Interpreting No. 603 of Taiwan's Constitutional Court as a Guide IN SEARCH OF A NEW APPROACH OF INFORMATION PRIVACY JUDICIAL REVIEW: INTERPRETING NO. 603 OF TAIWAN'S CONSTITUTIONAL COURT AS A GUIDE Chung-Lin Chen* ABSTRACT Although information privacy has garnered great attention in recent years, its judicial review issues have not received sufficient attention. This article intends to join the endeavor to advance judicial review techniques employed in information privacy cases. Currently, American courts largely rely on the reasonable expectation of privacy test when determining whether information should remain private. However, this test has suffered heavy criticism because it is logically problematic and practically ineffective due to a deficient reasoning process and the difficulty arising from the assessment of "reasonableness." This paper advocates the framework extracted from Interpretation No. 603 of Taiwan's Constitutional Court as an alternative to the test. This alternative framework involves the application of multiple standards and employs the use of principles of information privacy protection, including the constitutionalized purpose specification principle. This framework not only avoids the problems of the reasonable expectation of privacy test, but also promotes a more refined and exquisite approach to judicial review with respect to information privacy cases. INTRODUCTION Although information privacy has attracted great attention in recent years, its issues regarding judicial review have failed to receive sufficient consideration. Previous discussion has centered on legislative strategies responding to technological threats to privacy and has devoted less attention to innovation in judicial review of governmental intrusion. In Taiwan, before the controversy leading to Interpretation No. 603, there were few writings that explored judicial review issues of information privacy, even though Taiwan had * Assistant Professor, Institute of Law for Science and Technology, National Tsing Hua University; S.J.D., University of Wisconsin Law School. An early version of this article was presented at the 2008 ILST Conference on Innovation, Competition and Regulation, Hsinchu, Taiwan (Nov. 13-14, 2008). IND. INT'L & COMP. L. REV. experienced a rich bloom of scholarly works concerning information privacy for ten years. In the United States, although the discourse of the Fourth Amendment has long been a substantial branch of privacy concern, the tradition of relying on the reasonable expectation of privacy test is an unsatisfactory response to State action, and a sufficient replacement test has not been developed. Establishing an adequate framework of judicial review will strengthen judicial performance and subsequently provide more capable protection for privacy and other public interests. Therefore, this article intends to join the endeavor to advance judicial review techniques addressing information privacy cases. A preferable strategy ofjudicial review involving information privacy can be developed upon the insights offered by Interpretation No. 603 of Taiwan's Constitutional Court. After deconstructing and reorganizing Interpretation No. 603, a framework emerges. It consists of multiple standards and the application of some independent rules stemming from data protection principles. This framework appears to be more sophisticated, thoughtful, and effective than the "reasonable expectation of privacy" test in addressing information privacy cases where State action is under examination. I will present my argument in three parts. Part I briefly reviews the developments regarding standards of judicial review in the United States and Taiwan, as well as the interactions between their developments. Part II introduces the background and opinions of Interpretation No. 603. Based on the understanding in Part II, Part III proposes a preferable framework for courts to use in reviewing information privacy cases. The approach of multiple standards constitutes the core of the framework, and the constitutionalized purpose specification principle, as well as other principles of information privacy protection, further accomplishes the framework. As a preliminary matter, a couple of terminology issues demand clarification. First, are "personal information" and "personal data" equivalent terms? While the use of "personal information" is popular in the United States, the term "personal data," is more frequently used in European literature. Although some argue "information" and "data"' are distinguishable, usually the terms "personal information" and "personal data" are used interchangeably in common speech. Therefore, this article treats them as synonymous. Second, in Taiwan, because of a divergent legal heritage, the legal concepts created to protect information privacy vary with scholars. Some scholars introduce and prefer to use the term "right of information self-determination" (informationelles Selbstbestimmungsrecht), which originated in Germany. Others prefer to use the term "right of information privacy," which emerged under the influence of American literature. 2 Despite the terminological 1. E.g., RAYMOND WACKS, PERSONAL INFORMATION: PRIVACY AND THE LAw 25 (1989). 2. For an introduction of the right of information self-determination developed by German courts and scholars, see Chen-Shan Li, Lun Zih Syun Zih Jyue Cyuan [On the Right of Information Self-determination], in REN SING ZUN YAN Yu REN CYUAN BAO JHANG 275,277-81 22 [Vol. 20:1 IN SEARCH OF A NEW APPROACH difference, some have argued that the concepts do not differ.3 Because the cores of both concepts equally surround the control over personal information, it is redundant to distinguish them and to maintain two different concepts. Therefore, this article refers only to the right of "information privacy" without an implication of the denial of the "right of information self-determination." Third, when referring to the governmental entity possessing the power of judicial review in Taiwan, commentators often called it the "Council of Grand Justices," a direct translation from its Chinese title to English.4 In contrast, the English version of Judicial Yuan's official website uses the phrase "Constitutional Court."5 Because the term "Court" more clearly indicates judicial power and is consistent with the official use, this article will refer to Taiwan's judicial review entity as the Constitutional Court. I. STANDARDS OF JUDICIAL REVIEW IN THE UNITED STATES AND TAIWAN: AN OVERVIEW A. The United States Categorization and the application of various standards represent a rough pattern of the American approach ofjudicial review. The approach consists of two steps. The first step requires an analysis and categorization of involved facts or laws. Then, as the second step, courts invoke a specific standard of judicial review according to the consequence of categorization. Although the complete utilization of the approach may not occur in all circumstances, it applies to most cases, including those involving individual rights.6 [HuMAN DIGNITY AND PROTECTION OF HuMAN RIGHTS] ( 2d ed. 2001) (Taiwan). For a brief description of the development of the constitutional right to information privacy in the United States, see DANIEL J. SOLOVE & MARC ROTENBERG, INFORMATION PRIVACY LAw 188-90 (2003). 3. See, e.g., Interpretation No. 603 (Const. Ct., Sept. 28, 2005) (Lin, J., concurring) (Taiwan); Jau-Yuan Hwang, Wu Jhih Wun Ze Wu Shen Fen Jheng? Huan Fa Guo Min Shen Fen Jheng Yu Ciang Jhih Cyuan Min Na Jhih Wun De Sian Fa Jheng Fen Si [No Fingerprint, No ID? A Constitutional Analysis ofMandatory Fingerprinting as Precondition ofNational ID Cards], in MIN JHU, REN CYUAN, JHENG YI [DEMOCRACY, HuMAN RIGHTS, JUSTICE] 461, 470 (International Association of Penal Law, Taiwan Chapter ed. 2005). See also Li, supra note 2, at 287-89. 4. E.g., Jou-juo Chu, Global Constitutionalism and Judicial Activism in Taiwan, 38 J. CONTEMP. ASIA 515, 516 (2008); Tom Ginsburg, Confucian Constitutionalism? The Emergence of Constitutional Review in Korea and Taiwan, 27 LAw & Soc. INQUIRY 763, 768 (2002); Thomas Weishing Huang, Judicial Activism in the Transitional Polity: The Council of Grand Justices in Taiwan, 19 TEMP. INT'L & COMp. L.J. 1, 2 (2005); Wen-Chen Chang, Transition to Democracy, Constitutionalism and Judicial Activism: Taiwan in Comparative Constitutional Perspective 133 (2001) (unpublished JSD dissertation, Yale Law School) (on file with Law Library, Yale Law School). 5. Judicial Yuan Justices of Constitutional Court, Petitions and Procedures for Interpretation, http://www.judicial.gov.tw/CONSTITUTIONALCOURT/EN/p02_01_0l.asp (last visited Nov. 7, 2009). 