OLN

data privacy

APAC Perspectives on Data Privacy Laws: A Globalaw Roundtable Discussion Recap

by

On 25 April 2025, at the Globalaw Asia Pacific Regional Meeting in Osaka, Japan, our Partner and Head of Tax and Private Client, Anna Chan, joined Uday Singh Ahlawat of Ahlawat & Associates (India), Han Sung Kang of DLG Law Corporation (South Korea), Ariel Hung of Stellex Law Firm (Taiwan) and Yusaku Akasaki of Chuo Sogo LPC (Japan) for an insightful roundtable discussion on the evolving landscape of data privacy laws across key APAC jurisdictions.

Globalaw Asia Pacific Roundtable on Data Protection
Globalaw Asia Pacific Roundtable on Data Protection

The recent decade has seen an increase of phishing attacks and data breaches. With the introduction of the new cybersecurity law in Hong Kong which will come into effect next year, there is heightened concerns over data security and rights of data subjects. The roundtable discussion therefore offered a timely forum to visit topics such as obtaining consent from data subjects, protecting the rights of data subjects and data breaches reporting practices, as well as on recent legislative developments in in Hong Kong, India, Japan, South Korea, and Taiwan. This article summarises each of the participants’ inputs in the roundtable discussion, each speaking from their respective jurisdictions, on these topics.

Obtaining consent from data subjects
  • In Hong Kong, a data user must expressly inform the data subject the purpose for which the data is to be used on or before collection of the data. Provision of personal data pursuant to such information by the data subject shall be deemed sufficient consent which is implied. However, new consent from the data subject is required if such personal data shall be used for a new purpose. So far as cross-border transfer is concerned, the Personal Data (Privacy) Ordinance (“PDPO”) provides, among others, that data subject should also consent in writing specifically but this requirement has not come into effect yet.
  • In India, when seeking consent from data principals, it is crucial to sufficiently disclose that their personal information will be transferred to another entity. The details of such third-party entity (to which the data will be transferred) as well as the purpose of such transfer also needs to be disclosed. In the case of cross-border transfer of personal information, the manner of seeking consent from data principals remains the same.
  • In Japan, business operators must clearly outline the purpose of data collection and obtain specific consent for the cross-border transfer of personal information with certain exceptions.
  • In South Korea, informed and voluntary consent is essential for collecting and using personal data, unless a legal exception applies. Also, consent for collection, third-party provision, and cross-border transfers must be clearly distinguished and obtained separately.
  • In Taiwan, organizations must expressly inform data subjects when collecting personal data, detailing the collection purposes, data types, usage scope (duration, geography, territory, and methods), data subject rights, and consequences of non-disclosure, unless exempt by law. When collection involves planning for cross-border transfers, intended overseas jurisdictions should also be specified.

Is there a “right to be forgotten”?
  • In Hong Kong, while there is no express “right to be forgotten”, under the PDPO, data users must ensure personal data is retained only as long as necessary, and generally must take practicable steps to erase the personal data held by them where it is no longer required unless the statutory exemptions apply.
  • In India, there is no clear statutory provision for the “right to be forgotten” but the Indian courts have recognized the “right to be forgotten” in some judicial pronouncements. The Indian judiciary has also attempted to clarify the distinction between “right to be forgotten” and the “right to erasure” in their judicial pronouncements. Further, the forthcoming Digital Personal Data Protection Act (“DPDPA”) will provide for a statutory “right to erasure” (unless the statutory exemptions apply).
  • In Japan, while there is no express “right to be forgotten”, the Act on the Protection of Personal Information (“APPI”) recognises the right of data subjects to correct, add, or delete their personal data only on the ground that the retained personal data is contrary to the fact.
  • In South Korea, data subjects have the rights to access, correct, delete, and suspend the processing of their data, as well as to withdraw consent. While there is no express “right to be forgotten”, it is being increasingly recognised in practice as a separate right from the general deletion right. In common practice, business operators in South Korea often establish a defined retention period and periodically re-request consent.
  • In Taiwan, while there is no explicit “right to be forgotten”, similar protections exist under the Personal Data Protection Act (“PDPA”) through various data subject rights, including rights to access, correct, delete data and demand cessation of data processing and use. In practice, certain Taiwan courts have interpreted constitutional principles of informational self-determination and privacy to support this right, balancing individual rights against public interest when assessing removal requests, thus adapting to emerging digital privacy challenges.

