waiting for the organiser. - ipr-helpdesk · •case study: if an eu individual who uses tinder...

Waiting for the Organiser.

The Webinar will begin shortly.

Straits InteractiveMr. Alvin Toh

European CommissionMr. Fabian Delcros

SEA IPR SME HelpdeskMs. Amira Nabila Budiyano

21 June 2018Copyright © 2018 European Union-Malaysia Chamber of Commerce and Industry & South-East Asia IPR SME Helpdesk.

All rights reserved.

Welcome to the Webinar!

Rita MooreEvents and Business Support Manager

Project: SEBSEAM-MSupport for European Business in South East Asia Markets – Malaysia

Lead applicant: EUMCCIEU-Malaysia Chamber of Commerce and Industry

Webinar Interaction Tools

Turn on full screen here

Raise your hand here

Send the IP expert a question here

Webinar 24 hour technical support number: http://support.gotomeeting.com ‘Contact Us’ section



http://support.gotomeeting.com/

EUMCCI in Brief

ADVOCACYNETWORKING EVENT PLATFORM

11 Committees1600 Companies +20 Events

Know Your Market Foster Partnerships Enter Malaysia

Strong network across

Malaysia, ASEAN, and Europe

as the EU Chamber of

Chambers.

Business Opportunities

through events all year

round.

Strong voice to government

through industry

committees.



Practical Examples



PDPA / GDPR Workshops TBC

Welcome to the Webinar!



Helika JurgensonProject Officer

South-East Asia IPR SME Helpdesk

Snapshot: Helpdesk Free Services

Enquiry HelplineIP Guides & Newsletters

E-learning & Business Tools

Training Workshops& Live Webinars

Website www.ipr-hub.eu Blog www.youripinsider.eu



Speakers’s Bio

Name: Mr. Alvin TohFirm: Straits InteractiveLocation: SingaporeEmail: [email protected]

As CMO and Head of International Operations of Straits Interactive, Alvin drivesmarketing strategy, awareness and partner relationships for the company’s innovativeprivacy solutions that build upon the foundation of responsible marketing.

In addition to running the company’s marketing and international operations, Alvin is asort after regional speaker on data protection and privacy management. With hisextensive knowledge of regulatory requirements and his process driven outcome, Alvin isalso involved in Straits Interactive’s data protection consulting and training engagements.



For Mr. Alvin Toh’sPresentation, pleaserefer to the externalpresentation linkedon the Website.

mailto:[email protected]



Speakers’s Bio

Name: Ms. Amira Nabila BudiyanoFirm: Gateway Law Corporation / Gateway Intellectual Property Services Location: Singapore / MalaysiaEmail: [email protected]

Amira has a diverse practice with a core focus on IP, privacy and IT laws. Amira has administeredand managed local and overseas clients’ IP portfolios. Her practice also includes providing advice onIP commercialization, such as assignment/franchise agreements, IP due diligence, licensing andtechnology transfer matters. Apart from that, she continues to engage in general corporate advisorywork (related to IP rights or otherwise) involving confidential information and trade secretsamongst others and several regulatory and technology-related issues.

Amira was also previously on the Panel of Lawyers under the PDPA Legal Advice Schemeadministered by the Law Society, and has advised a multi-national company providing IT solutionsto Singapore’s biggest telecommunications service provider on a recent investigation by thePersonal Data Protection Commission on a breach of data protection obligations.


The GDPR and its impact on SMEs’ IPR strategies in Southeast Asia



Topic



Does the GDPR affect your organisation in Southeast Asia?

• Extraterritorial effect of the GDPR: Organisations based outside the EU may still besubject to the GDPR if they conduct either of the following:-

o Target goods or services at EU individuals irrespective of whether payment isrequired;

o Monitor the behavior of EU individuals

• Non-exhaustive factors determining whether business in Southeast Asia targets EUindividuals :-

oUse of an EU language;

oUse of an EU currency;

oOther references to EU users.

• The effects of the GDPR will be most pronounced for businesses that heavily rely onindividuals’ personal data as their business models.



What is Intellectual Property (IP)?

Intellectual Property

Trade Marks Patents Designs CopyrightProprietary Information

Trade Secrets

Know-how

Types of IPR most likely to be affected by the GDPR



What types of South-east Asian organisations will the GDPR affect specifically?

• Case Study: Types of organisations that rely on personal data as business models(non-exhaustive)

*For the GDPR to apply, the above examples relate to personal data collected from EU individuals in Southeast Asia.

• Online digital service helping online clothing retailers to find the right dress sizes for their shopperswould require shoppers to share their personal data, which includes height, weight, measurements,body type, favourite brands and preferences.