6. For an introduction to the frameworks guiding analysis of individual rights issues, see 2010] 23 IND. INT'L & COMP. L. REV. Categorization is a substantial part of constitutional reasoning. It is a common practice in various fields for people to group things or concepts to facilitate the understanding of natural knowledge or development of normative science. In establishing constitutional reasoning, courts and scholars use categorization. For example, a court may first identify a constitutional case as one associated with individual rights and distinguish it from one related to separation of powers. It may then further classify the case as a free speech case according to the type of individual rights implicated. And even after a court has categorized a case as one invoking individual rights to free speech, it will further categorize the case by inquiring whether the law at issue is content- based or content-neutral. For a content-based regulation, the question remains whether the regulation falls into any of the categories of speech such as "the lewd and obscene, the profane, the libelous, and the insulting or 'fighting' words."9 This series of inquiries is important because courts have sophisticatedly developed different responses to each different category. After categorization, the judicial review standard is determined from the following four types: strict scrutiny, intermediate scrutiny, minimal scrutiny, and categorical rules. In 1938, the famous footnote number four in United States v. Carolene Products Co. established the theory of double standard of judicial review, which distinguishes cases demanding greater scrutiny, such as legislation restricting political processes or which is directed at discrete and insular minorities, from cases requiring only the rational basis test, such as economic legislation.'o Later, intermediate scrutiny surfaced in areas such as sexual equality" to fill the middle of the spectrum between strict scrutiny and minimal scrutiny. The triple standard review technique is fairly familiar to American lawyers and regarded as basic in constitutional practice and scholarship. Yet, it has not exhausted the possibility of review techniques. A WiLLIAM A. KAPLIN, THE CONCEPTS AND METHODS OF CONSTITUTIONAL LAW 133-35 (1992). See also id. at 91-93, 100-03, 110-12. 7. It is worth noting that in this article, categorization simply refers to the method of grouping things or concepts. Naturally, in judicial review, it does not preclude the possibility of connecting the result of categorization with a balancing standard. I explain this point due to the existence of a special use of the "categorization" concept in the debate of "categorization v. balancing," which describes categorization and balancing as a dichotomy. In this latter context, once the category has been determined, the outcome of judicial review follows without any balancing efforts. About the debate of categorization v. balancing, see, e.g., John Hart Ely, Flag Desecration: A Case Study in the Roles of Categorization and Balancing in First Amendment Analysis, 88 HARv. L. REv. 1482 (1975); Kathleen M. Sullivan, Post-Liberal Judging: The Roles of Categorization and Balancing, 63 U. CoLO. L. REV. 293 (1992). Some scholars have recognized a kind of categorization compatible with balancing standards. See Kathleen M. Sullivan & Gerald Gunther, Constitutional Law 995 (15th ed. 2004). 8. See KAPLIN, supra note 6, at 18, 118. 9. See e.g., Chaplinsky v. New Hampshire, 315 U.S. 568, 572 (1942). 10. 304 U.S. 144, 152-53 n.4 (1938). For a classic elaboration of the rationale of footnote four, see JOHN HART ELY, DEMocRAcY AND DISTRUST: A THEORY OF JuDIcIAL REvIEw (1980). 11. Craig v. Boren, 429 U.S. 190,218 (1976); United States v. Virginia, 518 U.S. 515, 568 (1996). For an introduction of the development ofjudicial review standards associated with sex discrimination cases, see SuLLIvAN & GUNTHER, supra note 7, at 772-75. [Vol. 20:124 IN SEARCH OF A NEW APPROACH fourth type ofjudicial review technique is called "categorical judicial review." 2 Categorical judicial review involves per se rules rather than legislative purpose inquiries and means-ends tests.' 3 In other words, courts form specific constitutional mandates to apply in certain contexts. The violation of those categorical per se rules automatically invalidates state actions. In a strict sense, categorical judicial review is not a "standard" like the aforementioned three standards.14 In sum, with respect to standards of judicial review of constitutional questions, an understanding of court opinions as a whole reveals a triple standard review as a basic framework, and in some contexts the courts have created per se rules to apply instead. This section described how American courts conduct the reasoning of judicial review. Although judicial review varies with specific cases, contexts, and scholarly observations, categorization and multiple standards appear to be a dominant approach. While American lawyers may regard this approach as a universal approach, it is worth noting that different countries develop their ways of judicial review differently. The following section offers a fascinating example which maintains an intimate but divergent relationship with American style of judicial review. B. Taiwan As a country transplanting the legal system from the Western world, Taiwan's construction of judicial review is considerably shaped by the constitutional jurisprudence and practice of Western countries, especially Germany and the United States.' 5 Though Germany's principle of proportionality generally dominates Taiwanese construction ofjudicial review, the American style of judicial review has gained increasing influence as more scholars with American doctoral degrees discuss American jurisprudence. Germany's principle of proportionality has been one of Taiwan's most important constitutional doctrines.16 Article 23 of the Taiwanese Constitution provides that constitutional rights shall not be restricted unless it is "necessary to prevent infringement upon the freedoms of other persons, to avert an imminent crisis, to maintain social order or to advance public welfare."' 7 12. Robert J. Hopperton, Standards of Judicial Review in Supreme Court Land Use Opinions: A Taxonomy, an Analytical Framework, and a Synthesis, 51 WASH. U. J. URB. & CONTEMP. L. 1, 7, 82 (1997). 13. Id. at 7. 14. Id. at 82 ("In practice, categorical judicial review cannot be described as a standard of judicial review, for it is standardless [sic] in the sense of the varying degrees of scrutiny discussed by this Article."). 15. See Huang, supra note 4, at 5; see also Ginsburg, supra note 4, at 771-78. 16. See Huang, supra note 4, at 23. 17. MINGUO XIANFA [Constitution] art. 23 (1947) (emphasis added). The English version of the Constitution of Taiwan (Republic of China) (1947) is available at Justices of the Constitutional Court, Judician Yuan, The Constitution of the Republic of China, http://www.judicial.gov.tw/CONSTITUTIONALCOURT/en/pO7_2.asp?lawno=36. 2010]1 25 IND. INT'L & ComP. L. REv. Scholars universally interpret "necessary" to be equivalent to the principle of proportionality, which consists of three sub-principles: (1) the means adopted by the State must be helpful to the achievement of the intended objectives; (2) where there are several alternative means that would lead to a similar result in achieving the objectives, the one with the least harm to the rights and interests of the people shall be adopted; and (3) the harm that may be caused by the means adopted shall not be clearly out of balance against the interests of the objectives intended to be achieved.' 8 The Constitutional Court also regards the principle of proportionality as a part of the Article 23 requirement." However, the specific content of the principle in different decisions is not always consistent. In Interpretation No. 577, the Court did follow the three sub- principles above to review the Tobacco Product Labeling Act.20 In contrast, most other cases from this court did not specify the principle in detail or did not state the principle in complete accord with the scholarly description above.2 1 Despite the inconsistency, the principle of proportionality constitutes the most favored ruling standard of judicial review in Taiwan both academically and practically. Despite the popularity of Germany's principle of proportionality, the American model of judicial review standard is gaining increasing influence over Taiwan's development of constitutional jurisprudence. The introduction and advocacy of triple standard review techniques by Taiwanese scholars has continued for at least a decade. 2 2 Because applying three-tiered scrutiny 18. E.g., Zhi-Bin Fa & Bao-Cheng Dong, Sian Fa Sin Lun [Constitutional Law] 65-66 (3d ed. 2006). The three sub-principles of the principle of proportionality can also be found in Article 7 of Taiwan's Administrative Procedure Act of 1999. 19. Interpretation No. 436 (Const. Ct., Oct. 3, 1997) (Taiwan) (this is the first opinion mentioning that the law shall comply with the principle of proportionality under Article 23 of Taiwan's Constitution). 20. Interpretation No. 577 (Const. Ct., May 7, 2004) (Taiwan). See also Interpretation No. 575 (Const. Ct., Apr. 2, 2004) (Taiwan). 21. E.g., Interpretation No. 471 (Const. Ct., Dec. 18, 1998) (Taiwan) ("[C]onsidering the means adopted, the objective of prevention and treatment, and the demand of such an objective, [the provisions] violate the principle of proportionality under Article 23 of the Constitution"); Interpretation No. 623 (Const. Ct., Jan. 26, 2007) (Taiwan) ("[The provisions] adopt reasonable and necessary means to achieve the significant public interest that prevents and diminishes sexual transactions with children or juveniles; thus, the provisions do not violate the principle of proportionality under Article 23 of the Constitution."); Interpretation No. 476 (Const. Ct., Jan. 29, 1999) (Taiwan) ("[The laws] do not violate the principle of proportionality if the legislative objective is legitimate, means adopted are necessary, and restrictions are proportionate"). 