OLN

OLN Marketing

Cyber Resilience Assessment Framework Introduced for Insurers in Hong Kong

by

Following consultation with the insurance industry, on 11 December 2024 the Insurance Authority published a revised Guideline on Cybersecurity (Revised GL20). It takes effect on 1 January, 2025, introducing a Cyber Resilience Assessment Framework (CRAF or Framework) for insurers.

What Insurers Need to Know

The Framework applies (with limited exceptions) to the authorised insurers in relation to the business they carry on in or from Hong Kong. The provisions do not apply to captive, marine mutual, and special purpose insurers, Lloyd’s and insurers that have ceased underwriting or accepting business and are in run-off. All other provisions of the revised GL20 apply to all authorised insurers except for captive and marine mutual insurers.

The Framework requires insurers to evaluate inherent risk and the maturity of their controls against the prescribed control principles. The Framework’s three step approach is:

– Step One: the insurer conducts an inherent risk assessment.

– Step Two: the insurer conducts a cybersecurity maturity assessment.

– Step Three: the insurer makes a submission to the Insurance Authority on assessment results and proposed remedial measures.

What Insurers Need to Do, Generally

Important aspects of GL 20 require insurers to demonstrate a robust cybersecurity strategy and framework.  The requirements include:

1. Insurer’s board of directors to endorse the cybersecurity strategy and framework (CSF). In doing so it should ensure:

a. There are clearly defined roles and responsibilities including reporting lines and escalation procedures.

b. It should cultivate a strong level of awareness of and commitment to cybersecurity.

c. Risk appetite and tolerances are well defined.

d. This requires a complete risk assessment to identify risks and assess mitigating measures.It has oversight of CSF design and its implementation and effectiveness.

e. Where a designated management team of appropriately qualified individuals are tasked to assist the board, both board and team need to ensure the CSF is updated continuously.

2. Insurers are to include objectives and staff and system user competencies in the CSF, implement continuous monitoring and review the CSF periodically – annually, or more frequently if a material event occurs such as an incident or new system deployment.

3. Insurers are to have a well-developed cybersecurity incident response plan.

What insurers need to do regarding the Framework

Important actions to be implemented by insurers under CRAF include:

1. Conduct assessments:

a. An inherent risk assessment is to be conducted in accordance with the Inherent Risk Assessment Matrix. This is designed to identify the insurer’s rating on a three-tiered system:

i. High – extensive adoption of technologies over numerous delivery channels

ii. Medium – adoption of some complex new technologies

iii. Low or not applicable if appropriate – few emerging technologies are adopted

b. A cybersecurity maturity assessment is to be conducted in accordance with the Cybersecurity Maturity Assessment Matrix – having regard to Governance, Identification, Protection, Detection, Response and Recovery, Situational Awareness and Third-Party Risk Management. If an insurer wishes to adopt an alternative cybersecurity assessment framework, for example, the framework adopted by the organisation elsewhere or a framework previously used, it must be comparable to the Framework and meet all required conditions.

2. Make appointments:

a. an Assessor is to be appointed, with appropriate skills and qualifications (having regard to the inherent risk rating). When assessing cybersecurity controls, the Assessor should determine the sampling size and approach, taking a risk-based approach. Samples may be limited to the preceding 6 months if the assessment is being conducted for the first time. Otherwise, a 12 months period should be used.

b. If necessary, a Validator with the prescribed qualifications, is to be appointed.

3. Make submissions to the Insurance Authority:

a. For insurers with a high inherent risk rating the results of their assessments are to be submitted within 12 months from the effective date of CRAF.

b. For insurers with a low or medium inherent risk rating the results of their assessments are to be submitted within 18 months from the effective date of CRAF.

Thereafter, submissions are to be made at least every three years or more frequently (annually) or upon a major change to business or technologies.

4. Ensure the insurer’s Chief Executive or a senior officer (i.e. a key persons in control function) and the Assessor and/or Validator responsible for conducting Assessment review and approve the assessment.

Conclusion:

The insurance industry faces significant cyber risk as a first party issue, in its supply chain and in its insurance portfolios. GL20 is a valuable tool for insurers to measure, implement and enhance their cyber governance, systems, controls and resilience on a continuous basis.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

From Claims to Chains: The High Price of Overstating Your Losses in a Statement of Damages

by

Introduction

In personal injury claims, the plaintiff is required to sign a statement of truth to verify the truth of the facts stated in a Statement of Damages. The potential consequences of overstating one’s losses are highlighted in the case of Zurich Insurance Company Limited v Chan Man Fu [2024] HKDC 1615.

