regulation of cross-border transfers of personal data in asia regulation of cross-border transfers of

426 Pages·2017·3.2 MB·English

ABLI L eg al C onvergen ce S er ies
REGULATION OF
CROSS-BORDER
TRANSFERS OF
PERSONAL DATA
IN ASIA
SAL-ABLI Legal Convergence Series.indd 1 5/10/2018 3:12:11 PM
REGULATION OF CROSS-BORDER TRANSFERS OF PERSONAL DATA IN ASIA
ABLI Legal Convergence Series
REGULATION
OF
CROSS-BORDER TRANSFERS
OF
PERSONAL DATA IN ASIA
Project Lead and Editor
Dr Clarisse Girot

2018
About the Asian Business Law Institute
The Asian Business Law Institute (“ABLI”) is an Institute based in Singapore that
initiates, conducts and facilitates research and produces authoritative texts with a
view to providing practical guidance in the field of Asian legal development and
promoting the convergence of Asian business laws.

DISCLAIMER
Views expressed by the reporters are not necessarily those of the Editor, the Asian
Business Law Institute (“ABLI”), Academy Publishing nor the Singapore
Academy of Law (“SAL”). Whilst every effort has been made to ensure that the
information contained in this work is correct, the reporters, Editor, ABLI,
Academy Publishing and SAL disclaim all liability and responsibility for any error
or omission in this publication, and in respect of anything, or the consequences of
anything, done or omitted to be done by any person in reliance, whether wholly or
partially, upon the whole or any part of the contents of this publication.

COPYRIGHT
© 2018 Reporters.

Published by the Asian Business Law Institute under exclusive licence.

All rights reserved. No part of this publication may be reproduced, stored in any
retrieval system, or transmitted, in any form or by any means, whether electronic
or mechanical, including photocopying and recording, without the permission of
the copyright holder.

All enquiries seeking such permission should be addressed to:

The Secretariat
Asian Business Law Institute
1 Supreme Court Lane
Level 6
Singapore 178879
Tel No: ([phone]
E-mail:
FOREWORD
When I spoke at the launch of the Asian Business Law Institute some
two years ago, I said that differences in the legal regimes of the countries
in the region posed an impediment to the growth of business. This can
clearly be seen in the area of data protection and privacy. Even a cursory
glance at the reports in this compendium will reveal that the legal
landscape is a patchwork of variegated – and at times conflicting –
regulations and stipulations. The challenges that this poses have proven
to be a significant hindrance to the development of digital trade and
cross-border business operations in Asia.
It is for this reason that the subject of data privacy has been on the
agenda of the Institute since its inception. When the Board of Governors
of the Institute discussed the project in July 2017, it was decided that the
Institute would focus on the regulation of international data transfers, as
this has a direct and immediate impact on cross-border business in all of
the Asian jurisdictions represented on the Board of the Institute, and in
Asia more generally.
Over the past years, the Organisation for Economic Co-operation and
Development, the Asia-Pacific Economic Cooperation nations, and the
Association of Southeast Asian Nations, among others, have all adopted
statements of principle, frameworks or systems recalling the importance
of cross-border flows, data protection and privacy. While such supra-
national initiatives are useful for the purpose of convergence, they need
to be complemented by the hard and prosaic work of sifting through the
thicket of national laws and regulations to identify points of commonality
and areas where reform is required. From the outset, therefore, the
Institute conceived of its Data Privacy Project as proceeding in two
stages: first, it would research and study the state of the existing law;
second, it would set out to make recommendations to promote greater
convergence of national laws and regulations, with the twin goals of
upholding privacy and data protection rights and facilitating cross-border
trade in the region.
iii
Foreword
The publication of this compendium of jurisdictional reports – the
second in the ABLI Legal Convergence Series – marks the conclusion of
the first, descriptive, phase of the project. The reports in this volume
have been written by some of the foremost experts on the subject of data
privacy in their respective jurisdictions, and they are a truly impressive
and unique piece of legal scholarship. Taken together, they offer a
comprehensive survey of the regulatory landscape as it relates to cross-
border data flows and data localisation obligations in 14 Asian
jurisdictions and I have no doubt that they will prove to be valuable
resource, not only to practitioners but also to regulators and policymakers
both in Asia and beyond, many of whom, I am given to understand, have
already expressed an intention to make use of the compendium.
I commend this work to anyone with an interest in legal convergence in
this area of the law, including governments which are working on
drafting or reviewing their own data privacy legislations.
This publication of this compendium also raises the curtain on the
second, prescriptive, phase of the project where the Institute will work
towards the development of concrete proposals for the introduction of
common rules and standards on cross-border data transfers. In this
context, it is interesting to note that the reports reveal not only gaps, but
also considerable similarities in the legal systems. This is encouraging, for
it suggests that there is scope for greater convergence in this complex and
fast-evolving area of the law.
The wider objective of the Data Privacy Project is to promote a shared
legal ecosystem for international data transfers in Asia that would also be
interoperable with those already extant in other regions, such as Europe.
There is no question that this is an ambitious goal, but I draw confidence
from the fact that it is a shared enterprise. In this context, I would make
special mention of the Data Privacy Forum which was organised by the
Institute in Singapore on 7 February 2018 and was attended by 90 high-
level representatives from governments, data protection agencies, supra-
national organisations, industry, academia, and the legal community
from 19 different jurisdictions. During the Forum, the participants
engaged in a fruitful and productive discussion on how a framework for
the sharing and transfer information across international borders might
be developed in Asia. The breadth and depth of the support which the
Institute has enjoyed thus far, together with the quality of this
iv
Foreword
publication, gives me every confidence that its ambition is backed by the
necessary wherewithal to make it a reality.
This project is the work of many hands. Gratitude is due, first and
foremost, to the jurisdictional reporters who have so generously agreed to
give up their time to lend their considerable expertise to this project.
Thanks must go also to the data protection and privacy commissioners
and governments who have provided invaluable support and whose
participation has greatly increased the stature of the project. Finally,
special thanks are due to Dr Clarisse Girot, the project leader, and her
team at the Institute and the Singapore Academy of Law for so skilfully
co-ordinating the efforts of the jurisdictional reporters and for editing
the various chapters. This compendium would not have been possible
without the tremendous effort they have put in.
I congratulate the Institute on what has been achieved thus far and I look
forward with eager expectation at what is to come.
Sundaresh Menon
Chief Justice
Supreme Court of Singapore
24 April 2018
v
CONTENTS
Page

Foreword i

Introduction 1
Project Lead and Editor: Clarisse Girot
Jurisdictional Reports
Australia 17
Reporter: Peter G Leonard
China 62
Reporter: Kemeng Cai
Hong Kong SAR (China) 95
Reporter: Mark Parsons
India 17
Reporters: Amber Sinha and Elonnai Hickok
Indonesia 142
Reporters: Justisiari P Kusumah and Danny Kobrata
Japan 165
Reporter: Kaori Ishii
Macau SAR (China) 188
Reporter: Graça Saraiva
Malaysia 215
Reporter: Abu Bakar Bin Munir
New Zealand 247
Reporter: Katrine Evans
Philipines 278
Reporter: J J Disini
Singapore 315
Reporter: Ken Chia
South Korea 343
Reporter: Kwang Bae Park
vii
Contents
Page

Thailand 383
Reporter: David Duncan
Vietnam 394
Reporter: Waewpen Piemwichai

viii