IP & TMT Quarterly ReviewSecond Quarter 2016

www.mayerbrownjsm.com

2 IP & TMT Quarterly Review

mayer brown jsm 3

TRADE MARKS – CHINA

PATENTS – CHINA

COUNTERFEITING – CHINA

DATA PROTECTION – HONG KONG

CYBER SECURITY – HONG KONG

CONTACT US

4 The Continuing Battle over the “IPHONE” mark in respect of Leather Goods in China

7 China’s Judicial Interpretation on Patent Infringement Trials

10 Patent Licensing to China: Is a Joint Venture Necessary?

13 China Named Again as Global Source of Counterfeit Goods

16 To Market or Not to Market? Outsourced Service Provider Convicted for Breach of Direct Marketing Provisions

19 Riding on the Crest of a Wave of Emerging Risks – New Initiatives on Cyber-security by the Hong Kong Monetary Authority and the Securities and Futures Commission

Content

4 IP & TMT Quarterly Review

By Rosita Li, Partner, Mayer Brown JSM, Hong Kong Priscilla Ho, Trademark Executive, Mayer Brown JSM, Hong Kong

The Continuing Battle over the “IPHONE” mark in respect of Leather Goods in China

The Opposition

On 29 September 2007, a PRC entity, Xintong Tiandi Technology (Beijing) Company Limited (“Xintong”), filed a trade mark application for the “IPHONE” mark in class 18 (“Opposed Mark”) with the PRC Trade Marks Office (“TMO”). The goods covered by the application are a range of leather goods, wallets and cases under sub-classes 1801 and 1802.

The application for registration of the Opposed Mark was accepted for registration by the TMO. On 26 April 2010, Apple Inc. (“Apple”) filed an opposition against the Opposed Mark. Apple did not hold any China trade mark applications or registrations for its “IPOHNE” mark in class 18, at the time that the application for the Opposed Mark was filed. Therefore, in order to succeed in its opposition, Apple had to establish that its mark was well-known at the time that the application for the Opposed Mark was filed or that Xintong acted in bad faith.

Both the TMO and, subsequently, the PRC Trademark Review and Adjudication Board (“TRAB”) rejected Apple’s opposition claim and allowed the application for the Opposed Mark to proceed to registration. Although Apple filed an appeal to the Beijing No. 1 Intermediate People’s Court (“Intermediate Court”), the court again found in favour of Xintong and affirmed the TRAB’s decision.

The Intermediate Court’s decision was based on the following:

• As the application for the Opposed Mark was filed before the 2014 PRC Trademark came into effect, Apple’s opposition was considered based on the 2001 PRC Trademark Law, i.e. the old trademark law;

Trade MarksCHINA

mayer brown jsm 5

• Most of the evidence of use of the “IPHONE” mark submitted by Apple was dated after the filing date of the Opposed Mark (i.e. 29 September 2007) and the volume of evidence was limited; and

• The evidence filed was insufficient to show that Apple’s IPHONE mark had attained well-known status before the application date of the Opposed Mark.

In 2016, Apple filed a further appeal to the Beijing Higher People’s Court (“Higher Court”):

1. Ever since Apple’s products bearing the “IPHONE” mark were launched on 29 June 2007, the mark has become widely recognized and used worldwide (note that the first official launch in China was October 2009). Apple argued that its registered “IPHONE” mark in class 9 (registered since 2003) had attained an extremely high level of fame and distinctiveness in respect of goods in class 9, such as mobile phones, and should therefore be recognized as a well-known trade mark. Apple further alleged that the Opposed Mark was a blatant copy or imitation of Apple’s well-known trade mark. Despite Apple’s arguments, the Higher Court found that Apple had failed to establish that its “IPHONE” mark had achieved well-known status at the time that the trade mark application for the Opposed Mark was filed. At that time, Apple’s iPhone products had only been launched in China for 3 months.

2. Apple further agued that the Opposed Mark was immoral or had other “unhealthy influences” (e.g. a negative impact on public interest) in breach of PRC Trademark Law. The ground was rejected by the Higher Court due to a lack of evidence.

3. Lastly, Apple argued that the registration of the Opposed Mark was acquired by fraud or other improper means. This appeal ground was not considered by the Higher Court, as it had not been pleaded by Apple in its appeal to TRAB or in the Intermediate Court’s proceedings. Therefore, this ground could not form a basis of the appeal to the Higher Court.

In March 2016, the Higher Court upheld the decision against Apple. Whilst the Higher People’s Court decision is final, Apple may request for a re-trial with the Beijing Supreme People’s Court. Apple has already indicated that it intends to do so.

Impact to Apple

Once Xintong’s “IPHONE” mark is registered in respect of leather goods, etc, Apple will lose its right to register and use its name/mark “IPHONE” in relation to those types of goods. Despite the decisions issued by TRAB and the courts, Apple has attempted to file two trade mark applications for “IPHONE” in class 18 in China. Not surprisingly, these applications were blocked by Xintong’s prior application for the Opposed Mark in the same class.

In June 2008, Apple filed its first class 18 application in China. This application was partially rejected in respect of sub-classes 1801 and 1802 (due to Xintong’s earlier trade mark application for the Opposed Mark in those sub-classes). However, Apple’s application was allowed to proceed to registration in respect of the goods “umbrella; canes; dog leashes; guts for sausage” in sub-classes 1804, 1805, 1805 and 1807. Apple filed an appeal against the partial refusal all the way up to the Higher Court – in the end, Apple was unsuccessful and the partial refusal was sustained by the Higher Court on 19 April 2016.