22. For examples of academic works that introduced or advocated the American model of judicial review standard, see Tzu-Yi Lin, Yan Lun Zih You De SianJhih Yu Shuang GueiLi Lun [Restrictions on the Freedom ofSpeech and The Two-Track Theory], in YAN LuN ZIH You Yu SiN WuN ZmH You [THE FREEDOM OF SPEECH AND THE FREEDOM OF PREsS] 133, 142-54 (1999); Tzu-Yi Lin, Yan Lun Zih You Dao Lun [An Introduction to the Freedom ofSpeech], in TAI WAN SIAN FA JHIH ZONG Po HENG CIE [ANATOMIZING TAIwAN's CONSTITUTIONAL LAw] 103, 165-73 (Hong-Shi Lee et al. eds., 2002); Jau-Yuan Hwang, Li Fa Cai Liang Yu Sih Fa Shen Jha-Yi Shen Jha Biao Jhun Wei Jhong Sin [Legislative Discretion and Judicial Review: Focusing on the Standards ofJudicial Review], 26(2) SIAN JHENG SHm DAI [THE CONST. REv.] 156 (2000); 26 [Vol. 20:1 IN SEARCH OF A NEW APPROACH according to different contexts rather than invariably applying one standard takes judicial review into a more sophisticated realm, the academic community appears to be attracted to the American model. Later, it emerged in constitutional decisions as well. A prominent example of this emergence was seen in several Constitutional Court decisions addressing free speech issues that implicitly or explicitly drew on the United States' two-track and/or two-level theory. The United States' theory gradually formed through a series of U.S. Supreme Court cases and scholarly interpretations which systematically reviewed the law at issue by applying different scrutiny levels based on different categories of law or speech.24 Interpretation No. 603, which confronted an information privacy issue, presented another example of the Constitutional Court's acceptance of triple standard review techniques. 2 5 This article will illustrate the latter example, Interpretation No. 603, and its approach of judicial review. Taiwan absorbs nutrients from both the U.S. and European jurisprudence, It results in an interesting hybrid product. First, scholars and the Constitutional Court distorted the language of Article 23 of the Constitution to enjoy the merits of the principle of proportionality.26 Then the development strode towards a more sophisticated American approach due to the excellence of multiple standards. Currently, while the German principle of proportionality appears in decisions most frequently, Constitutional Court's rulings have been entangled with the American model of judicial review. C. Interplays The judicial review techniques of the United States and Taiwan are not, and will not be, developed in isolation of the other. Though American jurisprudence is constantly influencing Taiwanese judicial practices, Jau-Yuan Hwang, Sian Fa Cyuan Li Sian Jhih De Sih Fa Shen Jha Biao Jhun-Mei Guo Lei Sing Hua Duo Yuan Biao Jhun Mo Shih De Bi Jiao Fen Si [Judicial Standards ofReview for Restrictions on Constitutional Rights: Comparative Analysis ofthe U.S. Categorized Multiple Tests Approach], 33(3) TAI DA FA SIAo LuN CONG [NAT'L TAIWAN U. L. J.] 44 (2004). 23. In terms of the two-track theory, see Interpretation No. 445 (Const. Ct., Jan. 23, 1998) (Taiwan) and Interpretation No. 617 (Const. Ct., Jan. 23, 1998) (Lin, J., concurring) (Taiwan). As for the two-level theory, see Interpretation No. 577 (Const. Ct., May 7, 2004) (Taiwan); Interpretation No. 445 (Const. Ct., Jan. 23, 1998) (Taiwan); and Interpretation No. 414 (Const. Ct., Nov. 8, 1996) (Taiwan). See also Interpretation No. 577 (Const. Ct., June 20, 2008) (T. Hsu, J., concurring) (Taiwan); Interpretation No. 644 (Const. Ct., June 20, 2008) (Y. Hsu, J., concurring) (Taiwan). It is also worth noting that in Justice Tzu-Yi Lin's concurring opinion for Interpretation No. 644, he argued to apply strict scrutiny by invoking the concept of "prior restraint." Id. He also mentioned the U.S. Supreme Court Pentagon Papers case: New York Times Co. v. United States, 403 U.S. 713 (1971). 24. Regarding the two-track theory and two-level theory, see LAURENCE H. TRIBE, AMERICAN CONSTTUTIONAL LAW §§ 12-2 to 12-8 (2d ed. 1988). 25. However, American courts themselves do not strike the same path in the context of information privacy. 26. See Huang, supra note 4, at 25 (noting the gap between the language of Article 23 and the principle of proportionality). 2010] 27 IND. INT'L & COMP. L. REv. constitutional experiences in Taiwan also have potential for contributing to the jurisprudence of American judicial review. Through a long history of case law, the United States has accumulated abundant knowledge ofjudicial review techniques which have been a valuable contribution to the constitutional scholarship and judicial operation in Taiwan. As commentators observed, foreign influence permeates many opinions of Taiwan's Constitutional Court.27 Particularly, the last section showed that scholars have not only introduced the American approach, but the Constitutional Court has also adopted the approach of categorization and multiple standards in certain contexts. In a sense, the American model of judicial review standard is not completely "foreign" to Taiwan. Because Taiwan's Constitutional Court inherits the American approach ofjudicial review in certain cases, the insights provided by those cases will be easily recognizable by American lawyers. Since the transition from authoritarian party-state to democracy, Taiwan's Constitutional Court has played an active role in protecting people's rights in accord with constitutionalism. 28 Their efforts and outcomes have become a great asset for the international community. However, the heterogeneity between legal systems may obstruct incorporating foreign legal understandings. A country with a completely divergent legal development ofjudicial review may struggle with accepting the judicial review techniques emerging in Taiwan, even if it does appreciate the merits of the techniques. This is probably not the case for the United States. Because some of Taiwan's cases follow a comparable track to United States cases, the obstacles to incorporating Taiwan's techniques in the Unites States is largely diminished. The transmission of legal experience and knowledge between the United States and Taiwan can be bidirectional. Taiwan has adopted jurisprudence originating in the United States. Now, it may be time for Americans to take advantage of Taiwanese lessons. The latter chapters will offer specific examples of opinions from Taiwan's Constitutional Court which may potentially advance American jurisprudence. II. INTERPRETATION No. 603 OF TAIWAN'S CONSTITUTIONAL COURT A. Background The dispute arose from the implementation of Article 8 of the Household Registration Act. In early 2005, the Ministry of the Interior (MOI) announced that national identification cards (ID cards) would begin to be renewed on July 27. Ginsburg, supra note 4, at 771-78. See also Huang, supra note 4, at 5. 28. See Chang, supra note 4, at 392-97, 455,458-59, 504-05; Chu, supra note 4, at 519- 26; Ginsburg, supra note 4, at 788-89; Huang, supra note 4, at 40-54. 28 [Vol. 20:1 IN SEARCH OF A NEW APPROACH 1, 2005.29 Because Article 8 of the Household Registration Act required fingerprinting for people over the age of 14 in order to receive ID cards, the controversy regarding compulsory fingerprinting surfaced. 30 After the Executive Yuan expressed the intention to enforce the statute, 3 1 eighty-five congresspersons (members of the Legislative Yuan) filed a petition to the Constitutional Court for an interpretation of the Constitution. 32 Simultaneously, they petitioned for a preliminary injunction to suspend Article 8 of the Household Registration Act before an interpretation was delivered. Before a substantive review, the Constitutional Court issued Interpretation No. 599 that granted the preliminary injunction on June 10, 2005.34 In Interpretation No. 585, the Constitutional Court outlined a preliminary injunction and its elements.3 5 However, Interpretation No. 599 was the first time that the Constitutional Court ever exercised its authority to grant a preliminary injunction. It was disputed whether the Constitutional Court had the authority to issue preliminary injunctions because it was not specified by Taiwan's Constitution or mentioned in any statutes. Therefore, the creation of this authority, by the Constitutional Court's own interpretation, appears to be a milestone towards a more complete judicial power. On September 28, 2005, the Constitutional Court issued Interpretation No. 603 substantively addressing the constitutionality issue of Article 8 of the Household Registration Act. The general conclusion of this interpretation was met with universal acceptance from the academic community.37 Although some scholars might still dispute certain minor issues or concepts, it is undoubted that this interpretation lays a cornerstone for Taiwan's constitutional protection of the right of privacy. B. Opinion of the Court The opinion first revealed the following important points regarding 29. Cody Yiu, New Identification Cards to be Available from July, TAIPEI TIMES, Jan. 28, 2005, at 3. 