Updates Around the APAC Region:

Privacy Laws in Asia

The level of activity for Privacy legislation and enforcement in Asia had been very active over the past several years. The following eleven countries have implemented comprehensive privacy laws:Australia, Hong Kong, India, Japan, Macao, Malaysia, New Zealand, the Philippines, Singapore, South Korea and Taiwan.

The only country in the region that has been accepted by the European Commission as providing adequate protection is New Zealand. Conspicuously missing from the list of countries having implemented privacy legislation are China, Thailand, Vietnam and Indonesia. China is slowly moving toward a privacy regime in a piecemeal approach.

According to recent reports, Thailand may be on the verge of enacting privacy legislation and Vietnam appears to be moving slowly in that direction, while privacy legislation is unlikely in the near future in in Indonesia.

This article examines the commonalities and differences among the privacy laws in the region and discusses current trends and new developments.

Source: www.MOFO.com

Be Alert Asia – Top Tips for Employers: Cyber Risks and Fraud

Cyber risk is becoming a growing concern amongst businesses and institutions. Data breaches and hacking have been problematic among some sectors, predominantly financial services, for some time. These risks are listed as one of the top business risks in 2015. Companies in Asia are generally considered as less prepared for the increasing number of cybercrimes than counterparts in other regions like the USA.

When a security breach involves the loss or leakage of personal data, this also becomes a significant data protection and regulatory issue and can lead to fines, legal or regulatory sanction and reputational damage. This is particularly in a market environment where individuals (be they customers or employees) are becoming increasingly aware of their privacy rights and identity theft issues. With the arrival of the “Internet of Things,” the importance of data security will become even more prominent. The consequences of not protecting your business sufficiently from cybercrimes can be huge.

Despite the challenges faced by many companies, some of these risks can be identified and avoided at an early stage. Whilst most companies are aware of the firewalls and technology they need in place to protect themselves, many are unaware of other ‘soft spots’ that may also be contributing to the risks in a major way.

Source: www.dlapiper.com

The Korean Communications Commission Proposes Merging Overlapping Personal Information Protection Systems

On 15 October 2015, The Korean Communications Commission (KCC) and the Ministry of Interior (MOI) proposed merging the Personal Information Management System (PIMS) and the Personal Information Protection Level (PIPL) System into an integrated Personal Information Protection Management System Certification (‘the proposed Certification’). The proposed Certification will also amend the related auditing scheme. According to the KCC, the merge aims to alleviate the confusion and ‘bottle neck’ effect caused by current overlapping certification schemes.

So far, companies have had to choose between the two or apply for both certifications, which demand different requirements. The proposed Certification will eliminate confusion and make the application process less burdensome. At the same time, the new system lowers the level of requirements for small and medium enterprises (SMEs). This will, in turn, reduce costs and encourage applications for certification.”

Source: Dataguidance.com

Japan Plans to Amend its Law and Allow for Inspections

Japan’s Cabinet decided on 10 March to amend the 2003 Act on the Protection of Personal Information. Dr. Hiroshi Miyashita, Associate Professor, Chuo University, Tokyo, informed PL&B that both the House of Representatives and the House of Councillors of the Diet (Parliament) will examine this Bill in the coming months. The Bill seeks to establish an independent supervisory authority known as the “Personal Information Protection Commission” (Art. 59) for the entire private sector. The new Commission, consisting of the President and eight Commissioners, would have the power to conduct on-site inspections and to provide information to foreign Data Protection Authorities.

The Bill is available in Japanese at http://www.cas.go.jp/jp/houan/189.html

Source: http://www.privacylaws.com

China Mulls Privacy Protection, Further Curbs On Internet

Chinese authorities have proposed a sweeping but vaguely worded Internet security law that would strengthen protection of private information, ban hacking activities and also allow authorities to restrict Internet access to maintain public order. China’s government considers cybersecurity to be crucial to national security, and espouses the concept of Internet sovereignty, treating its portion of cyberspace as its territory. The proposed law says Internet operators must take necessary steps to close security loopholes to prevent possible cyber attacks. It also criminalizes any hacking activity. The draft says Internet operators are obligated to protect users’ personal data. It also requires that users register their real names to receive Internet service. Yet, members of the Chinese public are worried that their right to speech may be further curtailed in the name of national security.

Source: http://wtop.com

Thailand’s Education Ministry Orders Mandatory CriminalBackground Checks For Foreign Teachers

Education Ministry official announced that all School administrators have been instructed to run background checks on foreigners applying for work as teachers to weed out convicted pedophiles. Assistant Minister Thirakiat Charoensethasilp said the directive was sent to every educational institution in the country after the British embassy recently received a report that a British national with a record of child sexual abuse in the UK had applied for a job as a foreign-language teacher in Thailand. Additionally, in the case of British applicants, schools were advised to check the UK’s Association of Chief Police Officers’ (ACRO) Criminal Records Office website to determine if they have a criminal record and require they present an ACRO police certificate.

Source: www.chiangraitimes.com/

Indonesia Publishes Proposed Data Protection Rule

On July 14, 2015, pursuant to an implementation requirement of Government Regulation 82 of 2012, the Indonesian government published the Draft Regulation of the Minister of Communication and Information (RPM) of the Protection of Personal Data in Electronic Systems (Proposed Regulation). The Proposed Regulation addresses the protection of personal data collected by a variety of government agencies, enumerates the rights of those whose personal data is collected and the obligations of users of Information Communication Technology. The government provided a 10-day comment period for the proposal and issued proposed guidelines for the registration of software to be used in “public services.”

Source: www.HuttonPrivacyblog

Draft Data Security And Retention Standards Are A Potential ‘Game Changer’

The Personal Data Protection Commission (PDPC) published its ‘Public Consultation Paper No.1/2015’, which seeks feedback on three draft standards relating to data security, data retention and data integrity (the Draft Standards). The PDPC has the authority to produce standards which data users are legally obliged to comply with. However, this represents the first time the PDPC has opted to use this power. Tharishni Arumugam, Privacy Counsel at Aon Asia Pacific said, “The Draft Standards might be a game changer for compliance obligations, but not necessarily in the right direction, especially given the PDPC’s record of handling the implementation of the Personal Data Protection Act 2010 (PDPA).”

Source: www.Dataguidance.com

A Breach Will Cost An Australian Business $2.5m

Organised crime gangs are the biggest perpetrators of security breaches in Australia, while hacktivists and disgruntled employees factor in only a tiny fraction of crimes.Ninety-two percent of breaches are perpetrated by outsiders, of which 55% come from organised crime, followed by 21% by state-affiliated hackers and just 2% by activists and 1% by former employees. Some 14% of breaches are perpetrated by insiders, although this is rising. There’s an overlap between external and outside perpetrators, who sometimes collude. In addition, weak or stolen credentials are the No.1 cause of breaches, responsible for more than three quarters of incidents.The average cost of a data breach to an Australian business is more than $2.5 million per year, and over the five years to 2014, the average breach involved more than 20,000 records.

Source: http://www.crn.com.au