On 17 January 2014, Apple fiiled its second class 18 application in China. The goods covered were “leather goods, wallets, bags and cases” in sub-classes 1801 and 1802. The application was rejected, and is currently being reviewed by the TRAB. It is likely that the refusal will be maintained in light of Xintong’s earlier registration for the Opposed Mark in the exact same sub-classes.

Conclusion

The TMO, TRAB and the various courts had issued a decision against Apple, mainly due to the following reasons: (i) Apple did not have any China trade mark applications or registrations in class 18 for its

6 IP & TMT Quarterly Review

“IPHONE” mark which pre-dated the filing of the Opposed Mark; (ii) insufficient evidence had been submitted by Apple to demonstrate that its mark had attained the required well-known status as at the relevant date i.e. the application date of the Opposed Mark; and (iii) the old Trademark Law had been applied.

If the new 2014 PRC Trademark Law had been applied, Xintong’s bad faith may have carried more weight. That said, whether Apple could have succeeded on the bad faith ground would have very much depended on the evidence it submitted. It is not clear if this ground was pleaded by Apple to support its opposition, as there was no reference to this ground in the decision issued by the Higher Court, and there was no reference to the fact that Xintong had filed other trade mark applications for marks like “iphone” and “ipad” in other classes.

This case emphasizes the need for international brands to thoroughly review and formulate their trade mark portfolio and filing strategy prior to launching relevant product or services in a particular market. It is vital to not only consider the core classes that are directly related, but also other classes that cover potential areas of future expansion or related products and services.

CHINA

Trade Marks Cont’d

mayer brown jsm 7

By Xiaoyan Zhang, Counsel, Mayer Brown JSM, Hong Kong

CHINA

PatentsChina’s Judicial Interpretation on Patent Infringement Trials

On 21 March 2016, the Supreme People’s Court (“SPC”) of the PRC issued Interpretation II on Several Issues Concerning the Application of the Law in the Trial of Patent Infringement Disputes (the “Interpretation”). The Interpretation came into force on 1 April 2016, and contains 31 articles addressing various issues arising from patent invalidity and infringement cases in recent years, especially with regard to the length of the application period, difficulties in evidence production and inadequate damages recovery. The first juridical interpretation was released in December 2009.

The key provisions from the Interpretation are summarized below.

Injunctive Relief is not Automatic

Injunctive relief is not an automatic remedy granted in patent infringement cases. Rather, the court will balance public and private interests in making its determination, and can order the defendant to instead pay a reasonable compensation.

Recovery of Patent Infringement Damages Made Easier

Patent infringement damages are notoriously difficult to assess in China due to the lack of a discovery process and the high burden of proof. The Interpretation attempts to improve the situation by adopting a layered approach. If the actual loss suffered by the right holder is difficult to ascertain, the court shall ask the right holder to provide evidence on the profits gained by the infringer. If the right holder has provided such preliminary evidence, and the accounting books and documents relating to the patent infringement are primarily within the possession of the infringer, then the court may order the infringer to provide such books and documents. If the infringer refuses to provide the books and documents without justification, or provides false information, the court

8 IP & TMT Quarterly Review

may ascertain the profits gained based on claims and supporting evidence provided by the right holder.

If a right holder and the infringer agree on the amount of damages or the method for calculating damages, the court shall adopt such amount or method.

Standard Essential Patent (“SEP”) Related Issues

If a patentee wilfully violates the FRAND licensing obligations during an SEP licensing negotiation, resulting in the failure to agree the terms of a licence agreement through no obvious fault of the alleged infringer, no injunctions will be granted during the SEP infringement suit. Moreover, implementing a national, industrial or local standard pursuant to a recommendation is not a defence to patent infringement when the standard explicitly specifies the essential patent(s) covered.

The licensing terms shall be determined by the patentee and the alleged infringer through negotiation. If the parties fail to reach a licence agreement through negotiation, they can ask the court to make a determination on the royalty rate of the SEP. In making such determination, the court shall, pursuant to the FRAND principle, consider factors such as the novelty of the SEP, its effect on the standard, the nature, technical fiend, and implementation scope of the standard, and related licensing terms.

The Effect of PRB’s Invalidity Decision on Infringement

A patent infringement case may be dismissed, without prejudice, by a court if the patent is declared invalid by the Patent Re-examination Board (“PRB”). In the event that the PRB’s invalidity decision is later revoked, the patent right holder can file a new infringement case.

If a party requests to quash a patent infringement judgment or written mediation statement rendered by the court before the invalidation decision on the patent is issued, but is yet to be enforced, the court may stay

the enforcement of the judgment or written mediation statement unless the patent right holder provides a bond to the court and requests the continued enforcement of the judgment or written mediation statement. In the event that the invalidity decision survives the court’s effective ruling or judgment, the patentee shall compensate the alleged infringer for the losses incurred as a result of the continued enforcement. If the invalidity decision is later quashed and the patent remains valid, the court may directly proceed with enforcement against the property provided as a counter-bond pursuant to the infringement judgment or written mediation statement.

