知識分享
Insights
E-Commerce
A Discussion on Corporate Data Governance Prompted by iRent’s Excessive Personal Data Collection and Usage Incident
On January 7, 2025, the Consumers' Foundation held a press conference pointing out that iRent (Hotai Motor Co., Ltd.'s car rental division) collected excessive personal data in its rental terms and required consumers to agree to share personal data with affiliated companies, potentially violating the Personal Data Protection Act. The competent authority for car rental services, the Directorate General of Highways, dispatched personnel from the Taipei City Motor Vehicles Office to conduct an administrative inspection. They determined that the reasonableness and necessity of these terms were not clear and required iRent to improve. Hotai Motor Company also shut down the joint marketing data system function within the group. This is actually an unreasonable expectation that many large enterprises in the past have had—hoping to collect data once and apply it to all "affiliated companies." Without an appropriate corporate data governance framework, common situations violating the Personal Data Protection Act emerge from service planning to data management architecture. Let's first look⋯