Data breaches reporting practices
  • In Hong Kong, business operators are encouraged to voluntarily report data breaches in accordance with the best practices published by the Office of the Privacy Commissioner for Personal Data. For now, there are no specific criminal penalties for data breaches while civil liabilities may arise from breaches of contract, confidentiality, and negligence. That said, the newly enacted Protection of Critical Infrastructures (Computer Systems) Ordinance, expecting to take effect on 1 January 2026, will require the operators of crucial infrastructures in Hong Kong in the eight industries including energy, information technology, banking and financial services, transportation, telecommunications and broadcasting services and healthcare services to, among others, implement security plans and protocols, and report on security incidents. Failure to comply will result in fines ranging from HK$500,000 to HK$5 million.
  • In India, the forthcoming DPDPA prescribes that data breaches shall be reported to both the Data Protection Board of India and the data principal without delay. Failure on the part of data fiduciaries in providing such a notice could result in severe criminal penalties (as prescribed under the DPDPA).
  • In Japan, in the event of serious data security breaches, business operators are required to notify both the Personal Information Protection Commission (“JPIPC”) and data subjects. The APPI imposes criminal penalties for various improper handling of personal data as well as failure to comply with the JPIPC rectification requests and orders.
  • In South Korea, in the event of any leak involving sensitive personal data, business operators should notify the Korean Personal Information Protection Commission and data subjects within 24 hours of identifying such leak. Criminal penalties are imposed for intentional or severe negligence (e.g. illegal data sales or leaks), alongside with administrative fines, corrective orders, potential suspension of processing and public disclosure.
  • In Taiwan, the PDPA currently mandates that organisations are required to notify affected individuals of data breaches only after the relevant facts have been clarified. Criminal penalties apply for intentional misconduct, with a tiered system of administrative fines for other non-compliance. Notably, proposed amendments to the PDPA announced in March 2025 include heightened reporting requirements, and business operators should monitor these upcoming developments closely.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

ChatGPT and What It Means for You

by

In what seems to have occurred overnight, ChatGPT has become one of the hottest topics of discussions around the world. In its own words, ChatGPT is “an AI-powered chatbot developed by OpenAI, based on the GPT (Generative Pretrained Transformer) language model. It uses deep learning techniques to generate human-like responses to text inputs in a conversational manner.” Open AI was co-founded in 2015 by Elon Musk and Sam Altman and is backed by investors such as Microsoft.

Interest in ChatGPT and its ability to produce human-like responses is what makes ChatGPT so interesting and impressive, not to mention the vast knowledge available to ChatGPT providing users with informed and detailed responses. A quick review of viral stories, you will soon see that many individuals are using ChatGPT to assist in writing messages, writing code, writing academic papers, translating text or speech, researching information and even assisting individuals with day-to-day tasks such as scheduling appointments/meetings, creating a nutrition plan and finding recipes, travel itineraries and even creating content for social media.

Whilst ChatGPT is not currently accessible in Hong Kong, but easily overcome, it is still an important topic to discuss. Thus, whilst ChatGPT is still in its infancy, there is much to be learned as this technology continues to develop. We at OLN believe it is important that both our team and our trusted clients are aware of this developing technology as it becomes an increasingly and widely used AI tool both outside and within the workplace.

1. Will ChatGPT result in redundancy?

One of the most important questions asked is whether the introduction and use of ChatGPT will result in redundancy, with human-held jobs being replaced by ChatGPT. There is no doubt that ChatGPT will replace certain components of human-held jobs, however, what is more likely to occur is that ChatGPT will enhance a lawyer’s skillset and allow him/her to thrive by working alongside ChatGPT. The poignant question to ask is not whether ChatGPT will replace humans and result in redundancy, but rather how can humans use ChatGPT to his/her advantage in the workplace? One of the key advantages of ChatGPT is that it will result in time-saving which in the workforce results in costs-savings. When using ChatGPT, a key takeaway is that the user understands the importance of the question prompt. Asking the correct question will get you the response you want and need and failure to ask the correct question with the key prompts could take ChatGPT down another path.