A retrial may be granted based on an effective judgment or ruling entered by a court affirming the invalidity decision, requesting to quash a patent infringement judgment or written mediation statement rendered by the court prior to the invalidity decision being enforced. The court may also grant a retrial if the statutory deadline to appeal the invalidity decision to a court has passed.

A request to terminate the enforcement of a patent infringement judgment or written mediation statement may be granted provided this is rendered prior to the invalidation of the patent.

Non-Infringement

There will be no finding of infringement if:

• An accused technical solution cannot be adapted for use in the environment defined by the claims;

• The alleged infringing product is made by a process that is neither identical nor equivalent to the claimed process in a product-by-process claim; or

• An alleged infringing technical solution has additional features compared to a close-ended claim on a composition and the additional features are not inevitable impurities of a normal amount (does not apply to claims on traditional Chinese medicine compositions).

CHINA

Patents Cont’d

mayer brown jsm 9

Design Patents Infringement

“Design space” will be considered by the court when determining the level of knowledge and cognitive capability of an average consumer on a design. A wider design space means it is usually difficult for an average consumer to notice minor distinctions between different designs. In variable state design, infringement will be found if the allegedly infringing design is identical or similar to the design in all the various states of use as illustrated in the variable-state views.

In cases where there is only one option of assembly, infringement will be found if the allegedly infringing design is identical or similar to the design under the assembled condition. In cases where there is more than one option of assembly or there is no assembly relation among the components, infringement will be found if the alleged infringing design is identical or similar to the design of each individual component. In the case of a design for a product set, infringement will be found if the allegedly infringing design is identical or similar to one of the designs in the set.

The Interpretation also provides clarifications as to how to interpret functional claims and determine their equivalents, indirect infringement, and provisional protection for the period between publication and grant.

Conclusion

The Interpretation provides much-needed clarifications to various important issues in the current patent litigation procedure.

10 IP & TMT Quarterly Review

By Xiaoyan Zhang, Counsel, Mayer Brown JSM, Hong Kong

CHINA

PatentsPatent Licensing to China: Is a Joint Venture Necessary?

Historically, American companies have outsourced their technologies to China by licensing patents directly to Chinese companies. In recent years a new trend has emerged whereby such companies form a Sino-U.S. joint venture where patent rights are transferred to the joint venture (“JV”) as a capital injection.

Qualcomm Inc. recently entered into joint ventures with several Chinese companies to develop its wireless and advanced server technology. In early 2016 Microsoft Corp. formed a JV with a state-owned company in Beijing to develop its Windows 10 operations system. Is marriage throught a JV necessary from a regulatory and legal perspective?

When Forming a JV is a Must

Both direct licensing and joint ventures are classified as importation of technology and are subject to myriad regulations in China, including the PRC Regulations on Administration of Import and Export of Technologies. Not all technologies can be imported to China and those permitted may be subject to further restrictions. Forming a JV is mandated for technologies falling under the Catalogue for the Guidance of Foreign Investment Industries jointly released by the National Development and Reform Commission and the Ministry of Commerce. The Catalogue requires JVs for 15 sectors including energy, transportation, education and media. Notably, wireless and computer software are not among the compulsory categories on the list.

No Major Tax Incentives for JVs

Licensing from a tax perspective may be better than forming a JV. In direct licensing, the Chinese licensee pays a withholding tax of 16 percent, including 10 percent of company income tax and 6 percent value-added tax on the royalties, which may or may not be reimbursed by the foreign licensor depending on the parties’ agreement. In a JV, the JV entity does pay

mayer brown jsm 11

Chinese tax for income generated in China, although the foreign party pays no separate Chinese tax on its proportionate share of profits.

JVs do not receive special income tax treatment compared to domestic Chinese enterprises. The PRC Enterprise Income Tax Law of 2008 generally applies the same company income tax rate of 25 percent to both domestic and foreign-invested enterprises. High and new technology enterprises, whether or not formed through JVs, are levied at a reduced rate of 15 percent, and super deductions are allowed for some R&D expenses. Also certain qualifying high and new technology enterprises established after 1 January 2008, in Shenzhen, Zhuhai, Shantou, Xiamen, Hainan and Pudong New District of Shanghai may enjoy company income tax exemption for the first two years, and half of the regular company income tax rate for the third to fifth years.

Intellectual Property: Improvements and Grantback

While JVs are often thought to give foreign licensors greater control over IP than licensing, this is only marginally true for improvements made to the imported technologies. Article 27 of the Import and Export Regulations provides that improvements shall vest in the party that makes the improvements. In direct licensing it is the domestic Chinese enterprise; in JVs it is the Sino-foreign JV. Even though rights under the improvements can be granted back to the foreign licensor with proper compensation, such grantbacks are subject to both heightened antitrust scrutiny under Article 329 of the PRC Contract Law and China’s export control regulations. In the end foreign licensors may not be able to take improvements to their home country as freely as they would have wished.

Even if the foreign party controls the JV through ownership or contract, this control does not translate into intellectual property ownership. The joint ownership of a patent cannot be set proportionally in China even though profits from exploiting the patent can be distributed per parties’ agreement.

Most JV Marriages are Unhappy

Foreign companies historically have tried to bargain for “percentage control” in an equity JV, believing that a majority shareholding equates effective management control and in turn leads to a happy marriage. This remains wishful thinking.