• Online dating applications that match individuals to each other based on their dating profiles andpreferences and require personal data such as dating preferences, preferred age groups,geographical location etc.

• Online food delivery services which would require users to share their addresses, contact numbers,food preferences and other data.

• Online ride-hailing and ride-sharing services which would require users to share their contactnumbers, pick-up locations and drop-off locations (which usually include home and office addresses)and other data.

As illustrated above, such organisations rely heavily on personal data as business models, and their IPRstrategies are most likely to be most affected by the GDPR.



Who owns the Intellectual Property Rights (IPR) in personal data?

• Copyright and Database rights

o Possible copyright protection of databases in Malaysia

o Legal protection of databases (EU Directive 96/9/EC)

o The database creator is typically the first owner of the database right

o Difficulties may arise in determining ownership of database rights:

o Case Study 1: Database creators may not own the copyright in the database if another entity hadengaged them to provide a service. The entity that engaged the database creator to collect dataand “create” the database is likely to own database right instead.

o Case Study 2: If more than 1 entity engaged the database creator to collect data, there may bemore than 1 owner of the copyright in the database. In such a situation, these entities will jointlyown the database right.

• Existing copyright and trade secrets in personal data collected from EU individuals

o Organisations may monitor and use data taken from EU individuals and IPR may subsist in such resultant data collected. Implied transfer of ownership of any IPR that may subsist in the data taken from data subjects to data controllers.



What type of rights does the GDPR confer on EU data subjects?

• Right to be informed (Articles 13 and 14, Recitals 60, 61 and 62 GDPR)

• Right of access by the data subject (Article 15, Recitals 63 and 63 GDPR)

• Right to rectification (Article 17, Recital 65 GDPR)

• Right to erasure / ‘right to be forgotten’ (Article 17, Recitals 65 and 66 GDPR)

• Right to restrict processing (Article 18, Recital 67 GDPR)

• Right to data portability (Article 20, Recital 68 GDPR)

• Right to object (Article 21, Recitals 69 and 70 GDPR)

• Rights in relation to automated decision making and profiling (Article 22, Recitals 71 and72 GDPR)



How does the GDPR affect IPR owned by individuals/organisations?

1. Protection of Individual’s Right of Access vs Protection of IPR owned byOrganisation

2. Protection of Individual’s Right to Data Portability vs Protection of IPRowned by Organisation

3. Protection of Individual’s Data vs Organisation’s Use of Profiling

4. Protection of Individual’s Data vs Enforcement of IPR




1. Protection of Individual’s Right of Access vs Protection of IPR owned by Organisation

• Article 15 of the GDPR (“Right of access by the data subject”) and Recital 63 of the GDPR(“Right of Access”)• Case Study: If an EU individual who uses Tinder exercises her right of access and requests Tinder to send

her all her data, Tinder would be able to send the Tinder user her personal data, but not information onhow her Tinder matches were personalized as such information could depend on patented algorithmswhich are Tinder’s protected IPR.

• General right of access could be restricted if it adversely affects the rights and freedoms ofothers, including trade secrets and intellectual property rights

• Such IP considerations may limit the information available to an individual seeking toexercise the right of access

• IPR ownership may now be a legal basis for organisations objecting to sharing informationconcerning the organisation’s own IPR.




2. Protection of Individual’s Right to Data Portability vs Protection of IPR owned byOrganisation

• Article 20 of the GDPR and Recital 68 of the GDPR (“Right to data portability”), anextension of Article 15 of the GDPR (“Right of access by the data subject”)

• Where the processing of personal data is carried out by automated means, the datasubject has the right to do the following:

1. Obtain a copy of their electronic personal data from the data controller; and

2. Transmit their personal data from one controller to another, where such transfer istechnically feasible.




2. Protection of Individual’s Right to Data Portability vs Protection of IPR owned byOrganisation

• Case Study: For organisations that rely heavily on personal data of its users as theirbusiness models, such as apparel fitting platforms which help users of online clothingretailers to find their right clothing sizes, personal data such as height, weight,measurements and other personal information form a large part of its business model. Ifsuch organisations are required to transfer such data to other competitors under theGDPR (right of data portability), it would severely affect its business.




3. Protection of Individual’s Data vs Organisation’s Use of Data Profiling

• Data Profiling: Collection and use of personal data to evaluate certain aspects related tothe individual to predict the individual’s behavior, through automated forms of dataprocessing.

• Article 22, Recitals 71 and 72 GDPR (“Automated individual decision-making, includingprofiling”)

• Organisations that use data profiling must meet the necessary requirements under theGDPR, such as:-oObtaining consent of the data subject / show that the service provided largely

depends on data profilingoPersonal data should not be used for purposes incompatible with the purpose for

which the data was originally collectedoPersonal data should not be stored for longer than necessary to fulfil the purpose for

which such data is processed.




