Special features

Explore this edition's guest and international features, and get to know one of our Partners in “Coffee with...”

Special features

Cyber attacks: the increasingly complex landscape of regulatory reporting expectations in Asia

Personal data protection legislation is evolving globally, and no more rapidly than across Asia. The landscape of data breaches and other regulatory reporting obligations is becoming increasingly varied, with potential traps for those who are not following the latest developments.

Some of these apply extraterritorially to data users doing business in Asia even if they are incorporated elsewhere.

In Hong Kong, the law remains territorial, but it is becoming clear that the Privacy Commissioner for Personal Data (PCPD), expects companies that suffer data breaches to notify both the PCPD and affected data subjects in Hong Kong, even though there is currently no mandatory data breach reporting obligation under Hong Kong law.

C-suite concerns and
high-profile enforcement action
By late 2022, US corporate executives had already identified cyber attacks as the primary business risk, and revising and enhancing companies’ cyber risk management as their second most important focus, according to PwC’s Pulse Survey. Last year, “more frequent and/or broader cyber attacks” remained the primary risk identified by US corporate executives in the same survey.

The profile and public awareness of ransomware has also been raised by high-profile actions by law enforcement, among them the recent actions taken against the LockBit ransomware group. These culminated on 7 May 2024 in a global law enforcement coalition including the UK National Crime Agency, the US Department of Justice and the US Treasury Department (among others) naming and sanctioning a co-founder of the LockBit group.

As well as raising awareness of how LockBit operated, this action will make it harder for LockBit to operate through its network of affiliates. For victims, though, it will make it more difficult to pay a LockBit ransom and as a result it led to an immediate surge in claimed LockBit attacks being announced on the dark web.

“Personal data protection legislation is evolving globally, and no more rapidly than across Asia.”

The evolving Asian data privacy landscape
Making the landscape more complex, data privacy laws are also changing. In addition to the much-discussed Personal Information Protection Law of the People's Republic of China (passed in August 2021), some implementing regulations for which are still being issued, in June 2022 the Thai Personal Data Protection Act came into force. Both the PRC and Thai laws have extraterritorial application. Also, in October 2022, Indonesia passed its Personal Data Protection Act and Singapore amended its Personal Data Protection Act (increasing the range of financial penalties available to the Singapore Personal Data Protection Commission). In August 2023, India passed its long-awaited Digital Personal Data Protection Act.

In Hong Kong, the PCPD has been working for several years with the government of the Hong Kong Special Administrative Region (HKSAR) on proposed changes to the Personal Data (Privacy) Ordinance (PDPO). Some of the main changes expected were postponed while the HKSAR government and the PCPD focused on introducing and implementing new laws combatting doxxing (the intentional publication of personal data intended to harm the data subject), which came into effect in October 2021.

In February 2024, the PCPD reiterated that she continues to work with the HKSAR government on “practicable legislative amendment proposals to align with international developments in privacy protection, strengthen the protection of personal data privacy and address the challenges posed by cyber technologies”. The proposed further amendments include mandatory data breach notifications and granting the PCPD direct administrative fining powers, neither of which exist under the current legislation.

However, as yet, there is still no clear timeline for the draft legislative proposals. When asked, the PCPD did not commit to the amendments being made in 2024.

Challenges to legal privilege
Among all this noise about changing personal data privacy laws, the actual expectations of regulators and law enforcement may be missed. However, these are becoming evident to lawyers and data privacy practitioners who are helping victims respond to cyber attacks.

Some law enforcement agencies in Asia are becoming increasingly insistent that they be provided with the full details of a cyber attack, including a forensic investigation report.

This includes where the victim asserts legal privilege over the investigation report, and increasingly those law enforcement bodies are more willing to push back on claims of legal privilege over the full details in the report.

In November 2023, the Australian Federal Court in Robertson v Singtel Optus Pty Ltd (2023) rejected a claim for legal privilege over a forensic investigation report into a cyber attack, citing various aspects of the way in which the forensic investigators were engaged, and public statements by the victim company about the purpose of the investigation.

With some law enforcement agencies pushing back on claims for legal privilege, the rationale of the decision is increasingly important. Businesses operating in common law jurisdictions should take note of the reasoning and learn its lessons about how to reinforce a claim for legal privilege in the work and communications of forensic investigators.

Expectations to report in the absence of reporting obligations
The PCPD in Hong Kong, still without the tools of mandatory data breach reporting and direct fining powers, has also made clear her expectations that businesses make data breach notifications, even though there is no statutory data breach reporting obligation.