Statistics published by the IMAP Global Mergers & Acquisitions Advisory reveal that the failure rate of Sino-foreign JVs remains as high as 70 percent. The number of Sino-foreign JVs has dropped by an average of 25 percent per year from 2000 to 2008, according to Bain & Co. JVs in China have achieved a reputation for being difficult to manage, and the reasons for failures include disagreements over business decisions exacerbated by cultural differences. The Danone-Wahaha JV ended in a painful series of lawsuits, where the French party exited by selling its participation.

Although majority ownership does not guarantee control, foreign JV partners are prohibited from owning majority interests in 35 industries including telecommunication value-added service (no more than 50 percent), basic telecom business (no more than 49 percent), and air transportation companies (no more than 25 percent).

Direct Licensing: The Challenges

Despite these challenges, American companies still opt for JVs perhaps because direct licensing raises additional concerns in China.

First, foreign licensors may face heightened antitrust scrutiny in China not encountered by JVs especially with standard-essential patents. Foreign licensors are subject to antitrust claims (administrative by the National Development and Reform Commission or civil by the Chinese licensee) that their standard-essential patents royalty rates violate fair, reasonable and nondiscriminatory terms.

Second, it is difficult to conclude a patent licensing deal with Chinese companies. The current PRC Patent Law provides inadequate deterrence to patent

12 IP & TMT Quarterly Review

infringement. Injunctions are difficult to enforce and patent damages are almost impossible to prove in Chinese courts. As a result, nearly 97 percent of the patent infringement cases are awarded statutory damages that are capped at only 1 million renminbi. When approached for licensing, Chinese companies often delay the negotiation as a common tactic while continuing to exploit the patented technologies for free. Even if a license deal is eventually concluded, collecting royalties in China can be difficult and marred by fake and “smart” accounting.

A 2013 National Development and Reform Commission investigation resulted in a fine of 6.1 billion renminbi against Qualcomm and a rectification plan requiring Qualcomm to lower its royalty rates (5 percent for 3G devices and 3.5 percent for 4G devices). Another long seven-year licensing battle between InterDigital Co. and Huawei led to multiple infringement lawsuits in the U.S. initiated by InterDigital and antitrust countersuits by Huawei in China. The Chinese court finally ordered InterDigital to stop its practice of overpricing and tying sales of its products embodying 3G standard-essential patents and awarded Huawei 20 million renminbi.

Conclusion

Although JVs in China do not appear to provide substantial tax benefits or safeguards for intellectual property over improvements, and they can be difficult to manage, they remain a preferred way of entering the China marked for foreign companies and may reduce potential antitrust liability.

CHINA

Patents Cont’d

mayer brown jsm 13

By Xiaoyan Zhang, Counsel, Mayer Brown JSM, Hong Kong Amita Haylock, Senior Associate, Mayer Brown JSM, Hong Kong

CHINA

CounterfeitingChina Named Again as Global Source of Counterfeit Goods

Introduction

China’s role as a “global source of counterfeit goods” has been confirmed yet again, this time in the Office of the US Trade Representative’s Special 301 Report (the “Report”). Issued in April 2016, this annual Report reviews the intellectual property rights (“IPR”) protection policies and enforcement measures of the country’s 73 trading partners including China.

China, along with India, Thailand, and Indonesia share the prime spot on the Report’s Priority Watch List. These countries are deemed not to provide an adequate level of IPR protection or enforcement, or of market access for persons relying on IPR protection.

The Report identifies a range of concerns about IPR in China, including the growing problem of misappropriation of trade secrets and also indigenous innovation policies which may unfairly disadvantage US IPR holders in China.

The China Dilemma

Certain concerns about China feature prominently throughout the Report. These include:

1. Trade secrets theft The misappropriation of trade secrets and their use by a competitor can have a serious impact on business. The remedies available under Chinese law can be difficult to obtain and are insufficient to match the level of threat. Enforcement obstacles include:

• Deficiencies in China’s primary trade secrets law (found in the Anti-Unfair Competition Law) which limit the regulation’s application;

• Unresolved weakness in China’s civil enforcement, including limited injunctive relief and low damages awards; and

• Difficulties in pursuing criminal enforcement, including the need to prove actual damage caused by the theft of the trade secret.

14 IP & TMT Quarterly Review

CHINA

Counterfeiting Cont’d2. Information and Communications (“ICT”)

policies Since 2014, a number of measures introduced in China have invoked ‘national security’ as a justification for mounting barriers to foreign ICT products and services, and also for requiring the disclosure of critical intellectual property (“IP”) as a condition of access to the Chinese market. This troubling trend emerged when China issued a series of measures applying to the banking sector purchases of ICT products and services. Over time, these measures will require financial institutions operating in China to purchase an increasing share of ICT products and services from indigenous suppliers. An example of this is requiring foreign firms to conduct ICT-related research and development in China and divulge proprietary IP as a condition for the sale of ICT products and services on the domestic market.

3. Piracy and counterfeiting in China’s e-commerce markets China’s State Administration for Industry and Commerce (“SAIC”) reported that around 40 percent of goods that the SAIC purchased online during a survey were “not genuine”, a classification that it described as including fakes. To give a sense of scope of the problem, China has the largest Internet user base in the world, and annual sales of goods on the Internet are projected at nearly half a trillion US dollars. Although some online platforms have streamlined procedures to remove infringing articles, IPR holders report that the procedures are still burdensome and that repeat infringers are not deterred by penalties.