30. See id. The requirement of fingerprinting was amended to the Household Registration Act in 1997. Id. 31. Jimmy Chuang, Fingerprinting is the Law: Cabinet, TAIPEI TIMEs, May 18,2005, at 2. 32. Interpretation No. 603 (2005). See also Jewel Huang, DPP Seeking to Halt Controversial Fingerprint Proposal, TAIPEI TIMES, May 31, 2005, at 2. 33. Interpretation No. 603 (2005). 34. Interpretation No. 599 (Const. Ct., June 10, 2005) (Taiwan). 35. Interpretation No. 585 (Const. Ct., Dec. 15, 2004) (Taiwan). 36. See Tzung-Jen Tsai, Comment, Sib Fa Yuan Da Fa Guan Shih Zih Di Liou Ling San Hao Jie Shih [J. Y. Interpretation No. 603], TAI WAN BEN Tu FA SYUE ZA JHIH [TAIWAN L. J.] 121, 121-22 (2005); Chen-Shan Li, Lai Jhe You Ke Jhuei Jheng Shih Ge Ren Zih Liao Bao Hu Wun Ti-Sih Fa Yuan Da Fa Guan Shih Zih Di Liou Ling San Hao Jie Shih Ping Si [Taking Personal Data Protection Seriously: Comment on J. Y. Interpretation No. 603], TAl WAN BEN Tu FA SYUE ZA JHIH [TAIWAN L. J.] 222, 222 (2005). 37. See, e.g., Tsai, supra note 36, at 121; id. at 117 (Jau-Yuan Hwang, commentary); id. at 111 (Chen-Shan Li, commentary); id. at 126 (Yuan-Hao Liao, commentary). 2010] 29 IND. INT'L & COMP. L. REv. information privacy and judicial review: 1. "Although it is not specifically enumerated in the Constitution ... the right of privacy is an indispensable constitutional right and protected under Article 22 of the Constitution."38 "The right of information privacy regards the autonomous control of personal information," which is covered by the right of privacy.39 [It] is intended to guarantee the people's right to decide whether to disclose their personal information, and to what extent, at what time, in what manner, and to whom they disclose their personal information. It is also intended to guarantee the people's right to know and control how their personal information will be used and right to correct any inaccurate entries regarding their personal information.40 2. In determining the constitutionality of the statute at issue, [T]he public interests served by the State's collection, use and disclosure of personal information and the harm upon individuals with information privacy should be comprehensively considered and balanced. In addition, different standards of judicial review should be applied to different circumstances according to the characteristics of personal information involved, that is, whether the personal information concerns intimate/confidential/sensitive matters or whether the information, though not intimate/confidential/sensitive, may nonetheless be easily combined with other information and lead to a detailed personal profile.4 1 38. Interpretation No. 603 (2005). Article 22 of the Republic of China (R.O.C.) Constitution, like the Ninth Amendment of the U.S. Constitution, is considered a roof for all unenumerated constitutional rights. It provides that "[a]ll other freedoms and rights of the people that are not detrimental to social order or public welfare shall be guaranteed under the Constitution." MINGUO XIANFA [Constitution] art. 22 (1947) (Taiwan). Before Interpretation No. 603 came out, it was unclear whether the court recognized the right of privacy as a constitutional right and which provision the constitutional basis of the right of privacy should be, although early in 1992, Interpretation No. 293 had mentioned the right of privacy. See Shin- yi Peng, Privacy and the Construction ofLegal Meaning in Taiwan, 37 INT'L LAw. 1037, 1042- 43 (2003). 39. Interpretation No. 603 (2005). 40. Id. 4 1. Id. 30 [Vol. 20:1 IN SEARCH OF A NEW APPROACH 3. "The State shall ensure that the use of the personal information legitimately obtained by the State reasonably accords with the purpose and that the security of the information be safeguarded. Thus, the purposes of the State's collection of the information must be specifically identified by statutes. 4 2 By applying the general principles above to fingerprints and fingerprint databases, the Constitutional Court made the following analysis. First, in terms of the type of information and standard ofjudicial review, categorized as point two, the Court indicated that "the State's collecting fingerprints and establishing files in association with identity confirmation makes fingerprints sensitive information that enables monitoring individuals."4 It follows that "[i]f the State collects the people's fingerprint information on a large scale by compulsory methods, the collection is allowed only where it is the mean that causes less harm and is closely related to the achievement of a significant public interest."" In other words, "the scope and means of such collection shall be highly necessary and relevant to the achievement of the purposes of such significant public interest.' 45 Second, with respect to the purpose of collection, categorized as point three, the Court required that "the State shall specify the purpose of information collection in a statute 46 and, moreover, "the statute shall manifestly prohibit any use falling outside of the statutory purpose.' 47 Third, in addition to the application of the principles it revealed earlier, the Court further mandated that [T]he agency shall take into account the contemporary development of technology to act in the manner that is sufficient to ensure the accuracy and security of the information, and adopt necessary protective measures in terms of organization and procedure as to the files of collected fingerprints .... 48 After reviewing the statute, the Court held the provisions at issue unconstitutional. The Court first criticized that the statute failed to specify the purpose of collection. "The failure of the Household Registration Act to specify the purpose of compulsory fingerprinting and record keeping of such fingerprinting information is already inconsistent with the aforesaid constitutional intent to protect the people's right of information privacy.' 4 9 42. Id. 43. Id. 44. Id. 45. Id. 46. Id. 47. Id. 48. Id. 49. Id. 2010] 31 IND. INT'L & COMP. L. REV. Even considering the purposes asserted during the oral argument by the Executive Yuan regarding compulsory collection of fingerprint information, the Court concluded that [T]o pursue the purposes of anti-counterfeit, prevention of false claim or use of an identity card, identification of a roadside unconscious patient, stray imbecile or unidentified corpse, and so on, fails to achieve the balance of losses and gains and is an excessively unnecessary mean, and does not satisfy the requirement of the principle of proportionality.so C. Concurring and Dissenting Opinions Although a great majority of the Constitutional Court's justices voted for the opinion of the Court, their opinions vary to some extent. Among fifteen justices, four submitted separate concurring opinions, two submitted a joint concurring opinion, one submitted an opinion that concurs in part and dissents in part, and two submitted separate dissenting opinions. Many opinions debated over the procedural issue of whether the petition met the elements imposed by Article 5-I (iii) of the Constitutional Interpretation Procedural Act. For example, Justice Jen-Shou Yang's and Justice Tsay-Chuan Hsieh's dissenting opinions both focused only on this procedural issue and argued against hearing the case.51 Because the issue is not related to the right of information privacy, it is not relevant to the argument at hand. However, the four opinions providing a substantive discussion concerning information privacy demand attention. To a large extent, the concurring opinions of Justice Tzu-Yi Lin's and Justices Tzong-Li Hsu and Yu-Tien Tseng's support the main points of the Court's opinion.5 2 To offer additional reasoning or reinforce the arguments of the Court, Justice Tzu-Yi Lin stressed the danger of collecting compulsorily fingerprint information for the purpose of improving public safety/crime prevention and further explained the importance of requiring specific legislative purposes,5 3 while Justices Tzong-Li Hsu and Yu-Tien Tseng highlighted how the statute did not specify the purpose of collection and use and did not provide adequate protective measures in terms of organization and procedure to prevent the invasion of third parties.54 In addition, Justice Lin presented a prominent argument stating that, considering the sensitivity of fingerprint information, reviewing a law that mandates compulsory collection of fingerprints should trigger strict scrutiny rather than 50. Id. 51. Id. (Yang, J., dissenting) and (Hsieh, J., dissenting). 52. Id. (Lin, J., concurring) and (Hsu & Tseng, Js., concurring). 53. Id. (Lin, J., concurring). 54. Id. (Hsu & Tseng, Js., concurring). 32 [Vol. 20:1 IN SEARCH OF A NEW APPROACH intermediate scrutiny, which the Court applied.ss Differently from Justices Lin, Hsu and Tseng, Justice Chung-Mo Cheng widely questioned the opinion of the Court. He deemed fingerprints as neutral information and thus argued that the Court should invoke the minimum standard ofjudicial review rather than strictly reviewing the provision in terms of the "principle of clarity and definiteness of law."57 He also claimed that the provision at issue does not necessarily violate the principle of proportionality. 