Opinion Piece: The Legal Gap Behind the EZ WAY Controversy — Platformization of Administrative Procedures

Whenever engaging in cross-border online shopping, many people receive notifications before their goods arrive in Taiwan, requiring them to complete real-name authentication via EZ WAY. For most consumers, this is merely a necessary step before receiving their items. However, from placing an order and waiting for delivery to identity verification and customs clearance, what appears to be simple app operation actually constitutes legally binding administrative procedures.

This electronic authorization is not a commercial mechanism independently created by private enterprises, but is established under existing customs regulations. According to the "Air Express Cargo Clearance Regulations," imported express cargo may, in addition to written authorization, be electronically authorized through the Single Window for Trade, Port, and Customs or via real-name authentication platforms established by customs network operators. The same applies to maritime express cargo. Therefore, EZ WAY is not an exception outside the law, but a key implementation of the electronic customs authorization system.

As administrative procedures become increasingly digitized, digital platforms are emerging as critical interfaces between citizens and public authority. The challenges facing administrative law have expanded from mere procedural digitization to the platformization of administrative processes, including how public power operates lawfully, how procedural rights are protected, and how responsibilities are clearly delineated in public-private collaborations.

In practice, courts have begun scrutinizing legal liability under electronic authorization systems. The Taipei High Administrative Court's 113rd Year, Case No. 1405, involved a dispute over a customs broker's failure to properly execute authorization and retain relevant documents. The court reviewed whether the broker fulfilled its statutory obligations under current laws, without relaxing liability due to the digitization of procedures. This ruling confirms that digitization changes the operational mode of administrative procedures but does not alter the attribution of legal responsibility.

Returning to the recent EZ WAY data security controversy, TradeVan stated that its information systems are built and maintained in compliance with relevant regulations and undergo regular audits. Under current legal frameworks, this explanation suffices to meet regulatory requirements regarding information security, data confidentiality, and personal data protection.

However, regulatory compliance does not automatically eliminate governance concerns. When administrative procedures are largely conducted through platforms, the real governance challenges lie in whether procedural safeguards for citizens are effectively implemented, whether data processing is transparent, and how administrative agencies and platform operators share responsibility and provide effective remedies in cases of system failures or rights violations.

Personal data governance must also be understood within the context of the platformization of administrative procedures. The Personal Data Protection Act does not prohibit the collection, processing, or use of personal data when done lawfully. Its core lies in ensuring that data processing has a legal basis, serves specific purposes, and follows transparent and supervisable procedures. Thus, the legal issues surrounding EZ WAY include not only the legality of data collection, transmission, storage, and use but also the adequacy of outsourcing management, access control, information disclosure, and redress mechanisms.

From a comparative law perspective, while the EU's General Data Protection Regulation (GDPR) does not directly apply in Taiwan, its principles—legality, transparency, data minimization, and accountability—serve as important references for digital governance. What is truly being tested is not only information security measures but also whether data processing has a clear legal basis, well-defined responsibility allocation, and mechanisms that allow for external oversight.

Domestic regulatory practices also offer instructive comparisons. In 2024, the Financial Supervisory Commission penalized Sunshine Commercial Bank for deficiencies in data governance and legal compliance during its information system development. The regulatory review covered not only information security but also access control, internal controls, and overall compliance mechanisms. This shows that even private financial institutions, when handling large volumes of personal data, are required by regulators to establish comprehensive responsibility frameworks, internal controls, and continuous monitoring systems.

By this standard, EZ WAY is not merely providing a commercial service but serves as a critical interface through which citizens fulfill statutory customs procedures—implicating the exercise of public authority and administrative operations. Its governance requirements should therefore not be lower than those for financial institutions. Especially under public-private collaboration models, where administrative agencies delegate parts of procedures to private platforms, legal authorization, responsibility allocation, data usage, outsourcing management, and redress mechanisms must be clearly defined. This ensures citizens can understand how their data is processed, who is accountable, and to whom they can turn for remedies when their rights are infringed. If such strict standards apply to private banks, platforms handling administrative procedures should be held to even higher legal and supervisory standards.

The issues revealed by EZ WAY go beyond cross-border e-commerce and personal data protection, highlighting the governance challenges posed by the platformization of administrative procedures and public-private collaboration. From customs authorization and identity verification to data processing and administrative redress, these systems are interconnected. A failure in any link could undermine the realization of citizens' rights. While platforms enhance administrative efficiency, they must not compromise the principles of rule of law, procedural fairness, and rights protection.

As more administrative procedures are conducted through digital platforms, system design must go beyond convenience and efficiency. It must establish clear legal authorization, transparent data governance, well-defined responsibility allocation, and effective redress mechanisms. Platforms are merely carriers of administrative procedures; the rule of law remains the foundation of administrative operations. Only when technological advancement, administrative efficiency, and legal safeguards mutually support each other can digital governance achieve a balance between administrative effectiveness, public trust, and rights protection.

*The author is an adjunct instructor in law and information security at a higher education institution.