4. Global source of counterfeit goods The Report identifies China as the manufacturing hub of counterfeit goods sold illicitly on markets around the world. Counterfeit goods produced in China include: food and beverage, apparel, footwear, accessories, consumer electronics, computers and networking equipment, entertainment and business software, batteries, chemicals, appliances, pharmaceuticals and auto parts. In 2015, products from China accounted for

52 percent of the value of the IPR infringing products seized at US ports. Products transhipped through Hong Kong, or designated as originating there, were also produced in China, and accounted for an additional 35 percent of the estimated total value of seizures in US ports.

5. Patent-related measures and policies In addition to excluding foreign companies from standards setting, there is also a concern that foreign patent holders may be forced to both contribute proprietary technologies to standards against their will, and also be required to license them. This concern is based on a number of provisions found in existing and proposed measures relating to technical regulations, standard essential patents, and Anti-Monopoly Law enforcement in China. The Report flags this as a huge problem for patent holders and requests that measures should be taken to ensure that a patent holder’s determination of whether to contribute technology to a standard should be voluntary and not mandated by the government.

What is China Doing About Tthis?

China’s leadership has affirmed repeatedly the importance of IP generally. There are also ongoing IP legal and regulatory reform efforts such as developing draft measures on copyright, patents, trade secrets, drug review and approvals, Anti-Monopoly Law enforcement as it relates to IP and regulations on inventor remuneration.

At the end of 2015, the State Council of the People’s Republic of China published its “Opinion of the State Council on accelerating the building of a strong IP nation under new conditions’’ (the “Opinion’’). This provides general measures to strengthen the protection and enforcement of IPR; promote creation and use of IPR; predict and prevent IP risks for Chinese enterprises “going out” (i.e. companies investing abroad); strengthen planning for key industries; improve the level of international IP cooperation; and organise and implement policy guarantees. It is expected that the Opinion will be implemented in the next four years.

mayer brown jsm 15

In response to criticisms that it is lax in protecting IP rights, China has also set up specialised courts to handle IP cases. These courts were established in Beijing, Shanghai, and Guangzhou in late 2014. However, these courts are not yet handling criminal counterfeiting case.

There are also plans in place for China to accede to the Hague Convention, which provides protection for industrial designs.

These measures are certainly a step in the right direction, but until we see the counterfeiting numbers drop, scepticism will remain about the actual substance of these measures.

What does This Mean for Brand Owners Operating in China?

Unfortunately, there is no magic wand that brand owners can wave to protect themselves from counterfeiting in China. But there are a number of steps that brand owners should take as part of a well developed and consistent enforcement strategy.

For example, brand owners should:

• Be persistent in their enforcement strategy as this will send a strong message to infringers that IPR owners will not turn a blind eye to infringing activities;

• Work closely with the Chinese enforcement authorities in tackling infringements s. As an example, Salvatore Ferragamo revealed that as part of a joint campaign with the Chinese customs authorities, it had prevented US$ 7 million worth of counterfeit products from being sold online in Chinese marketplaces. The company found 90,000 counterfeits sold across 350 websites and all websites were subsequently shut down;

• Work with border control/customs in their respective countries to identify the incoming shipments of counterfeit goods; and

• Maintain better control over the supply chain of goods manufactured in China.

The production of counterfeit goods remains a

lucrative business in China, and an effective solution to address counterfeiting requires a multi-pronged approach.

mayer brown jsm 16

To Market or Not to Market? Outsourced Service Provider Convicted for Breach of Direct Marketing Provisions

On 16 May 2016, a marketing company was convicted for 2 breaches of the direct marketing provisions under the Hong Kong Personal Data (Privacy) Ordinance (“PDPO”). This is the fifth conviction in the last 12 months concerning the use of personal data in direct marketing, and the first time a marketing company has been in the firing line. The case sends a warning message to outsourced service providers carrying out marketing activities on behalf of a client that an agency arrangement may not shield them from liability under the PDPO.

The Relevant Direct Marketing Restrictions

On 1 April 2013, the new direct marketing provisions introduced by the Personal Data (Privacy) (Amendment) Ordinance 2012 came into effect. Under the PDPO, unless the relevant data subjects’ express and prior consent has been obtained, data users are prohibited from using personal data for direct marketing purposes, or from transferring it to a third party for their own use in direct marketing1. Valid consent for the transfer or use of personal data for direct marketing purposes can only be obtained if the data user has notified concerned data subjects of the following2:

a. That it intends to use their personal data for direct marketing and/or to transfer their personal data to a third party for direct marketing purposes, and cannot do so without their consent;

b. The classes of transferees to whom their personal data will be transferred for their use in direct marketing;

1 Sections 35E and 35K of the PDPO.

2 Sections 35C and 35J of the PDPO.

By Gabriela Kennedy, Partner, Mayer Brown JSM, Hong Kong Karen H.F. Lee, Senior Associate, Mayer Brown JSM, Hong Kong

Data Protection

HONG KONG

mayer brown jsm 17

c. The type of personal data that will be used or transferred;

d. The classes of goods, etc that will be marketed;

e. Whether the personal data is being transferred in return for gain (e.g. in return for payment, etc); and

f. A means through which the individual can communicate his/her consent in writing for free.