8 An even sharper disagreement with the opinion of the Court appeared in Justice Syue-Ming Yu's concurring and dissenting opinion. In his words, "fingerprints themselves do not implicate the right of privacy."60 Although acknowledging fingerprints are a kind of personal information, he argued that the Court should dismiss the case procedurally or at most apply the rational basis test.61 Moreover, in his opinion, public safety as the purpose of the provision at issue is compelling enough to pass even strict scrutiny, while the opinion of the Court did not take crime prevention into account as a legislative 62purpose. M. A PROPOSED FRAMEWORK TO REVIEWING INFORMATION PRIVACY CASES: THE UNDERSTANDING IN INTERPRETATION No. 603 AS A STARTING POINT A. The Problem of the "Reasonable Expectation of Privacy" In addressing information privacy cases, American courts extensively rely on the "reasonable expectation of privacy" test. However, this approach is logically problematic and practically ineffective. In the area of information privacy, the concept of the reasonable expectation of privacy determines the fate of most cases. Since Justice Harlan stated the reasonable expectation of privacy test in his concurring opinion in Katz v. United States, numerous court opinions have applied this test.M The test inquires whether the person who was intruded by the State has an actual 55. Id. (Lin, J., concurring). 56. Id. (Cheng, J., concurring). 57. Id. 58. Id. 59. Id. (Yu, J., concurring and dissenting). 60. Id. 61. Id. 62. Id. 63. 389 U.S. 347, 361 (1967) (Harlan, J., concurring) ("My understanding of the rule that has emerged from prior decisions is that there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as 'reasonable."'). 64. William C. Hefferan, Fourth Amendment Privacy Interests, 92 J. CRum. L. & CRIMINoLOGY 1, n.2 (2001). 2010] 33 IND. INT'L & CoMp. L. REV. privacy expectation which society regards as reasonable.65 At first glance, the test plausibly presents a plain explanation of whether privacy invasion exists. This makes the test attractive and frequently embraced by courts. Generally speaking, where courts do not find a reasonable expectation of privacy, plaintiffs lose the cases; where courts recognize a reasonable expectation of privacy, the plaintiffs win. However, the test suffers critical deficiencies. The first problem arises from the incompleteness of its reasoning process. It explains only whether a privacy interest deserving protection exists, but does not consider the balance of all involved interests. A complete reasoning requires weighing various interests after recognizing a privacy interest. Where a reasonable expectation of privacy is present, but is outweighed by other stronger interests, courts cannot help twist the finding to conclude that a reasonable expectation of privacy does not exist. For example, in Torbet v. United Airlines, Inc.," the court concluded that the airport security screening procedures at issue were reasonable because the passenger implicitly consented to random search by placing his bag on the x-ray conveyor belt.67 However, the so-called "consent" here is by no means voluntary because passengers who want to take a flight have no other choice. The contents of our bags are definitely private and the true reason that the court favored the police and the practice of a random search is that the court regarded flight security as a substantial enough to outweigh the passengers' privacy interest, rather than passengers cannot reasonably retain privacy expectation after handing over their bags. It then becomes obvious that the operation of the reasonable expectation of privacy test would hide a part of reasoning that should proceed in front of public eyes. The second flaw of the test concerns the assessment of "reasonableness." Scholars have criticized the circularity of the reasonable expectation of privacy test because the test defines "reasonable" by "reasonable."68 If courts possess capable methods to exercise their discretion concerning reasonableness, the term "reasonable" might not be much of a problem. Unfortunately, courts have not yet developed any effective tool or rule to identify a "reasonable expectation" of privacy. 69 As a result, the test equips courts with only a crippled way to address privacy inquiries. Worse yet, courts usually determine the reasonable expectation of privacy by comparing the practice at issue with preexisting practices or environments. As Freiwald put it, the judicial operation 65. Katz, 389 U.S. at 361. 66. 298 F.3d 1087 (9th Cir. 2002). 67. Id. at 1089. 68. Susan Freiwald, First Principles of Communications Privacy, 2007 STAN. TECH. L. REV. 3, para. 21 (2007) ("The presence of 'reasonable' in both the name of the test and its definition makes the test circular: the reasonable expectations are reasonable."); Silas J. Wasserstrom & Louis Michael Seidman, The Fourth Amendment as Constitutional Theory, 77 GEO. L.J. 19, 69 (1988) (describing the reasonable expectation of privacy test as "notorious circularity"). 69. See Freiwald, supra note 68, at para. 23; Heffernan, supra note 64, at 1, 32, 37. 34 [Vol. 20:1 IN SEARCH OF A NEW APPROACH of the test "misplaces the focus onto what the target knew or should have known instead of on the intrusive nature of the surveillance itself."70 For example, in Kyllo v. United States,' the Court concluded that the use of thermal imaging to measure heat emanating from a home constituted a Fourth Amendment search and is presumptively unreasonable without a warrant. However, according to the Court's holding, the conclusion is valid only where the device "is not in general public use."72 It follows that if the device is in public use, then use of it will no longer constitute a search, even though its intrusive nature has not changed. By the same logic, in an area where voyeurs frequently appear (and the police fail to sweep them), the police have unfettered discretion to videotape people's movement inside a public lavatory by claiming that one cannot reasonably expect privacy in that circumstance. By the same logic, in an age when investigation agencies arbitrarily wiretap people, the police can legitimately monitor people's phone conversations by claiming that it would not be reasonable for anyone to expect privacy when they talk on the phone. These ridiculous consequences make it obvious that this approach to addressing privacy cases is problematic and unreliable. Relying only on the reasonable expectation of privacy test is not satisfactory. While the test might be helpful in certain cases, it encounters attacks from both theoretical dissection and practical consideration. Therefore, courts have overlooked better alternatives which avoid the deficiencies that this test contains by blindly following past precedent. B. The Approach of Multiple Standards I argue for the approach of multiple standards as an alternative for the reasonable expectation of privacy test. The problems found in the last section do not occur in the use of the proposed approach. Moreover, using a multiple standard approach is consistent with existing American jurisprudence of judicial review and has been put into practice in Taiwan's information privacy cases. In comparison with the reasonable expectation of privacy test, the approach of multiple standards has the following merits. First, invoking a standard takes care of the balance of involving rival interests. Unlike the reasonable expectation of privacy test that focuses only on whether a reasonable expectation of privacy exists and presents a straightforward zero-sum game, the approach demands that courts not only identify a privacy interest, but also to weigh the privacy interest and rival state interests. For example, when strong privacy interests are involved, the state action burdening the privacy interests 70. Friewald, supra note 68, at para. 21. 71. 533 U.S. 27,40(2001). 72. Id. ("Where, as here, the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a 'search' and is presumptively unreasonable without a warrant."). 2010]1 35 IND. INT'L & COMP. L. REv. has to be reviewed under stricter standards, meaning that the state action has to be narrowly tailored to pursuing a compelling interest.73 Choosing a specific standard purports that a specific level of state interest, such as a legitimate, important, or compelling interest, is required to justify the restriction of privacy rights.74 By differentiating the facts and according different standards, the approach is able to strike the balance of privacy interests and rival state interests. As a result, the approach does not draw the logical deficiency that the reasonable expectation of privacy test has suffered. Second, the approach need not address thorny problem of measuring abstract, lack-of-standard "reasonableness." Third, the approach presents a sophisticated framework consisting of multiple review steps and standards, rather than relying only on one single rule. It therefore promotes judicial review to a more thoughtful level in response to complex cases. Incorporating the approach of multiple standards into judicial review of information privacy would not pose any discord with current practice of American courts. As shown in Part I, American courts maintain a triple standard approach as a basic framework to constitutional issues, except sometimes appealing to categorical per se rules. The approach pervades in most constitutional contexts and there is no reason that the information privacy field should be an exception. Further, because of the existing tradition of the multiple standards approach, it would not be difficult to apply the approach to information privacy cases in the United States. Interpretation No. 603 has exemplified the application of the triple standard approach in the context of information privacy. This interpretation clearly provided that "different standards ofjudicial review should be applied to different circumstances." 