A quick question directed to ChatGPT about whether redundancy is a risk, ChatGPT will acknowledge its limitations. Whilst efficiency and speed may be gained, human touch and the need for soft skills cannot be replicated by an AI bot. To quote ChatGPT, “this therefore brings forth unprecedented opportunities for lawyers to optimize their skills and service offerings to clients.” Perhaps then, this is an opportune time for lawyers to nurture and embrace the need for soft skills in the workplace and with clients. This can easily be accomplished through regular check-ins, face-to-face meetings and human-to-human telephone calls.

2. What risks should we be aware of?

ChatGPT is an emerging technology and essentially is still in its infancy. Reports in the media state that even Elon Musk, one of the co-founders of OpenAI is saying we must slow down the process as it is still developing and there is much to be learned about this technology. Some countries are even banning ChatGPT so does that mean other countries will follow suit?

One of the key reasons why there is such hesitation with ChatGPT is the issues surrounding privacy. In order for ChatGPT to work properly, users are required to place question prompts into the AI bot. A well-crafted query will result in a more enhanced and detailed response by the ChatGPT. However, many human users may also add in detailed queries which could essentially invade privacy and result in private data being collected, used and accessed by ChatGPT. We have already seen privacy issues come forth with other apps and software such as Tik Tok and the cloud. It is almost guaranteed the same privacy queries and concerns will arise with the growing use of ChatGPT. At OLN, we are committed to privacy and ensuring the privacy of our clients and have created parameters for our staff and colleagues when using ChatGPT such that client information and details are never input into the AI bot.

In addition to privacy concerns, there is also the question of adaptability. At this time, the most recent and up-to-date ChatGPT is ChatGPT 4.0 and can now connect to the worldwide web and therefore has full access to up-to-date information that is currently on the internet. However ChatGPT 4.0 is a paid service, and not generally used yet by the public. ChatGPT version 3.5 is the most widely used version and is not connected to the worldwide web and is only trained with data up to the year 2021. OpenAI claims that the newest version of ChatGPT has “more advanced reasoning skills” but it is still not fully reliable and may “hallucinate” by inventing facts or making reasoning errors. Again, ChatGPT’s experience and adaptability is limited to the internet and cannot be replicated by human experiences. As humans, our brains have the ability to adapt to experiences and senses around us, which AI bots cannot. Thus, this again emphasizes the limitations of ChatGPT as it is not a human brain and cannot adapt as easily as a human.

Finally, whilst ChatGPT’s response to queries may be fast and detailed due to its vast access to knowledge, is it reliable? The responses provided by the AI bot must be verified and checked by readers. It may be tempting for users to trust the information without question, but to do so could be catastrophic if the information is improperly used. This is when human knowledge and expertise will come into play to ensure that the information is certainly not trusted simply because it was provided by ChatGPT. Similar to any information on the web, everything must be checked and verified with the critical thinking of the human mind.

So, what does ChatGPT mean for OLN and our clients? First and foremost, OLN will stay up-to-date on the ever-evolving world of ChatGPT. We are also committed to having continuous discussions about the evolution of ChatGPT. At this time, ChatGPT is simply an evolving technology that we are keeping a close eye on, but have not implemented using at OLN as our services to clients cannot be replicated by AI technology and only through the work and experience offered by our lawyers and support staff. This is not to say that ChatGPT may become an integral part of any law practice, however, at this time the use of ChatGPT is premature at OLN.

Your Call To Action: Now that you have an overview of ChatGPT and some of the key points and risks to consider with this AI technology, it is time for you to take action in your own business and practice. Do not let this pass you by as this is now an opportunity to head up a roundtable discussion with your staff and colleagues on technology that will soon become an integral part of your business. It is important to remain up-to-date on this evolving technology and you now need to consider challenging your staff and colleagues about ChatGPT. Ask your staff why they should not be concerned about being made redundant and seek information from staff on how they will continue to play an invaluable role in your business despite ChatGPT. Most importantly, consider how ChatGPT can be implemented into your business to save time and costs, thus enhancing your overall business and business practice. If you wish to discuss this further with us at OLN, as have several of our other clients, we are happy to discuss this with you as an objective sounding board.