The notification and consent requirements regarding the transfer of personal data to a third party, do not apply where the data user is transferring the personal data to its agent, so that they can carry out direct marketing solely on behalf of the data user3.

In addition, a data user must promptly comply with any request it receives from an individual asking them to cease using their personal data for direct marketing purposes4.

Breach of the direct marketing provisions is a criminal offence and may result in a maximum fine of HK$500,000 and 3 years’ imprisonment, or a maximum fine of HK$1,000,000 and up to 5 years imprisonment (if there has been a transfer of personal data in return for gain).

The Case

In May 2014, the Privacy Commissioner received a complaint against a marketing company (“Marketing Company”). The complainant had made a reservation with a restaurant at a hotel in Hong Kong (“Hotel”), and provided his surname and mobile number (“Personal Data”). In April 2014, the complainant received a call from the Marketing Company inviting the complainant to join the Hotel’s membership programme. The complainant had never provided his consent for such use of his Personal Data. During the call, the complainant informed the Marketing Company that he was not interested and asked the Marketing Company to never call him again. Contrary to the complainant’s opt-out request, the Marketing Company called the complainant again in May 2014 to

3 Section 35I of the PDPO.

4 Section 35G of the PDPO.

promote the Hotel’s membership programme. During the call, the Marketing Company indicated to the complainant that the Hotel had outsourced the promotion of its services to the Marketing Company.

The case was referred by the Privacy Commissioner for prosecution and brought before the Kwun Tong Magistrates’ Court. Interestingly, the case was brought against the Marketing Company only. The Marketing Company pleaded guilty to using the complainant’s Personal Data for direct marketing purposes without having obtained the complainant’s prior consent and without complying with its notification obligation, and also for failing to cease using the complainant’s Personal Data in direct marketing after receiving the complainant’s request to do so. The Marketing Company was fined HK$16,000 in total (HK$8,000 for each charge).

Who is Liable?

Why were the criminal proceedings for breach of the PDPO brought against the Marketing Company, but not the Hotel?

Under Section 2(12) of the PDPO, a person is not considered to be a data user for the purposes of the PDPO, if the person holds, processes or uses the relevant personal data solely on behalf of another, and does not hold, process or use the personal data for its own purposes. The Hotel had collected the Personal Data from the complainant and provided it to the Marketing Company in order for it to provide marketing services on behalf of the Hotel. Since the Marketing Company had pleaded guilty to both charges, there was no discussion as to whether or not the Marketing Company should in fact be held liable in respect of the first charge, i.e. failing to provide the specified notification and to obtain consent. Arguably, such obligations fell on the shoulders of the Hotel as the data user and original collector of the personal data, and the Marketing Company simply acted as the Hotel’s data processor and agent.

18 IP & TMT Quarterly Review

Data Protection Cont’dHONG KONG

The case was heard before a Magistrate’s Court and no written judgment is publicly available. For now, this means that the many questions the case raises, will remain just open to speculation.

However, in the wake of this case, it is likely that data processors might take the view that having a data processing arrangement in place, will no longer offer immunity from the direct marketing provisions in Hong Kong. A tightening of relevant provisions in data processing or marketing agreements is to be expected, as data processors and marketing companies will seek to obtain appropriate warranties and indemnities from their customers.

Where to Now?

In 2015, 322 complaints were received by the Privacy Commissioner relating to direct marketing. As of 31 December 2015, 53 cases were referred by the Privacy Commissioner to the police for criminal investigation and prosecution. A constant stream of decisions on direct marketing can be expected from now on. So far the criminal convictions have related to isolated incidents of breaches, with the maximum fine imposed being HK$30,000. It is likely that the courts will impose higher fines in future cases involving multiple complainants, repeat breaches and transfers of personal data in return for gain.

This most recent case will no doubt cause marketing companies and other data processors to review their terms of business and seek stronger assurances from their corporate customers regarding consents from data subjects, and cause them to revisit their procedures regarding the maintenance of opt-out lists.

mayer brown jsm 19

By Gabriela Kennedy, Partner, Mayer Brown JSM, Hong Kong Karen H.F. Lee, Senior Associate, Mayer Brown JSM, Hong Kong

Maggie S.Y. Lee, Associate, Mayer Brown JSM, Hong Kong

HONG KONG

Cyber SecurityRiding on the Crest of a Wave of Emerging Risks – New Initiatives on Cyber-security by the Hong Kong Monetary Authority and the Securities and Futures Commission

A set of initiatives in Hong Kong by the financial regulators to strengthen cyber-security requirements have taken place in the past few months. These initiatives come as no surprise given the increase in the number of data breaches and data hacks in Hong Kong in the past year alone. In fact cyber-security has been on the radar of both the Hong Kong Monetary Authority (“HKMA”) and the Securities and Futures Commission (“SFC”) for at least two years (see the various circulars, guidelines and other publications issued by each since 20145, and the semantic shift in the language of these publications from reducing / mitigating hacking risks to clearer edicts on pre-emptive measures to increase cyber-security).

This article looks at the changes and proposals articulated in the recent initiatives of the HKMA and the SFC and their impact on financial institutions operating in Hong Kong.

