How General Counsel Can Help Prepare for Cyberattacks

November 10, 2021
In-house lawyers can be the fence at the top of the cyber cliff, creating procedures to prevent the worst effects of a cyberattack and responding quickly and effectively when (not if) a cyberattack occurs. Given how quickly cybersecurity has risen from being a line-item on the IT department’s annual budget to top of the list for most companies, in-house lawyers are now a critical gear in the machinery protecting a firm’s digital assets, client data and balance sheet. General counsel must lead the charge in encouraging the C-suite to create, implement and test a robust cybersecurity incident response (IR) plan. The future success of their company could depend on it. Just how much of a problem are cyberattacks and breaches in 2021? US-based cybersecurity provider FireEye said in its M-Trends 2021 report that the Asia Pacific (APAC) region is the “most-targeted” region in the world for ransomware. Ransomware is a form of malware that encrypts a victim’s computer files. The attacker then demands a ransom to restore access to the data. Users are shown instructions for how to pay a fee to get the decryption key. FireEye’s report said on average, APAC organizations are attacked by ransomware roughly 51 times per week in 2021. But it’s not just ransomware that is rising. Between May 2020 and May 2021, recorded instances of all types of cyberattacks on APAC-based companies rose 168%. And in just one month – April-May of this year – the entire region saw a whopping 58% increase in cyberattacks, year-on-year. Image: Ransomware on the rise. ‘Dwell time’ indicates the time an attacker or malware variant sits on...

China’s new personal information privacy law is not simply a repeat of the GDPR: some important nuances for business in China

November 3, 2021
China’s new personal information privacy law (PIPL) becomes effective today, 1 November 2021. It significantly alters the regional and global privacy landscape, and its significance will likely be more apparent after having read this article. The readiness anxiety generated by the impending effectiveness of the GDPR in May 2018 seems fairly recent. The GDPR caused a flurry of activity to ensure compliance with this European regulation, with extraterritorial effect and an unpredictable global impact. Like the GDPR, the PIPL is also extraterritorial and there is likely a significant amount of PIPL-covered personal information throughout Asia, not to mention everywhere else. Since becoming effective, we have witnessed some enormous GDPR fines levied against transgressors. In July 2021, Luxembourg fined Amazon €746 million in relation to cookie consent issues and in 2020 France also fined Amazon €35 million in relation to cookie consents. Cookies relate to how Amazon collects and shares personal information. Consent must be freely given. Ireland fined WhatsApp €225 million in relation to issues related to allegedly forced consents and sharing personal data with third parties. For those organizations in Asia and elsewhere that have had limited exposure to the GDPR, there will be a steep learning curve with respect to the PIPL. It is extraterritorial and appears to be almost as expansive as the GDPR. If you do business in China, then you are likely subject to the PIPL. Organizations that provide products and services or separately monitor the behavior of people in China, regardless of whether they are in the PRC, are subject to the PIPL. The PIPL’s fines and penalties regime of up to 5%...

Catch them if you can: Post-judgment recognition and enforcement across jurisdictions

September 30, 2021
Litigating to recover money is a long and burdensome process, and it gets worse if a win in court does not translate to getting your money back. A good litigation strategy plans backwards from an ideal end game. In this article, we explore how judgments, arbitral awards and liquidation processes can be recognized and enforced against counterparties, particularly those with assets across jurisdictions. Recognition of foreign judgments and awards Foreign judgments and arbitral awards have no direct force in Hong Kong unless they are formally recognized as a local judgment. Court Judgments Hong Kong recognizes final money judgments from the superior courts of Australia, Austria, Belgium, Bermuda, Brunei, France, Germany, India, Israel, Italy, Malaysia, Netherlands, New Zealand, Singapore and Sri Lanka by way of registration under the Foreign Judgments (Reciprocal Enforcement) Ordinance (Cap.319), or FJREO. A similar registration mechanism also exists between Hong Kong and Mainland China under the Mainland Judgments (Reciprocal Enforcement) Ordinance (Cap. 597), or MJREO. Judgments outside the scope of the FJREO and the MJREO (e.g. Japan, UK, US) may be recognized in Hong Kong at common law by bringing a fresh action based upon the foreign judgment, in which case, the judgment debt awarded by the foreign court will form the cause of action of the Hong Kong action. The plaintiff (the judgment creditor of the foreign judgment) may then proceed to apply for a default judgment if the defendant/judgment debtor does not defend, or a summary judgment if the defendant/judgment debtor does not have an arguable defense based on the limited defenses available to such an enforcement action. Arbitral awards Hong Kong is one...

