where the central government is located shall have exclusive jurisdiction.
If the non-government agency referred to in paragraph 1 is a legal person or a group and has no main office, principal place of business, or the addresses thereof are both unknown, the district court where the central government is located shall have exclusive jurisdiction.

Where the rights of multiple data subjects have been infringed upon due to the same incident, the incorporated foundation or incorporated charity may file a lawsuit with the court in its own name after obtaining a written delegation of litigation rights of at least 20 data subjects. The data subjects may withdraw their delegation in writing before the conclusion of the oral argument and the data subjects shall notify the court thereof.
With regard to the litigation referred to in the preceding paragraph, the court may issue a public notice, either upon receiving a petition therefor or on its own initiative, informing other data subjects that suffer damages due to the same incident that they may delegate their litigation rights to the incorporated foundation or the incorporated charity referred to in the preceding paragraph within a specified period of time. The incorporated foundation or the incorporated charity may expand demand for the relief sought before the conclusion of the oral argument.
If other data subjects that suffer damages due to the same incident chose not to delegate their litigation rights pursuant to the preceding paragraph, they may still bring the case to the court within the timeframe specified in the public notice for the court to combine the cases.
Other data subjects that have suffered damages due to the same incident may also file a petition, requesting the court to issue the public notice referred to in the preceding paragraph.
The notice referred to in the preceding two paragraphs may be posted on the bulletin boards of the court, on the Internet or at other proper locations. Should the court consider it necessary, it may make such notice in a government gazette or newspaper, or through other means, and the fees therefrom shall be paid by the National Treasury.
For the incorporated foundation or the incorporated charity that brings a case to the court in accordance with paragraph 1, if the claim value of the case exceeds NT$600,000, the court fee attributable to the excess portion of the claim value shall be waived.

If a data subject withdraws his/her delegation of the litigation rights in accordance with paragraph 1 of the preceding article, the part of the court proceedings relating to such data subject shall automatically be suspended, and such data subject shall make a declaration to become a party to the suit. The court may also, on its own initiative, order such data subject to become a party to the suit.
After the incorporated foundation or the incorporated charity files a lawsuit with the court in accordance with the preceding article, if the withdrawal of litigation rights by some data subjects causes the number of remaining data subjects in the lawsuit to drop to less than 20, the court proceedings for the remaining data subjects may still continue.

The statute of limitation for each data subject to exercise the right to claim damages under paragraphs 1 and 2 of Article 34 shall be calculated separately.

An incorporated foundation or an incorporated charity that has been delegated litigation rights by data subjects shall be entitled to implement any and all acts pertaining to the lawsuit. However, the data subjects may set restrictions on the abandonment, withdrawal, or settlement relating to such lawsuit.
The restrictions set by one of the data subjects referred to in the preceding paragraph have no effect on the other data subjects.
The restrictions referred to in paragraph 1 shall be specified in the documents identified in paragraph 1 of Article 34, or shall be submitted to the court in writing.

In the event that a data subject is not satisfied with the judgment of the lawsuit filed pursuant to Article 34, he/she may withdraw his/her delegation of litigation rights before the deadline for filing an appeal by such incorporated foundation or incorporated charity, and then file the appeal himself/herself.
After receiving the original copy of the judgment, the incorporated foundation or the incorporated charity shall notify the data subjects of the outcome and also notify the data subjects in writing within seven days as to whether or not an appeal will be filed.

The incorporated foundation or the incorporated charity shall deduct the necessary litigation fees from the compensation awarded in accordance with the result of the lawsuit filed pursuant to Article 34, and deliver the remaining amount to the data subjects that delegate the litigation rights.
The incorporated foundation or the incorporated charity may not ask for remuneration for the lawsuit filed in accordance with paragraph 1 of Article 34.

The incorporated foundation or the incorporated charity that filed a lawsuit in accordance with the provisions of this Chapter shall engage an attorney as its agent ad litem for the lawsuit.