7 5 Instead of completely following the principle of proportionality, the Constitutional Court invoked another standard: the purpose shall be pursuing a significant public interest and the means shall be highly necessary and closely relevant to the achievement of the purposes.76 The Court did not specify how many standards it had in mind and did not indicate what level of standard it used in this case. Nevertheless, reading Justice Lin's concurring opinion and Justice Yu's concurring and dissenting opinion together with the Court opinion, it appears that the American three-tier approach profoundly influenced the Court because it applied intermediate scrutiny. When Justice Lin argued for strict scrutiny and Justice Yu supported minimum 73. To survive strict scrutiny, the law must satisfy two prongs: first, the underlying governmental interests must be compelling; and second, the law must be narrowly tailored to achieve those governmental interests. See, e.g., Adam Winkler, Fatal in Theory and Strict in Fact: An Empirical Analysis ofStrict Scrutiny in the Federal Courts, 59 VAND. L. REv. 793, 800 (2006). 74. Passing deferential scrutiny requires only a legitimate governmental interest and passing intermediate scrutiny requires an important governmental interest. See, e.g., SULuvAN & GuNTHER, supra note 7, at 641, 643. 75. Interpretation No. 603 (2005). 76. Id. 36 [Vol. 20:1 IN SEARCH OF A NEW APPROACH scrutiny against the Court opinion's standard, they plainly used the terms "strict scrutiny," "intermediate scrutiny," or "rationality scrutiny."n The interpretation evidenced that the approach can be practically useful in addressing the constitutionality issues of information privacy. Instead of routinely relying on the reasonable expectation of privacy test, courts should consider the alternative approach of using multiple standards. The merits described above sufficiently make the approach prominent in comparison with the reasonable expectation of privacy test. The analysis above also precludes the concern of practicability. While its detail demands it to be further embodied and supplemented, the approach has undoubtedly shown an option that will better serve for the resolution of constitutional cases of information privacy. C. Invocation of Scrutiny and Other Constitutional Mandates Establishing a multiple standard approach goes only halfway to comprehensively addressing information privacy issues. The answers to the following questions will further enrich and supplement the approach of multiple standards to complete the proposed framework. First, what factors should courts take into account when determining which standard to apply? Second, in addition to a triple standard approach, is there any other constitutional rule that courts should also have in mind when examining the law? 1. Factors Triggering Diferent Standards To complete the multiple standards approach, it is necessary to establish when a specific standard should be triggered; in other words, to establish what factors courts should consider when deciding which standard to invoke. For instance, the level of scrutiny courts use to review regulations on speech is determined by a number of factors, including: whether the regulation is content- based or content neutral and whether the restricted speech is regarded as high- value or low-value speech. But because rationale for protecting information privacy differs significantly from the rationale for protecting the freedom of speech, or other fundamental rights, a framework uniquely designed for protecting information privacy is needed. 77. Interpretation No. 603 (2005) (Lin, J., concurring) and (Yu, J., concurring and dissenting). It is worth noting that the term that the court used to describe the requirement of the purpose is "jhong da gong yi," the translation of which is debatable. "Gong yi" means a "public interest." As for "jhong da," I translated it as "significant" in order to avoid the implication of a specific standard. Justice Lin probably considered "jhong da" as "important." On the other hand, Justice Yu seemed to regard it as "compelling" and thus criticized that the Court should have used "jhong yao" (important) instead of "jhong da," since the Court intended to state intermediate scrutiny. Id. 78. See generally TRIBE, supra note 24. 2010] 37 IND. INT'L & CoMP. L. REV. In Interpretation No. 603, the court suggested that different types of personal information should trigger different standards ofjudicial review. The court clearly stated that different standards ofjudicial review should be applied to different circumstances according to the characteristics of personal information involved; that is, whether the personal information concerns intimate/confidential/sensitive matters or whether the information, though not intimate/confidential/sensitive, may nonetheless be easily combined with other information and lead to a detailed personal profile. 9 Where sensitive personal information is involved, there is a greater danger of a privacy invasion. For this reason, the European Union Data Protection Directive generally prohibits the processing of certain categories of personal data, including "personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life."80 Following this idea, scholarly works create an even more sophisticated classification of personal information according to the levels of sensitivity. 1 The understanding that the extent of a privacy threat differs depending on the sensitivity of the personal information involved should not matter only to the regulatory policy, but should also effect the level of scrutiny of judicial review - as it did in Interpretation No. 603. In addition to the involvement of sensitive personal information, the aforementioned statement of the court describes the other scenario in which stricter scrutiny should be triggered; that is, where the "information, though not intimate/confidential/sensitive, may nonetheless be easily combined with other information and lead to a detailed personal profile."82 Modern data processing technologies, such as computer databases and data mining tools, are able to easily accumulate, analyze, and interpret personal information, and to subsequently reveal individuals' behavior patterns and psychological profiles.83 Thus, the sensitivity of a single piece of personal information is not the only concern. The combination of information also presents a privacy alert. Accordingly, a law allowing the databases of different agencies to connect with each other, even containing no sensitive personal information, should receive strict judicial examination. The sensitivity of personal information and the likelihood of the exposure of a detailed personal profile through combining bits of personal information do not necessarily exhaust all possible factors that courts should consider. For 79. Interpretation No. 603 (2005). 80. Council Directive 95/46, Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of such Data, art. 8, 1995 O.J. (L 281) 31 (EC), available at http://eur-lex.europa.eulLexUriServ/LexUriServ.do.uri=CELEX:31995LOO46 :EN:HTML [hereinafter Council Directive 95/46]. 8 1. For example, Wacks categorizes more than three hundred types ofpersonal information into three levels of sensitivity-high sensitivity, moderate sensitivity, and low sensitivity. WACKS, supra note 1, at 227, 229-38. 82. Interpretation No. 603 (2005). 83. SoLovE & ROTENBERG, supra note 2 at 49. 38 [Vol. 20:1 IN SEARCH OF A NEW APPROACH instance, the likelihood and the scale of disclosure of personal information might play a role as well, because larger-scale disclosure causes greater privacy harm. It follows that a freedom of information law opening people's personal information held by governments to the public without weighing privacy interests and withholding certain personal information would appear constitutionally suspicious and should trigger stricter scrutiny, because this law may lead to wide dissemination of personal information. By speculating about potential privacy interests in various circumstances, a couple of factors triggering judicial review standards have emerged. The two factors unearthed from Interpretation No. 603, the sensitivity of personal information and the likelihood of the exposure of a detailed personal profile, should have an effect on the choice of standards. And in addition to the two factors borrowed from Interpretation No. 603, further variables, such as the scale of the disclosure of personal information, should be considered. 