Offshore E-Service Providers Now Required to Register as VAT Registrants in Thailand

September 30, 2021
From 1 September 2021, offshore e-service providers are officially subject to VAT in Thailand. The online registration system has been open since 16 August 2021 but the Ministerial Regulation No. 377 (B.E. 2564 (2021)) issued under the Revenue Code re: the Procedure Concerning Evidencing and Registering for Value Added Tax via Electronic Means for Offshore Electronic Service Providers (the “MR No. 377”), which sets out the details of VAT registration, was announced in the government gazette on 27 August 2021. The first tax filing and payment due date are set at 25 October 2021. The MR No. 377 requires offshore e-service providers to register as VAT registrants via the online system of the Revenue Department (“RD”) (“SVE system”) within 30 days from the date when income from such e-service exceeds THB 1.8 million (approximately USD 55,520) per year. E-service providers can voluntarily register for VAT even if income from their services do not exceed THB 1.8 million. The RD manual requires e-service providers who have income exceeding THB 1.8 million before or on 3 August 2021 to register for VAT by 1 September 2021, and it is recommended that providers register for VAT as soon as possible. Besides registering as VAT registrants, the MR No. 377 also provides that a VAT registrant must notify the RD of following changes within 15 days from the date of the changes via SVE system: change to the essential particulars in the VAT registration, including name, business email address and business website temporary business cessation for a continuous period of more than 30 days relocation of a business business cessation, including business cessation...

Thailand: A regulatory overview of the production, import and sale of herbal medicine during the COVID-19 pandemic

September 15, 2021
Studies conducted in Thailand have revealed that Thai herbs, e.g., Andrographis Paniculata (Burm.f.) and fingerroot (Kaempfer or Boesenbergia rotunda) can treat COVID-19 symptoms, and there have been some indications that these herbs may be able to suppress SARS-CoV-2 and stop the virus from replicating. The COVID-19 pandemic in Thailand, along with results from research into Thai herbal remedies has led to the increase in the sale of Thai herbs. As such, many players in this area should be aware of the regulatory framework for the production and sale of such products in Thailand. Introduction In 2019 the Herbal Product Act B.E. 2562 (2019) (“HPA”) was issued to centralize the regulations governing herbal medicines, with the Food and Drugs Administration (“FDA”) being the competent authority under the HPA. Under the HPA, “Herbal Product” is defined as follows: Medicine from herbs, including Thai traditional medicine, medicine developed from herbs, traditional medicine for human usage under the medicine laws, or medicines that are derived from the knowledge of alternative medicine as prescribed and notified by the Minter of Public Health upon the recommendation of the Herbal Product Committee, for the treatment, cure and relief of human illnesses or the prevention of diseases Products from herbs, or products which contain active ingredients composed of or processed from herbs, which are ready for human use to improve health or bodily functions, reinforce bodily structure or functions of humans, or lessen the risk factors for illness Objects which are intended to be used as ingredients in the production of herbal products Other objects prescribed and notified by the Minister of Public Health upon the recommendation...

A Guide to US Regulations for Non-US Companies Seeking to Navigate the US Digital Health Market. Part IV: Other Potential Applicable Laws

September 2, 2021
U.S. Regulatory Considerations Applicable to Digital Health Providers and Suppliers: Primary Regulatory Regimes Relevant to mHealth – Part IV: Other Potential Applicable Laws We conclude our series by examining other relevant laws digital health providers and suppliers should know. If you missed our earlier articles, you can read about HIPAA in Part I and II, and the FDCA and other privacy considerations in Part III. Federal Trade Commission Act (FTCA) When companies tell consumers they will safeguard their personal information, the Federal Trade Commission (FTC) can and does act to ensure companies live up to their promises. The FTC has brought legal actions against organizations that have violated consumers’ privacy rights, misled them by failing to maintain security of sensitive consumer information or caused substantial consumer injury. In many cases, the FTC has charged the defendants with violating laws related to unfair and deceptive trade practices. As a recent example, a developer of a popular women’s fertility-tracking app settled FTC allegations that it misled consumers about the disclosure of consumers’ health data. As part of the proposed settlement, the developer is prohibited from misrepresenting: 1) the purposes for which it or entities to whom it discloses data collect, maintain, use or disclose the data; 2) how much consumers can control these data uses; 3) its compliance with any privacy, security or compliance program; and 4) how it collects, maintains, uses, discloses, deletes or protects users’ personal information. Additionally, the developer must notify affected users about the disclosure of their personal information and instruct any third-party that received users’ health information to destroy that data. [1] In addition, FTC also...