Recently, several HKSAR government departments and quasi-governmental organisations have reported data breaches caused by cyber attacks. Two of those have led to investigations by the PCPD, culminating in investigation reports in April and May 2024. These are two of the eight enforcement reports issued by the PCPD from the start of 2023 to mid-May 2024. Seven of those enforcement reports related to data breaches (the other involving written and on-site inspections of a virtual bank), and three of the seven involved ransomware attacks specifically.

“Recently, several HKSAR government departments and quasi-governmental organisations have reported data breaches caused by cyber attacks.”

Taking just one of those enforcement reports, the PCPD is abundantly clear in her criticism of the victim company’s lack of sufficient cyber attack prevention and detection measures. The PCPD also expressly praises the victim company for promptly reporting the data breach and cooperating with the PCPD, even though the PDPO provides no mandatory data breach reporting obligation.

Updated Hong Kong data breach guidance
The PCPD’s expectations of timely, and technically voluntary, data breach notification to the PCPD and affected data subjects, are also set out in the PCPD’s updated data breach guidance issued in June 2023: ‘Guidance on Data Breach Handling and Data Breach Notifications’ (Updated Guidance).

The Updated Guidance is intended to provide data users with guidance on how to handle a data breach. This includes pointers about implementing a data breach response plan, steps to handle data breaches and making data breach notifications.

The PCPD’s previous data breach guidance, issued in 2015, indicated that in the event of a data breach, data users should consider “notifying the affected data subjects and the relevant parties”, and in doing so should consider “the consequences for failing to give notification”. The 2015 guidance indicated that “while it is not a statutory requirement” data users were advised to give breach notifications “as a recommended practice for proper handling” of data breaches.

The Updated Guidance focuses on implementing a data breach handling policy, which the PCPD has recommended in several of her recent enforcement reports, and gives guidance on what the PCPD would expect to see in a data breach response plan, including a “risk assessment workflow to assess the impacts of the breach on data subjects” and a “communication plan for determining which parties to notify and how to notify”.

The Updated Guidance also recommends five steps when handling a data breach, including:

immediate gathering of essential information about the incident
containing the data breach
assessing the risk of harm to affected individuals from the data breach
considering giving data breach notifications to data subjects, the PCPD and other law enforcement agencies (who had been included in the previous data breach guidance only as an “interested party” the data user should consider contacting)
documenting the breach.

In step four (considering giving data breach notifications), the Updated Guidance adds to the factors the data user should take into account. These now include “the potential consequences of a [data] breach for the affected individuals”, “how serious or substantial these are, and how likely they are to happen”, and the prior factor of “the consequences of failing to give notification”.

The Updated Guidance goes on to make clear the PCPD’s expectation that:

“In general, the data user should notify the PCPD and the affected data subjects as soon as practicable after becoming aware of the data breach, particularly if the data breach is likely to result in a real risk of harm to those affected data subjects.”

While the shift in the PCPD’s expectations is therefore not yet mandatory and may appear subtle, it is clear from the Updated Guidance and the PCPD’s recent enforcement reports. The PCPD now expects data breach notifications to be made to the PCPD and affected data subjects in most cases, even before amendments to the PDPO are implemented.

The PCPD is likely to take into account whether and when data breach notifications were made in assessing a data user’s compliance with data protection principle 4 (security of personal data) and the data user’s response to a data breach. These may then form part of the PCPD’s assessment of any additional measures she requires the data user to implement in any enforcement notice.

Victims of cyber attacks will therefore need to weigh this updated expectation of the PCPD as part of the delicate balance of which regulators to notify about an attack and when.

Navigating the landscape

Seasoned incident response managers can help provide a calm head and the benefit of their experience and, when they are lawyers, can help victim companies maximise the chances of attracting legal privilege to the extent it is available.

Ultimately, responding to a cyber attack is easier on a practical level when using a considered and rehearsed breach response plan. The PCPD now expects data users to have such a plan.

A breach response plan can also make clear which regulators and data subjects should be notified and when, taking into account both statutory and regulatory reporting obligations, the non-legal expectations of regulators and the company’s ethos and commercial considerations.

Preparation is key and may also result in more lenient treatment from regulators.

This article was first published in the July-September 2024 issue of the Corporate Disputes Magazine.