Background

This case revolves around a committal application by an insurance company against a plaintiff in the underlying personal injury proceedings.

The respondent, Chan Man Fu, was involved in a traffic accident on 12 November 2018. Following the accident, Chan filed a personal injury claim against another driver whose motor insurer was the applicant in this case. At the time of the accident, Chan was represented by T.S. Tong & Co., with Tam as the handling solicitor, appointed by the Legal Aid Department.

Under the Statement of Damages dated 13 October 2022, Chan claimed a monthly income of HK$45,000 which includes his alleged earnings from two jobs: a freelance job at a cemetery and a part-time taxi driver job. The total amount of pre-judgment and post-judgment loss of earnings claimed by Chan come up to more than HK$5 million. The Statement of Damages included a statement of truth translated by Tam and signed by the respondent before Tam, confirming the accuracy and truthfulness of the information provided.

Key Evidence Suggested Chan Had No Income

Contrary to Chan’s declared income in the Statement of Damages, various documents disclosed by Chan during the personal injury proceedings revealed that Chan had no income at all during the relevant period:-

  1. An Annual Statement of Earnings and Property Acquired dated 3 November 2018 (which was only nine days prior to the traffic accident) as signed by Chan, showed Chan had declared no income, listing only Comprehensive Social Security Assistance (CSSA) of HK$8,678;
  2. In the Annual Statement of Earnings and Property Acquired filed for the period of 3 October 2018 to 3 October 2019, Chan also declared no income other than CSSA of HK$8,928;
  3. In an application for the Traffic Accident Victims Assistance Scheme submitted by Chan himself in April 2019, Chan described himself as a self-employed taxi driver who was only familiarizing himself with the roads and had not taken any order or earned any income.

In face of the overwhelming evidence that Chan was lying about his income, Chan attempted to shift the blame on his solicitors by alleging that there was misunderstanding between him and his solicitors in that the income stated in the Statement of Damages was only referring to his potential income and not his actual income at the time of the accident. Chan also alleged that he was asked to sign the statement of truth (which Chan alleged Tam for claiming it was in draft form) first before the solicitors had explained the importance of the statement of truth and consequences of giving false statement (which Chan admitted was at least done after the signed the document). Chan also said that when he told Tam some statements in the Statement of Damages were incorrect, Tam allegedly said, “it does not matter, we can revise it [the Statement of Damages] later.”

The court finds Chan’s explanation implausible, as Chan did not insist on correcting the Statement of Damages even after being told about the serious consequences that can following the making of false statement. This remained the case long after the Statement of Damages is filed. Chan also failed to summon Tam to give evidence at the hearing nor adduce any evidence from Tam in support of his account of events.

Judgment

After considering the evidence above, the District Court Judge found Chan guilty of making false statements in his Statement of Damages. The court stressed that the evidence overwhelmingly demonstrated that Chan had knowingly or recklessly made false declarations about his income. The judge highlighted that Chan’s actions were a blatant attempt to mislead the court and secure financial benefits fraudulently.

Chan was eventually sentenced to 21 days of imprisonment for contempt of court. Additionally, he was ordered to pay the costs of the applicant on an indemnity basis, with counsel certificate.

Key Takeaways

This case highlights two key reminders in respect of signing of statements of truth in legal documents:

  1. Honesty is Paramount: Claimants must provide truthful information in legal declarations. False statements can lead to severe legal consequences, including imprisonment, penalties, and adverse legal costs orders.
  2. Verification of Claims: Before signing statements of truth, claimants should ensure that all claims and damages sought are accurate and supported by concrete evidence. Even if they are legally represented, claimants are ultimately responsible for the information they provide. They should fully understand the contents and implications of any legal documents before signing.

The case of Zurich Insurance Company Limited v Chan Man Fu underscores the critical importance of honesty and evidence in personal injury claims. Claimants must be diligent in ensuring the accuracy of their statements and be prepared to substantiate their claims with verifiable evidence. This case serves as a stark warning that the legal consequences of making false statements can be dire and far-reaching, affecting not the claimant’s chance of success in a personal injury action but also his potential exposure to imprisonment and monetary.

Should you have any questions, please feel free to contact us.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

What You Need to Know before commencing Personal Injuries Action – Importance of Compliance with Pre-Action Protocol in Practice Direction 18.1

by

Introduction

Before parties commence a personal injury proceedings in the Court, parties are required to adhere to, amongst others, the Pre-Action Protocol in Practice Direction 18.1 (“PD 18.1”). The importance of abiding to the Pre-Action Protocol is highlighted in the decision of Mak Shiu Cheung v Luk Man Tai [2023] HKDC 1801.