2. The Principle ofSpecificity of Purposes In addition to triple standards, I suggest introducing the principle of specificity of purposes to the constitutionality examination. Where the right of information privacy is involved, vagueness/specificity of law becomes a more considerable point in judicial review. While the rule of law requires laws to be as specific as possible to provide certainty and predictability, allowing vagueness in a law's language may offer flexibility and efficiency of enforcement. In consideration of these conflicting interests, the courts in both the United States and Taiwan differentiate cases and respond with divergent degrees of strictness in terms of vagueness/specificity of laws. The context of information privacy may provoke a higher requirement in this regard, especially under the "purpose specification principle," a widely accepted principle of data protection. As a general principle, vagueness/specificity of law affects a law's constitutionality. In Taiwan, the "principle of clarity and definiteness of law" is universally regarded as a constitutional principle, because excessively vague provisions would destroy the predictability of the application of the law and impose undue restrictions on the people.85 While the principle has a far- reaching territory of application, it is worth noting that in a case involving the freedom of assembly, the court seemed to heighten the requirement of the principle to invalidate the provisions that might be considered constitutional in contexts other than the freedom of expression. In the United States, the 84. The Freedom of Information Act in the United States establishes several exemptions, including "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy" to balance the right to access governmental information and the right to privacy. 5 U.S.C. § 552(b)(6) (2009). The Freedom of Information Act in Taiwan provides a similar exemption in Article 18. 85. See Interpretation No. 432 (Const. Ct., July 11, 1997) (Taiwan). 86. Interpretation No. 445 (1998). 2010] 39 IND. INT'L & COMP. L. REV. vagueness doctrine primarily arises in First Amendment cases, while it has implications on the notice requirement of procedural due process as well.87 Similar to the development in Taiwan, the impact of vagueness on the constitutionality of law varies. As Justice Powell said in Smith v. Goguen, "Where a statute's literal scope, unaided by a narrowing state court interpretation, is capable of reaching expression sheltered by the First Amendment, the [vagueness] doctrine demands a greater degree of specificity than in other contexts." 89 In summary, courts tend to more strictly scrutinize the law when the freedom of speech is involved due to the potential for a chilling of legitimate speech by citizens. The current divergent responses to free speech cases imply that although the principle concerning vagueness/specificity of law universally applies to all areas, the teeth of the principle may vary with contexts. In the area of personal information protection, the "purpose specification principle" has long been identified as one of its basic principles.90 Early in 1980, the OECD began to require that The purposes for which personal data are collected . . . be specified not later than at the time of data collection and the subsequent use limited to the fulfilment [sic] of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.9' Other influential international instruments, such as the European Union Data Protection Directive92 and the Asia-Pacific Economic Cooperation (APEC) Privacy Framework,93 also made similar points. Moreover, the domestic legislation of many countries embodies this principle. Taking Taiwan's Computer-Processed Personal Data Protection Act as an example, Articles 7 and 18 of the Act require that for collection or computer processing of personal information, government organizations or non-government organizations must have a specific purpose. In other words, the principle has become not only a desired practice, but also a statutory mandate in many countries. The developments described above confront us with the question of 87. SuLLvAN & GUNTHER, supra note 7, at 1347-48. 88. 415 U.S. 566 (1974). 89. Id. at 573. 90. See, e.g., WACKS, supra note 1, at 208. 91. Id. See also Org. for Econ. Co-operation & Dev [OECD], OCED Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, art. 9 (1980), available at http://www.oecd.org/document/1 8/0,3343,en_2649 34255_18151861_1_1_1,00.html. 92. Council Directive 95/46, supra note 80, at art. 6. 93. Asia-Pacific Econ. Cooperation [APEC], APEC Privacy Framework, art. 15 (Nov. 17- 18, 2004), available at http://www.apec.org/aped/news media/2004_media-releases/201104 apecminsendorseprivacyfrmwk.MedialibDownload.vl.html?url=/etc/medialib/apec media library/downloads/ministerial/annual/2004.Par.0015.File.vl.1 [hereinafter APEC]. 40 [Vol. 20:1 IN SEARCH OF A NEW APPROACH whether the level of specificity of the collection purpose should meet higher criterion in order to avoid an unconstitutional judgment. Interpretation No. 603 has taken into account the understanding that I presented in the last two paragraphs. In my analysis, Interpretation No. 603 incorporated the purpose specification principle into the principle of clarity and definiteness of law as it mandated that the "purposes of the State's collection of the information must be specifically identified by statutes." 94 It is not enough that the government discovers the purposes from the legislative history or unilaterally asserts those purposes.95 In a later paragraph, the Constitutional Court stressed that "the State shall specify the purpose of information collection in a statute" as one of requirements for collecting fingerprints on a large scale and storing them in a database.96 In short, the Court has promoted the purpose specification principle as a constitutional mandate in the context of information privacy or at least in the context of fingerprint databases. Reasoning through the path of the vagueness doctrine in special contexts, the purpose specification principle as one of major information privacy principles, or the combination of them, would reach the same conclusion. That is, the specificity of the purpose of information collection in the law at issue should be considered as an element determining the constitutionality of the law. In addition to reviewing the law through the approach oftriple standards, courts should also examine the law in terms of the specificity of collection purpose. While vagueness/specificity of law matters in all areas, information privacy demands higher protection in this regard. According to the principle of specificity of purposes, which in my view has emerged in Interpretation No. 603 as a constitutional rule, courts should invalidate a law that authorizes the gathering of large-scale personal information without specifying the purpose of information collection. 3. Principles ofData Protection In addition to the purpose specification principle, should any other data 94. Interpretation No. 603 (2005). Justice Chung-Mo Cheng, in his concurring opinion, also construed the opinion of the court in the way similar to my understanding. Id. (Cheng, J., concurring). In his view, the court strictly reviewed the statute at issue in term of the "principle of clarity and definiteness of law" because the court regarded fingerprints as sensitive personal information. Id. Different from the opinion of the court, he argued to review the statute at issue in term of the "principle of clarity and definiteness of law" by a lower standard. Id. 95. Interpretation No. 603 (2005). On the contrary, Justice Syue-Ming Yu, in his concurring and dissenting opinion argued that the court can discover legislative purposes through the legislative history or even come up with legislative purposes by itself. Id. (Yu, J., concurring and dissenting). And, in this case, he thought the legislative history had sufficiently suggested what the purposes are. Id. See also id. (Cheng, J., concurring). 96. Interpretation No. 603 (2005). 97. In addition to the opinion of the court, Justices Tzong-Li Hsu and Yu-Tien Tseng's concurring opinion also supported the idea that the statute must clearly state the purpose of collecting and using people's personal information. Id. (Hsu & Tseng, Js., concurring). 