Jonathan Crompton
Partner
+852 6822 5016
jonathan.crompton@rpc.com.hk

Flora Leung
Associate
+852 6392 2835
flora.leung@rpc.com.hk

Armani Cheng
Associate
+852 6392 7190
armani.cheng@rpc.com.hk

Special features

Dealing with loneliness as an in-house lawyer

The Centre for Legal Leadership

There is much focus on work life balance and wellness, and rightly so. But one area that is often overlooked is loneliness and in turn the part it plays in our overall health and conduct.

The loneliness of working within in-house legal is something regularly raised in conversations, events, and the training that the Centre for Legal Leadership (CLL) holds.

How often have you worked on a project, even those within a large team, and not been able to discuss it with your fellow in-house team members, let alone other colleagues within the company?

Many lawyers move in-house to get closer to the action; to see the company's strategy come to life as it progresses through its many stages and assist with the "behind the scenes" work of the business as usual in keeping the company positively ticking. It's a privilege to play such an integral part, but this has a flip side. It's confidential and can't be discussed.

The dreaded "crisis” has not been mentioned here, which could and does of course crop up, and fully involves in-house legal teams, but oddly this can bring the team and key stakeholders together as it usually needs “all hands on deck” with collaboration being essential.

Loneliness can also increase the further up the pyramid you climb, with less peers around you to provide support.

But an in-house team is an unusual place where seniority is often hard to define, for example one can be new to working in-house but be ex-private practice with extensive PQE however is not a generalist, or alternatively may have been working in-house for a few years within a small team and therefore have a lot of condensed but valuable experience.

What can be done?
Awareness, as with everything, is vital. Ask yourself about your own wellness, do you have a trusted individual or network around you where you can voice worries or just share/vent in a safe environment? Those in more senior roles may find it best to reach out to coaches and mentors.

Consider what networks you have access to, and also what resources your company provides; many provide a wide range of support often run by external providers giving the comfort of remaining separate from your employer.

“It may all seem
overwhelming initially,
but by taking small steps,
with the support of others,
each challenge becomes easier
and bigger steps can be taken
driving you forward.”

Supporting your team
Do you have line manager responsibilities? Leading a team at any level can be a tough gig with tone within the team being set by you. Think about how you can support those in your team, perhaps having a "coffee and how are you chat" can become a regular opener before WIP conversation starts. Just being visible can have a huge impact. Look out for networks you can recommend to your team (CLL has a great junior and mid-level lawyer network). You probably can't share the in-and-outs of what you do, but other in-housers are definitely in the same boat and will offer a life-ring to stop that sinking feeling.

No matter your level, it's never too late to start reaching out and building connections, there is much media buzz around networking, bringing to mind huge rooms filled with awkward individuals sharing business cards or the QR code. But this certainly needn't be the reality, joining smaller interest groups can be equally, if not more, inviting or perhaps reach out to the host and ask for a few introductions. You have not missed the boat!

About CLL

The Centre for Legal Leadership (CLL) is a resource for in-house lawyers on everything other than law. CLL provides advice, insights and support to help you find your feet and build your career as an in-house lawyer.

They also run regular events for GCs, including the quarterly Regulation Forums for senior leaders in major regulators and in the organisations that they regulate. These roundtables are held under Chatham House rule. Attendance is by invitation and the sessions are chaired and moderated by CLL. Find out more

Resources

The Centre for Legal Leadership
A community and knowledge hub for those in-house by in-house, providing free training, networking, events, mentoring and a wealth of in-house information, including Loneliness at the top and Resilience and recovering from setbacks.

LawCare
A mental health charity for the legal sector, providing support and advice. With a free and confidential helpline, open 9am to 5pm every weekday (except bank holidays). Tel. 0800 279 6888.

Special features

Spotlight on
compliance in the Middle East:
expert insights on the latest trends
and developments

In February 2024, RPC hosted a roundtable discussion exploring corporate compliance trends in the Middle East with contributions from a panel of prominent industry leaders based in the region.

The event was chaired by Sam Tate, RPC's Head of White Collar Crime and Compliance. The panel featured James Walker, Director of Ethics and Compliance at NEOM, Randa al Momani, Senior Officer in Ethics and Compliance at SAP, Ricardo Weffer, Head of Ethics and Compliance at Al Dahra and Osama Al Jayousi, Expert Consultant at RPC.

The discussion covered many interesting areas relating to compliance in the Middle East, including risks associated with the use of third parties, how companies are using technology

and AI, the increased focus on ESG issues and some of the key issues relating to the culture of the Middle East and the impact of those on compliance teams in the region. In this article, we have set out an overview of some of the key trends and developments the expert panel discussed.