Facts of the case

This case concerns a traffic accident case, the facts of which are straightforward: the vehicle that the Plaintiff drove on was hit by the Defendant’s vehicle and the Plaintiff sustained personal injuries as a result.  

On 2 May 2023, the Plaintiff’s solicitors issued a Letter of Claim as per PD 18.1 to the Defendant (“Letter of Claim”). However, the Letter of Claim (1) did not disclose the fact that there has been an Employees’ Compensation Action already commenced on behalf of the Plaintiff in respect of the accident; and (2) did not disclose documents relating to the issue of quantum such as medical reports and records as well as the Plaintiff’s earning records such as payrolls and tax returns.

The Defendant replied to the Letter of Claim on 11 May 2023, which was within one month after the Letter of Claim was sent to the Defendant. In the reply letter, the Defendant requested for documents and information such as the Plaintiff’s payroll records and all documents related to the Employees’ Compensation Action (“Reply Letter”).

The Plaintiff’s Solicitors did not respond to the Reply Letter and instead commenced the proceedings by issuing the Writ, filing and serving the Statement of Claim and Statement of Damages around 3.5 months later on 22 August 2023.

The Defendant took out a Summons on 7 September 2023 (the “Summons”), asking for:-

  • Stay of proceedings of 3 months from the date of order (“Issue 1”);
  • Plaintiff to make discovery of documents to the Defendant as required under paragraph 66 of PD 18.1 and the Reply Letter and comply with PD 18.1 as to constructive communication and engagement of a single joint expert (“Issue 2”);
  • Plaintiff to be disallowed of the costs of preparation of the Statement of Claim and Statement of Damages (“Issue 3”); and
  • Costs of the present application be to the Defendant (“Issue 4”).

Ruling of the Court

There is no dispute as to Issue 1 and Issue 3 as the Plaintiff conceded and agreed to waive the costs for the preparation of the Statement of Claim and Statement of Damages and to stay the proceedings for a period of 3 months.

The real dispute is on Issue 2 and Issue 4.

Regarding Issue 2, the Plaintiff argued that it was not necessary to take out the Summons and that the Plaintiff had to commence a legal proceedings because, amongst others, the Defendant failed to give a constructive reply in their Reply Letter as to whether the insurer of the Defendant will admit liability and whether there will be third party which may be at fault and that the Plaintiff would be time-barred if the legal proceedings was not commenced.

The Court found for the Defendant, stating that:-

  • The Plaintiff failed to contain all the basic information and documents specified in PD 18.1 in his Letter of Claim, particularly there is a lack of particulars regarding the Employees’ Compensation Action and failure to disclose the relevant quantum documents;
  • The Plaintiff’s solicitors is the solicitors on record for both the Personal Injuries Action and Employees’ Compensation Action and therefore this is not a case where the Plaintiff does not have knowledge on the Employees’ Compensation Action;
  • This is not a case where the Plaintiff was unaware of the existence of quantum documents such as medical reports and records and income proof as these documents were filed in the list of documents in the Employees’ Compensation Action prior to the issuance of the Letter of Claim of the Personal Injuries Action;
  • This is also not a case where such quantum documents can be obtained by the Defendant by other means;
  • Admission of liability is not a prerequisite for an initial reply to be amounted to a “constructive reply”;
  • The current proceedings most likely could have been avoided if the Plaintiff had complied with the Pre-Action Protocol; and
  • Even so, the Plaintiff failed to comply with PD 18.1 as it had not served the Writ and Statement of Claim along with other documents such as statement of facts and finding of guilt, documents on post-accident earnings, pre-accident earnings, statement by the Plaintiff and other eye-witnesses when they were available and were not served under the Pre-Action Protocol.

The Court repeatedly emphasized that the importance of strict compliance to the Pre-Action Protocol in PD 18.1. The rationale behind the Pre-Action Protocol in PD 18.1 is to encourage early settlement of the matter in order to save time and costs for parties and the Court. The burden lies with the Plaintiff to include and disclose the basic information and documents specified in Appendix A and Schedule A of PD 18.1. The Court highlighted that any half-hearted and half-baked attempt to purportedly comply with the Pre-Action Protocol would not be tolerated by the Court and a simple “oversight” will not generally be accepted. Any unnecessary costs incurred or wasted would result in adverse cost consequences and even a wasted costs order (i.e. an adverse costs order made to penalize a party’s improper conduct).