HKMA’s Cybersecurity Fortification Initiative

On 18 May 2016, the HKMA announced a new cybersecurity initiative unambiguously called the “Cyber-security Fortification Initiative” (“CFI”). The

5 HKMA publications: Supervisory Policy Manual module entitled “Risk Management of E-banking” dated 2 September 2015; Circular entitled “Cyber Security Risk Management” dated 15 September 2015;

SFC Circulars: Circular to All Brokers – Tips on Protection of Online Trading Accounts dated 29 January 2016; Circular to All Licensed Corporations on Internet Trading – Internet Trading Self-Assessment Checklist dated 11 June 2015; Circular to Licensed Corporations – Mitigating Cybersecurity Risks dated 27 November 2014; Circular to All Licensed Corporations on Internet Trading – Information Security Management and System Adequacy dated 26 November 2014; and Circular to All Licensed Corporations on Internet Trading - Reducing Internet Hacking Risks dated 27 January 2014.

20 IP & TMT Quarterly Review

Cyber Security Cont’dHONG KONG

CFI is the most comprehensive cyber-security initiative developed by the HKMA to date.

The CFI applies to all financial institutions in Hong Kong supervised by the HKMA (“Banks”) and its aim is to enhance the cyber-security of Hong Kong’s banking system through: (i) the introduction of a cyber risk assessment framework; (ii) rolling out training to ensure a steady supply of qualified cyber-security professionals; and (iii) setting up a cyber intelligence platform for Banks. The CFI will be implemented through a three pronged approach, namely:

1. Cyber Resilience Assessment Framework The Cyber Resilience Assessment Framework is intended to establish a risk-based framework for financial institutions to self-assess their risk profiles and determine the level of security they require. The framework comprises three components:

i. Inherent risk assessment – which measures the cyber risk exposures of a Bank based on a set of factors. Inherent risk ratings of high, medium or low will be used to set each Bank’s “required maturity level” of cyber resilience.

ii. Maturity assessment – A Bank’s “actual maturity level” of cyber resilience is to be ascertained through this assessment. By comparing the actual maturity level and the required maturity level of cyber resilience, gaps in the cyber-security framework of a Bank can be identified. The HKMA will require the Bank’s senior management to put in place governance arrangements and processes to achieve the required level of cyber resilience.

iii. Intelligence-led Cyber Attack Simulation Testing (“iCAST”) – will comprise of simulation test scenarios which are designed to replicate cyber attacks based on specific and current cyber threat intelligence. Banks which aim to attain the “intermediate” or “advanced” actual maturity levels are required to perform and satisfy an iCAST.

The inherent risk and maturity assessments should be conducted by qualified professionals who

possess the necessary knowledge and expertise, such as professionals certified under the Professional Development Programme (discussed below).

The HKMA will shortly begin a three month consultation of the Cyber Resilience Assessment Framework with Banks. The details of the factors that will be considered in the inherent risk and maturity assessments and the methods of assessments will be released to Banks shortly.

2. Professional Development Programme The Professional Development Programme has been devised to deal with the lack of qualified cyber-security professionals who will be needed to assist financial institutions to carry out cyber-security audits and implement adequate levels of security. The Professional Development Programme hopes to close this skills gap by boosting the supply of qualified cyber-security professionals and enhancing the sector’s cyber security system.

The Professional Development Programme is a training and certification programme which has been designed jointly by the HKMA, Hong Kong Institute of Bankers (“HKIB”) and Hong Kong Applied Science and Technology Research Institute (“ASTRI”). Scheduled to be rolled out by the end of 2016, the programme will provide the first set of training courses for cyber-security practitioners in Hong Kong. While initially designed for the financial sector, depending on its success it is likely other sectors might follow suit.

3. Cyber Intelligence Sharing Platform The final pillar of the CFI features a new piece of infrastructure which allows the sharing of cyber threat intelligence amongst Banks to enhance collaboration and uplift cyber resilience. The platform will be jointly launched by the HKMA, HKIB and ASTRI by the end of 2016. All Banks are expected to join the platform. This will be the first platform of its kind launched in Asia.

The platform’s aim is to increase awareness

mayer brown jsm 21

amongst Banks of cyber-attacks and enable them to be prepared for attacks, by constantly sharing cyber –intelligence.

On 24 May 2016, the HKMA issued a circular6 to all Banks mandating the implementation of the CFI. In the meantime, Banks are encouraged to actively participate in the consultation exercise for the Cyber Resilience Assessment Framework and are reminded to start making the necessary preparations to implement the CFI. The HKMA will set out further details of the regulatory requirements related to the implementation of the CFI after taking into account input from the industry during the consultation period.

SFC’s Circular on Cybersecurity

Prior to the issuance of the CFI, a Circular to All Licensed Corporations on Cybersecurity7 (“Circular”) was issued by the SFC in March this year. The SFC regulates participants in the securities and futures markets which are licensed under the Securities and Futures Ordinance8 (also known as Licensed Corporations, “LCs”). The Circular identified areas of concern arising out of reviews conducted by the SFC against selected LCs, including inadequate coverage of cyber-security risk assessment exercises, inadequate cyber-security risk assessment of service providers, insufficient cyber-security awareness training, inadequate cyber-security incident management arrangements and inadequate data protection programs.