4. Protection of Individual’s Data vs Enforcement of IPR

• Owners of IPR may now find it more difficult take action against domain name holders whooperate websites infringing their IPR• Case Study: A well-known French company owns several registered trade marks. Counterfeit products are

sold on a .eu website domain bearing these trade marks. Should this French company wish to launchtrade mark infringement proceedings against the domain name holder, it would be difficult to identifysuch domain name holders under the GDPR.

• GDPR provides individuals with more extensive control over disclosing their personal data

• The EU Directive 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on theenforcement of intellectual property rights still stands and has not been overridden by the GDPR

o In IP infringement proceedings, national courts of EU Member States may order infringers orpersons who have been involved in the production or sale of infringing goods to discloseinformation regarding the origin and distribution networks of such goods.

• A fine balance between data protection and IP protection needs to be drawn.



What are some IPR Strategies EU SMEs in Southeast Asia can take?

• Issues of IPR ownership in databases

• As with all IPR, ownership can be allocated in a contract. Where ownership has notbeen appropriately provided for, organisations should draw up contracts clearly todetermine who has the economic rights to data aggregation / copyright in databases.

• Releasing information to EU individuals who request for access to data or dataportability

• Should an EU individual seek to exercise his or her right of access to data or dataportability, organisations should consider whether any trade secrets or IPR exists insuch information, before releasing such information to the said individual. As part ofthe Terms of Use and/or Privacy Policy, organisations should incorporate clausessetting out the nature of IPR and ownership of such IPR, for clarity.

• When faced with data portability requests, organisations may argue that suchrequests adversely affects trade secrets and intellectual property.



What are some IPR Strategies EU SMEs in Southeast Asia can take?

• Conducting Data Profiling

• Organisations that conduct data profiling should set out clearly in any Terms of Use ontheir website / mobile application that any IPR existing within the information derivedfrom data analytics conducted belong solely to the organisation itself, and that theindividual agrees to transfer any IPR ownership in such data to the organization.

• Enforcing IPR in cases of IP infringement

• In the event of potential IP infringement, it would be more difficult to take actionagainst domain name holders who are individuals in the EU.

• Organisations should note that to file a suit for infringement, the IP in question mustbeen registered (i.e. trade marks and patents).

Q&A



Follow us in Social Media for latest



Twitter

@eumcci

LinkedIn

@eumcci

YouTube

@eumcci

FB

@eumcci• News & Updates• Market Information• Events

www.eumcci.comwww.businessmalaysia.eu

More info:

https://twitter.com/eumcci

https://www.linkedin.com/company/eu-malaysia-chamber-of-commerce-and-industry

https://www.youtube.com/channel/UCyoBpXrMvpcaUg3XAMxOzjw

https://www.facebook.com/eumcci/

https://twitter.com/eumcci

https://www.linkedin.com/company/eu-malaysia-chamber-of-commerce-and-industry

https://www.youtube.com/channel/UCyoBpXrMvpcaUg3XAMxOzjw

https://www.facebook.com/eumcci/

http://www.eumcci.com/

http://www.businessmalaysia.eu/

Before you go…



• First insights on business opportunities in Malaysia;

• Customised tools to European businesses that are keen onestablishing or expanding their business in Malaysia;

• We offer two types of Market Studies to support yourbusiness:

1. Pre-Market Consultation

2. Individual Market Study

Our Business Support team will provide you:

Follow us in Social Media for latest



News

Developments

Projects

Activities

Training materials

South-East Asia IPR SME Helpdesk

@iprASEAN South-East Asia IPR SME Helpdesk

www.yourIPinsider.eu Channel: Helpdesk TVwww.ipr-hub.eu

https://www.facebook.com/pages/South-East-Asia-IPR-SME-Helpdesk/350370585078981

https://www.facebook.com/pages/South-East-Asia-IPR-SME-Helpdesk/350370585078981

https://twitter.com/iprSEAsia

https://twitter.com/iprSEAsia

http://www.youripinsider.eu/

http://www.youripinsider.eu/

“KNOW BEFORE YOU GO. WE ARE HERE TO HELP YOU GROW...”



The South-East Asia IPR SME Helpdesk provides free, confidential, business-focused advice to European Small and Medium Enterprises (SMEs) relating to IPR in South-East-Asia.

To learn about any aspect of intellectual property rights in Vietnam or elsewhere in South East Asia, including

Local partners

Due diligence

IP audits

Or to simply learn about the local landscape and adapt your IP plan accordingly – something which can save you EUR in the long term

Contact us on [email protected]


waiting for the organiser. - ipr-helpdesk · •case study: if an eu individual who uses tinder...

Documents