As to costs (Issue 4), the Court suggested that the Defendant had good grounds to ask for a wasted costs order against the Plaintiff or Plaintiff’s solicitors and costs on an indemnity basis. However, in view of Defendant’s concession, the Court only ordered for a disallowance of costs on the Plaintiff for preparation of the Statement of Claim and Statement of Damages and the costs of and occasioned by the application be to the Defendant on a party-and-party basis.

Key Takeaways

In a personal injury claim, the plaintiff is required to adhere and ensure compliance to the Pre-Action Protocol in PD 18.1 to provide the requested documents and information to the defendant to facilitate the defendant’s investigation to the matter and for achieving early settlement between the parties. Failure to comply with the Pre-Action Protocol would lead to costs consequence and even a wasted costs order.

Should you have any questions, please feel free to contact us.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

Assisted Reproductive Technology Laws in Hong Kong

by

Due to advances in reproductive medicine, women in their 40s and beyond are now able to give birth to healthy babies. Although controversial, it was reported in 2005 that a 66 year old Romanian woman had given birth to a healthy baby girl through in-vitro fertilisation (IVF).

Assisted reproductive technologies have significantly improved the ability for older women to become pregnant and successfully deliver live babies. The US Centers for Disease Control and Prevention defines assisted reproductive technology as “all fertility treatments in which either eggs or embryos are handled”. This year, the world’s first “test tube” baby born via IVF, Louise Brown, celebrates her 46th birthday. In Hong Kong, the first reported successful birth via IVF was reported in 1986.

Egg freezing

It has been estimated that females are born with a finite, lifetime supply of approximately one million oocytes (immature eggs) which decrease in quality and quantity beyond the mid 20s, when peak fertility has been observed. Freezing high quality eggs during the prime childbearing years for later use is now considered practical when one is not ready to become pregnant.

Egg freezing has become more popular in recent years, particularly in the pandemic and post pandemic era. TIME Magazine surveyed a fertility practice with over 50 clinics in the US and it reported a 50% increase in the number of women freezing their eggs between 2019 and 2021.

In Hong Kong, there are no age or marital status restrictions on women who wish to freeze their eggs. Frozen oocytes (i.e., eggs) can be stored for up to 10 years, and since women are advised to freeze their eggs before the age of 35 due to declining egg quality, this storage limit tries to cap potential pregnancies at age 45.

The public healthcare system offers women suffering from cancer under the age of 35 years with egg freezing services if they have not had chemo or radiotherapy, demonstrate adequate follicle count upon pelvic scanning and have a greater than 50% predicted survival rate post cancer treatment. The costs of egg storage still need to be borne by the patient.

In most other instances, the total costs of egg freezing must be funded by patients, either out-of-pocket, through private insurance, or a combination of both.

IVF

When a patient is ready for pregnancy, her oocytes may be harvested or thawed and then used in IVF, described by the Mayo Clinic as a process whereby “…eggs are collected… and fertilised by sperm in a lab. Then a procedure is done to place one or more of the fertilised eggs, called embryos, in a uterus, which is where babies develop.”

Unfortunately, a woman must be legally married in a monogamous relationship to have her eggs fertilised using IVF pursuant to the Hong Kong Code of Practice on Reproductive Technology & Embryo Research (the Code). Since same sex marriage is not yet legally recognised in Hong Kong, couples in same sex marriages and single women are not yet able to access post egg freezing services leading to live pregnancies. Appendix IV of the Code does allow for the transfer of eggs outside of Hong Kong to an IVF centre licensed or established according to the laws where the centre is situated. Section 4 of the Human Reproductive Technology Ordinance established the Council on Human Reproductive Technology, which oversees the 2002 Code.

Three public hospitals are able to provide public IVF services to a couple where the wife is a Hong Kong permanent resident under the age of 40 years with no biological children. The waiting period for the initial IVF appointment could be up to three years and patients still need to pay out-of-pocket for medication, certain procedures and embryo storage (if applicable).

Surrogacy

Through IVF, a woman can serve as a surrogate in Hong Kong, carrying an embryo through to childbirth, but only for a couple in a legally recognised marriage, again ruling out same sex couples. Commercial surrogacy (i.e., receiving monetary payment) is prohibited pursuant to section 17 of the Human Reproductive Technology Ordinance and therefore only altruistic surrogacy is allowed. Furthermore, section 18 of the Human Reproductive Technology Ordinance goes on to state that surrogacy agreements are not enforceable so altruistic arrangements may ultimately be rescinded by either party to a surrogacy agreement.