In view of the outcome of the reviews, the SFC recommended cyber-security controls that could help address the weaknesses in cyber-security control frameworks and strengthen defensive mechanisms, including:

6 HKMA Circular entitled “Cybersecurity Fortification Initiative” dated 24 May 2016.

7 SFC Circular to All Licensed Corporations on Cybersecurity dated 23 March 2016.

8 Examples of LCs include market operators (e.g. exchanges and clearing houses) and intermediaries (e.g. brokers, investment advisers and fund managers).

• Establishing a strong governance framework for cyber-security management;

• Implementing a formalized cyber-security management process for service providers;

• Enhancing security architecture to guard against advanced cyber-attacks;

• Formulating information protection programs to protect sensitive information flow;

• Strengthening threat, intelligence and vulnerability management to pro-actively identify and remediate cyber-security vulnerabilities;

• Enhancing incident and crisis management procedures with more details of latest cyber-attack scenarios;

• Establishing adequate backup arrangements and a written contingency plan that incorporates the latest cyber-security landscape; and

• Reinforcing user access controls to ensure access to information is only granted on a need-to-know basis.

In short, LCs should make sure that the enhancement of their cyber-security controls is being treated as a matter of priority. LCs are required under the Circular to undertake a comprehensive and effective review and assessment of their cyber-security risks , including seeking advice from third party provider/consultants if they do not possess such expertise or resources in-house, and rectify any weaknesses identified as a result of their review and assessment. At the same time, they are expected to comply with the cyber-security standards set out in other SFC circulars on cyber-security and online trading published in the last two years.

What do These Changes Mean?

The latest developments are evidence that the Hong Kong regulators are paying more and more attention on enhancing cyber-security across the city’s banking and financial services sectors. Earlier this year, the HKMA made an announcement of the establishment of its new Fintech Facilitation Office to promote research in Fintech solutions, with cyber-security being one of

22 IP & TMT Quarterly Review

Cyber Security Cont’dHONG KONG

its key topics for research. More recently, the HKMA issued a further circular9 which requires Banks to enhance their fraud management mechanisms in Internet banking in light of recent unauthorised share trading incidents. The SFC has expressly stated in the Circular that it intends to focus on LCs’ cyber-security preparedness. We can see that the regulators’ emphasis has shifted from seeking enhancement of cyber-security systems two years ago to mandating that Banks / LCs be prepared and accountable for their systems. We expect to see the regulators continuing to issue further requirements or guidance in the near future. In order to maintain its position as a leading international financial centre, it is vital for Hong Kong’s financial institutions to have in place robust cyber-security measures and to maintain accountability for them.

Furthermore, it is clear that the HKMA and the SFC are urging institutions to take on a risk-based and threat-based approach to cyber-security and are starting to introduce more concrete and detailed requirements to ensure that Banks and LCs adopt such an approach. Institutions are expected to detect their cyber-security risks and to strengthen their cyber-security control framework according to the risks identified. Merely complying with the minimum cyber-security requirements without regard to an institution’s risk profile and vulnerabilities is likely to be considered inadequate in light of the latest SFC circulars and the CFI.

9 HKMA Circular entitled “Security controls related to Internet banking services” dated 26 May 2016.

Mayer Brown JSM is part of Mayer Brown, a global legal services organisation, advising many of the world’s largest companies, including a signifi cant proportion of the Fortune 100, FTSE 100, CAC 40, DAX, Hang Seng and Nikkei index companies and more than half of the world’s largest banks. Our legal services include banking and fi nance; corporate and securities; litigation and dispute resolution; antitrust and competition; employment and benefi ts; environmental; fi nancial services regulatory and enforcement; government and global trade; intellectual property; real estate; tax; restructuring, bankruptcy and insolvency; and wealth management.

Please visit www.mayerbrownjsm.com for comprehensive contact information for all our offi ces.

This publication provides information and comments on legal issues and developments of interest to our clients and friends. The foregoing is intended to provide a general guide to the subject matter and is not intended to provide legal advice or be a substitute for specifi c advice concerning individual situations. Readers should seek legal advice before taking any action with respect to the matters discussed herein.

Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the “Mayer Brown Practices”). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe-Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown Mexico, S.C., a sociedad civil formed under the laws of the State of Durango, Mexico; Mayer Brown JSM, a Hong Kong partnership and its associated legal practices in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. Mayer Brown Consulting (Singapore) Pte. Ltd and its subsidiary, which are affi liated with Mayer Brown, provide customs and trade advisory and consultancy services, not legal services.

“Mayer Brown” and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.

© 2016 The Mayer Brown Practices. All rights reserved.

Contact Us

GABRIELA KENNEDYPartner+852 2843 2380 gabriela.kennedy@mayerbrownjsm.com

ROSITA LI Partner+852 2843 4287 rosita.li@mayerbrownjsm.com

AMITA HAYLOCKSenior Associate+852 2843 2579amita.haylock@mayerbrownjsm.com

KAREN H.F. LEE Senior Associate+852 2843 4452karen.hf.lee@mayerbrownjsm.com

MAGGIE LEE Associate+852 2843 4336maggie.lee@mayerbrownjsm.com

XIAOYAN ZHANGCounsel (New York, USA)+852 2843 2209 xiaoyan.zhang@mayerbrownjsm.com

0616

Americas | Asia | Europe | Middle East | www.mayerbrownjsm.com