Middle East compliance culture
Compliance teams operating in the Middle East face challenges balancing cultural aspects of the region with the approach often taken to compliance by international corporates. This can include balancing the role of personal relationships between employees of the company and third parties, such as members of the supply chain or customers, with the corporate requirements for due diligence on those third parties and formalities around proof of ownership of companies.

Osama Al Jayousi, Expert Consultant at RPC, who spent over 15 years working in the Middle East as both an auditor and head of compliance at a multi-national company, summarised this balancing of cultures:

“I think the way we are brought up in the Middle East places a large focus on personal relationships and connections. That doesn’t mean we accept people working in a business becoming involved in fraud and conflicts of interest. This can create an issue and multinationals need to develop a deeper understanding of that culture.”

A further issue can relate to the role played by public officials within private companies. The panel observed that,

“the nature of private-public sector partnerships in the Middle East and local laws allowing government officials to have roles in companies can create many conflict of interest scenarios that companies need to be aware of.”

For Ricardo Weffer, Head of Ethics and Compliance at Abu Dhabi headquartered Al Dahra, to be able to manage these challenges, it is important to demonstrate to the local business the benefits of implementing a strong compliance framework. As he said,

“the key to a successful compliance programme in the Middle East is to roll up your sleeves, work with the business, and let them know and understand the benefits of having a compliance programme. I have found that our business appreciates that a robust programme allows them to attract more ambitious clients and to work with multinationals, and that has been an effective way of getting buy-in to the implementation of the programme.”

A significant recent trend in the Middle East has seen the increasing professionalisation of compliance. This has seen careers in ethics and compliance roles becoming a real option in the region, and larger numbers of Middle Eastern compliance professionals entering roles in both local and international companies. This is a further indication that good governance is a subject that has been strongly adopted in the region.

Third party risk
Use of third parties and designing compliance controls to manage the financial crime risks they present remains a significant issue around the world, but particularly so in the Middle East. Several panellists noted that

“third party risk remains the major area of focus in their compliance programs and that tailoring those programs to that risk to work for the business is key. That involves designing programs that fit the organisation depending on the organisation's size, the quantity of third parties and ensuring the right amount of due diligence can be carried out at the right time.”

Companies in the Middle East are taking steps to build and enhance their compliance programmes, including around due diligence and risk analysis of suppliers, service providers and subcontractors. A particular area of focus for many companies operating in the Middle East relates to supply chain risk, where the range of counterparties can extend from international household names to small local companies with limited public profiles.

From a practical perspective, companies are analysing the services a third party is actually performing when balancing the risk assessment against the level of due diligence to be performed on it. Where the third party is performing multiple services, companies are tailoring the due diligence down to an individual engagement level.

The panellists also identified taking steps such as conducting supplier audits and carefully looking at the proof of service from sub-contractors as helpful from a practical perspective when managing third party risk.

The contributions of the panellists highlighted the wide range of practical steps to manage third party risk that companies across the region are taking. These steps start with appropriate levels of due diligence, factoring in risk and the nature of the services being performed and continue through the life cycle of the relationship.

Increasing responsibility for ESG
Inward investment into the Middle East has increased the focus on ESG factors in the region. Compliance teams in the Middle East are seeing this area fall increasingly within their remit and are leading their companies' development of ESG risk assessments and controls.

As Osama Al Jayousi stated,

"ESG is very topical in the Middle East at the moment. There is a lot of public attention on ESG issues, both within the Middle East and on the region from the outside. This has especially been the case since the UAE Expo and Qatar World Cup in 2022. Both these events attracted considerable negative media from an ESG perspective. After that, companies in the region are paying a lot more attention to the subject."

Compliance teams in the region are now working more closely with sustainability teams at their companies and are often responsible for major areas of work including around modern slavery and human rights issues as these subjects are brought within the broader governance compliance programme.

In many cases, the due diligence and screening tools being used to identify and manage financial crime risk are being extended in scope to factor in these wider social and governance issues.

Use of technology and AI
The Middle East is taking a leading role in the uptake of technological solutions in compliance. Companies are both purchasing off-the-shelf solutions but are also designing and building bespoke tools to fit the specific needs of the business and the compliance function. These tools are being used widely across companies' compliance functions including in managing third party and supply chain risk, for instance by using large language model AI tools to review third party documents and proposals. AI tools are also becoming increasingly widely used in internal investigations.

One particular area where AI tools are proving effective is in relation to designing and providing compliance training for employees. This includes using AI tools to support more traditional training tools by developing analytics relating to responses to questions in employee training modules to better identify the training needs of groups of employees.