Pursuant to Chapter XII of the Code, a multi disciplinary team must provide a commissioning couple and the surrogate mother (and her husband if applicable) with counseling so the parties are able to understand the ethical, legal, medical, moral and social implications of the surrogacy arrangement. The counseling team must consist of two registered medical practitioners, a legal professional, a social worker and/or a clinical psychologist. Recommendations on the surrogacy arrangement including the reasons and details for the surrogacy must be recorded by the multi disciplinary team.

Hong Kong legal framework for assisted reproductive technology

Hong Kong’s legal framework illustrates the complex intersection between restrictive marriage laws and reproductive rights in Hong Kong.

By 2023, Hong Kong’s fertility rate had plummeted to 0.75, one of the lowest in the world. The reasons have been attributed to, amongst other factors, health conditions, a society inhospitable to child rearing, desire to have freedom, fear of financial burdens and responsibilities, career ambitions, lack of childcare options, short parental leaves, an overly competitive schooling system and/or lack of a suitable co-parent.

It may be time to review and update the laws in relation to assisted reproductive technology in order to help support higher fertility rates in the HKSAR, enabling more women to successfully give birth.

Disclaimer: This article is for reference only. Nothing herein shall be construed as Hong Kong legal advice or any legal advice for that matter to any person. Oldham, Li & Nie shall not be held liable for any loss and/or damage incurred by any person acting as a result of the materials contained in this article.

Oldham, Li & Nie Named Hong Kong Law Firm of the Year at Asialaw Awards 2024 

by

Oldham, Li & Nie has been honoured with the prestigious title of Hong Kong SAR Law Firm of the Year 2024, the top jurisdictional accolade, at the Asialaw Awards 2024. The awards ceremony took place on 26 September 2024, at JW Marriott Hotel in Kuala Lumpur.  

In addition, our Partner and the head of Private Client and Tax departments, Anna Chan, has been awarded the Client Choice Award and named Hong Kong SAR Lawyer of the Year, further underscoring the excellence of our Private Client and Tax teams. 

Asialaw Awards Winner 2024

About Asialaw awards 

Asialaw, one of the leading legal directories, not only provides comprehensive legal rankings, but also celebrates outstanding achievements through its annual awards, recognising the best law firms, individuals and deals across Asia. 

For 2024, Asialaw honoured legal excellence across 20 jurisdictions in Asia, celebrating work in 28 practice areas and industry sectors during the 2023-2024 eligibility period. The selection process is based on rigorous in-house research and feedback from clients and legal industry experts. 

For more information on the Asialaw Awards 2024, including the full shortlist and list of winners, please visit the Asialaw website. 

OLN is Featured as Highly Recommended Law Firm in the Asialaw 2024 Profiles

by

We are pleased to announce that Oldham, Li & Nie has been again ‘Highly recommended’ by asialaw.

asialaw have ranked Oldham, Li & Nie for the following practice areas:

  • Dispute Resolution – Highly recommended
  • Intellectual Property – Highly Recommended
  • Corporate and M&A – Recommended
  • Labour & Employment – Recommended
  • Private Client – Notable
  • Restructuring and Insolvency – Notable

Additionally, Oldham, Li & Nie has been recommended in the following industry sectors:

  • Insurance – Recommended
  • Technology and Telecommunications – Recommended

Oldham, Li & Nie’s partners have also received 5 recognitions in their respective practice areas:

  • Gordon Oldham is recognised as a Senior Statesman in Dispute Resolution
  • Richard Healy is recognised as a Notable Practitioner in Dispute Resolution
  • Tracy Yip is recognised as a Distinguished Practitioner in Corporate and M&A
  • Vera Sung is recognised as a Distinguished Practitioner in Intellectual Property
  • Anna Chan is recognised as a Rising Star in Tax and Private Client

For more information and detailed analysis, please visit Oldham, Li & Nie’s profile on asialaw: https://www.asialaw.com/Firm/oldham-li-nie-hong-kong-sar/Profile/1112#profile

OLN has also been shortlisted in two categories for asialaw awards 2024:

  • Oldham, Li & Nie – Hong Kong Law Firm of the Year
  • Anna Chan – Hong Kong Female Lawyer of the Year

About asialaw

asialaw is the only legal directory featuring comprehensive analysis on Asia’s regional and domestic firms, and leading lawyers from the region.

In addition to the asialaw rankings guide, the directory publishes awards shortlists and winners recognising the best firms in Asia.

More information about asialaw, please visit https://www.asialaw.com/