2010] 41 IND. INT'L & COMP. L. REV. protection principles be incorporated into the interpretation of the Constitution? Current discussion focuses on the role of those principles in legislative policies and largely overlooks the significance of the issues regarding constitutional implications of data protection principles. While the purpose specification principle has been discussed above, other widely accepted principles of data protection and their potential constitutional implications are subject to exploration in this section. The following influential international instruments respectively established several general principles of data protection. The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data declare eight basic principles of data protection, including the collection limitation principle, data quality principle, purpose specification principle, use limitation principle, security safeguards principle, openness principle, individual participation principle, and accountability principle.98 Articles 6 to 11 of the European Union Data Protection Directive reveal its seven groups of data protection principles.99 The APEC Privacy Framework also announces its information privacy principles under the following subjects: preventing harm, notice, collection limitation, uses of personal information, choice, integrity of personal information, security safeguards, access and correction, and accountability.loo The principles proclaimed in different international or domestic instruments are by no means identical. Yet, in many points, they do overlap or possess similar ideas. The principles that receive extensive acknowledgement represent common consensuses regarding what should be done about personal information protection. The courts may acknowledge the implication of those principles of data protection in judicial review. Interpretation No. 603 has taken a substantial step towards transforming the principles of data protection into constitutional mandates. As shown in the prior section, the purpose specification principle entered the Constitution through the existing "principle of clarity and definiteness of law" in the interpretation. It displays the possibility that courts can adopt certain data protection principles to be constitutional rules in reviewing information privacy cases. Other principles of data protection deserve attention as well. The purpose specification principle deals with only the justification of collection ofpersonal information. After taking care of the justification of collection, the issues of storage, use and disclosure of the information remain unaddressed. Other rules are needed to ensure sustained protection in reducing privacy risk. Interpretation No. 603 again provided a good example. It has established the 98. OECD, supra note 91, at pt. 2. 99. Council Directive 95/46, supra note 80, at art. 6-11. Solove and Rotenberg give titles to those seven groups of principles required by Articles 6 to 11 of the Directive. See SoLovE & ROTENBERG, supra note 2, at 726-28. 100. APEC, supra note 93, at pt. 3. 42 [Vol. 20:1 IN SEARCH OF A NEw APPROACH constitutional mandates that obviously stem from the use limitation principle'o' and security safeguards principle.102 With respect to the use limitation principle, the Constitutional Court made it clear that the "State shall ensure that the use of the personal information legitimately obtained by the State reasonably accords with the purpose" and that "the statute shall manifestly prohibit any use falling outside of the statutory purpose." 0 3 As to the security safeguards principle, the Court required that "the security of the information be safeguarded."'" Moreover, the Court noted the importance and the changing nature of technology. Therefore, it further provided that "the agency shall take into account the contemporary development of technology to act in the manner that is sufficient to ensure the accuracy and security of the information, and adopt necessary protective measures in terms of organization and procedure as to the files of collected fingerprints." 0 5 For the Court, the use limitation principle and security safeguards principle have become not only the criteria of good practices, but also constitutional rules. Interpretation No. 603 has by no means thoroughly addressed constitutional effectiveness of all data protection principles. For example, it did not particularly elaborate the role of the "individual participation principle""1 in judicial review.107 suggest that granting the right of individuals to access and correct their personal information should also be a 101. "Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with Paragraph 9 except: a) with the consent of the data subject; or b) by the authority of law." Council Directive 95/46, supra note 80, art. 10. See also id. at art. 6; APEC, supra note 93, at art. 19. 102. "Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data." OECD, supra note 91, at art. 11. See also Council Directive 95/46, supra note 80, at art. 17; APEC, supra note 93, at art. 22. 103. Interpretation No. 603 (2005). 104. Id. 105. Id. Justices Tzong-Li Hsu and Yu-Tien Tseng in their concurring opinion further elaborated the State's obligation to adopt adequate protective measures. Id. (Hsu & Tseng, Js., concurring). On the contrary, Justice Chung-Mo Cheng in his concurring opinion questioned the activism of the court in forming such a detailed discussion directing the legislature. Id. (Cheng, J., concurring). 106. "An individual should have the right: a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; b) to have communicated to him, data relating to him within a reasonable time; at a charge, if any, that is not excessive; in a reasonable manner; and in a form that is readily intelligible to him; c) to be given reasons if a request made under subparagraphs(a) and (b) is denied, and to be able to challenge such denial; and d) to challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed or amended." OECD, supra note 91, at art. 13. See also Council Directive 95/46, supra note 80, at art. 12, (discussing the protection of individuals with regard to the processing of personal data and on the free movement of such data); APEC, supra note 93, at art. 23. 107. Nevertheless, it does mention the right to know how their personal information will be used and the right to correct any inaccurate entries regarding their personal information as a part of the content of the right of information privacy. Interpretation No. 603 (2005). 2010] 43 IND. INT'L & COMP. L. REv. constitutional mandate, because the rights of access and correction have been widely considered as a core mechanism concerning data protection and, moreover, because the Court in Interpretation No. 603 has deemed it as an aspect of the right of information privacy. The principle is significant enough to function in the realm of constitutional law. In Taiwan, the Computer- Processed Personal Data Protection Act has created the rights to access, acquire copies of, amend and correct personal information in Article 4 and therefore meets the requirement. However, if any new legislation extremely restricts individuals' right to access and correct personal information or eliminate it altogether, it should encounter great difficulty surviving the constitutional challenge.10 8 CONCLUSION This article reveals an alternative framework to the reasonable expectation of privacy test in examining the state actions that invade the right of information privacy. By understanding the jurisprudence of judicial review in both the United States and Taiwan, this article is able to dissect Interpretation No. 603 of Taiwan's Constitutional Court and reorganize it so it is in line with preexisting jurisprudence. The resulting framework consists of the approach of multiple standards and certain independent rules. To be more specific, the approach of multiple standards constitutes the core of the framework, and the constitutionalized purpose specification principle as well as other principles of information privacy protection further accomplishes the framework. The framework appears to be more sophisticated, thoughtful, and effective than the reasonable expectation of privacy test in addressing many information privacy cases in which state action is subject to examination. As I have pointed out, the reasonable expectation of privacy test is logically problematic and practically ineffective because of the deficiencies in its reasoning process and the difficulties arising from the assessment of "reasonableness." The framework I proposed, based on an analysis of Interpretation No. 603, not only avoids these problems, but also promotes a more refined and exquisite approach of judicial review with respect to information privacy. While Interpretation No. 603 has provided a solid foundation for developing a preferable strategy of judicial review involving information privacy, its analysis in this article does not end the need for further advancement in the field. First, after accepting the approach of triple standards, efforts can be made to seek additional factors implicating the determination of which scrutiny should be triggered. For example, I have suggested the 108. It has raised controversy that the draft of Taiwan's Biobank Act contains a provision precluding the rights to access, acquire copies, amend, and correct personal information. Article 5 of the draft of the Biobank Act, submitted by the Department of Health to the Administrative Yuan, Jan. 5, 2009 (on file with author). 44 [Vol. 20:1 2010] IN SEARCH OF A NEW APPROACH 45 likelihood and the scale of disclosure of personal information to be one of the potential factors that should be taken into account in addition to those that have been considered in Interpretation No. 603. Second, because certain data protection principles reflect strong hints of common consensuses regarding required information practices, it is worthwhile to deliberate whether some principles, in addition to those that have been acknowledged by Interpretation No. 603, are vital enough to be considered as constitutional mandates. For example, I have suggested the individual participation principle to be a principle of such. As the proposed framework would not only further strengthen courts' performance on the subject, but also facilitate future intellectual efforts advancing the scheme, it is time to make a turn away from completely reliance on the reasonable expectation of privacy test.