The Intellectual Property Office of the Ministry of Economic Affairs (hereinafter the “IPO”) has recently clarified that whether the use of personal data recorded in the trademark register constitutes use of “lawfully made public personal data” within the meaning of the Personal Data Protection Act remains subject to case-by-case determination.
Under the Trademark Act, the competent trademark authority is required to make the trademark register publicly available. However, personal data such as the registrant’s name and address recorded in the register are entered pursuant to the Enforcement Rules, which were promulgated under a blanket authorization provided by the Trademark Act. On this basis, the mere collection of such data by a trademark agent cannot readily be regarded as falling within the lawful collection ground of “lawfully made public” personal data under Article 19, Paragraph 1, Subparagraph 3 of the Personal Data Protection Act (in accordance with the purport of Letter No. 1150000700 dated April 20, 2026, issued by the Preparatory Office of the Personal Data Protection Commission).
The IPO further noted that where a trademark agent obtains the name and address of an applicant or trademark owner from the Trademark Gazette or other similar sources and then proceeds to use that information for commercial marketing purposes, the agent must examine whether such use exceeds the specific purpose for which the data was originally collected, and must verify whether the requirements for the use of personal data under Article 20 of the Personal Data Protection Act are satisfied. The assessment in this regard must be made based on the specific facts of each case.
In addition, regardless of the intended purpose, any conduct involving marketing activities must respect the data subject’s right to opt out of marketing. Once a data subject expresses an objection to receiving marketing communications, the business operator must immediately cease any further use of that individual’s personal data for such purposes. Furthermore, when conducting marketing for the first time, the operator is required to provide the data subject with a means of opting out and must bear any costs associated with exercising that right.