Ricardo Weffer stated that Al Dahra has also used AI to refine training programmes.

“We are using AI tools in many areas, including to assist employees to seek guidance on our policies. We are starting to use AI tools to review those requests and to tailor compliance training so that our online and face to face training sessions cover the issues that arise in reality for our employees.”

Technology and AI is an area into which Middle East-based compliance teams are particularly investing and developing, and it is an area likely to continue to grow in importance in the coming years.

If you would be interested in attending our next Middle East compliance roundtable, in the first quarter of 2025, you can register you interest here.

Sam Tate
Partner
+44 7375 489750
sam.tate@rpc.co.uk

Thomas Jenkins
Senior Associate
+44 7856 279455
thomas.jenkins@rpc.co.uk

Special features

Coffee with… Jon Bartley

We speak to Jon Bartley, Head of our Data Advisory team, and find out more about his career and his specialism in data protection and privacy law advice.

Tell us about yourself

I lead the Data Advisory team, part of our wider Data Protection, Privacy & Cyber group (the other sub-groups being Data Disputes and Data Breach). I qualified in 1997, just as businesses were gearing up for the Data Protection Act 1998, so I got into data and privacy then, and have always specialised in the area. For many years I advised on data protection alongside my commercial and technology contracts practice, but the proportion of data protection work steadily increased, particularly in the last 15 years. When I joined RPC in 2017 there was a huge focus on helping our clients prepare for the advent of GDPR, and since then my work has focussed almost exclusively on data protection advice. I still get to work on some contracts to keep my hand in!

How have you seen the
regulatory landscape change during your career?

In the late nineties data protection and cybersecurity wasn't such a priority for most companies. We hadn't yet seen the explosion of data generation and collection and the global data flows that arose from technologies such as Web 2.0, smartphones, cloud computing and AI. Prior to 2010, the ICO didn't even have the power to issue monetary penalties, so it's not surprising that it was lower on board's agendas; now it's right up there as a key concern. As data has become fundamental to the global economy, data privacy has been transformed from a nerdy backwater to (dare I say it) a hot area that lots of young lawyers and compliance professionals want to specialise in.

What types of regulatory advice do you offer to clients?

Within the Data Advisory team, we provide everything from ad hoc support on discrete queries through to large project work, such as multi-jurisdictional audits. One minute we'll be working on a project to maximise direct marketing reach across multiple retail brands, the next we'll be negotiating a data sharing agreement, advising on global intra-group data flows or on compliance around the use of AI or AdTech. We also provide a fully outsourced service responding to data subject access requests (DSARs) which can involve such large datasets that they require specialist advice and technology to handle effectively. In the wider group, our Data Breach team is one of the most experienced in the city in assisting clients with personal data breaches and our Data Disputes team are involved in many of the most ground-breaking and high-profile privacy cases.

What are the biggest regulatory challenges you’re seeing organisations face?

One of the main challenges for our clients in recent years has been the volume, complexity and overlapping nature of data and digital regulation. Multinational organisations have to keep up with a rapidly expanding global portfolio of comprehensive and issue-specific data laws. Even leaving aside other jurisdictions, organisations have had to find resources to keep up with changes in domestic laws, such as updates to data transfer mechanisms in light of GDPR, the Schrems II case, and Brexit. The rise of regulation to govern new technologies such as AI is generating further complexity and certain sectors have also had to grapple with multiple waves of regulation on the same or related topics, such as GDPR, NIS2 and DORA (Digital Operational Resilience Act).

Looking ahead how do you see the regulatory landscape evolving?

As data and digital regulation expands, we increasingly see the same regulations falling within the remit of multiple regulators. Absent coordination between the regulators, this can lead to confusion and conflicting guidance. It's been pleasing to see initiatives like the Digital Regulation Cooperation Forum attempt to address this issue (eg the ICO and CMA's joint position paper on online choice architecture). I hope this collaborative model continues and is replicated elsewhere, as it can add clarity and provide a more coherent regulatory landscape.

I also expect to see greater international harmonisation of standards, or at least more mutual recognition or interoperability between data protection regimes, to reduce the burden for businesses operating across national boundaries. Examples include the Global Cross-Border Privacy Rules Forum and the OECD Declaration on Government Access to Personal Data. Initiatives like this should help ensure a balance between economic growth and respect for fundamental privacy rights.

Jon Bartley
Partner
+44 7912 242142
jon.bartley@rpc.co.uk