Notes from the IAPP Asia Managing Director, 18 August 2017

Selamat pagi from Singapore! Back on home soil, although still reeling from the lack of sleep that is jet lag. Groan.

The definition of the right to privacy rumbles on through the courts in India. One of the latest submissions suggested that “right to privacy was an elitist concept” and those in need of welfare could perhaps not expect to have such a right. It is a subject that has been wrangled with, in other countries, including the U.S. It will be interesting to learn of the court’s view on this idea. (A nine-judge Constitution bench of the Supreme Court is currently deliberating whether or not Indian citizens have the right to privacy. At the same time, the government has appointed a committee under the chairmanship of retired Supreme Court judge B.N. Srikrishna to formulate a data protection law for the country.)

In Australia, it is the definition of “metadata” that rumbles on. We earlier reported on the possible misuse of the “right” to see telecomms records. This has come to the fore again with the disclosure by the Australian Federal Police that there were 23 disclosures of information from the Federal Police to enforcement agencies in other countries last year, including to China. Two issues at the heart of the controversy are the cost to telcos of retaining the data (which is borne indirectly by the taxpayer since grants of AUD128 million were given by the government to the telcos to assist in this) and the accessing of journalists’ metadata. Permission was granted twice in the last financial year to Western Australia Police to access journalists’ data 33 times without the knowledge of the journalists concerned.

The protection of voter privacy also came under scrutiny in Australia, where the Australian Bureau of Statistics has decided to include personal identifiers on ballot papers for the same-sex marriage postal vote by including bar codes on the papers to identify responses. This has given rise to fears that votes may not be kept secret, while the ABS states that the identifiers are to prevent fraud and multiple voting.

In China, the first reported enforcements were seen under the new Cybersecurity Law, which came into effect 1 June 2017. Local authorities in Shantou and Chongqing brought enforcement actions against information technology companies for violations of the Cybersecurity Law. They involved only warnings and orders to correct the issues; no fines or criminal penalties were imposed. As such, these enforcement actions do not provide much insight into how the Cybersecurity Law will be enforced moving forward. These actions do, however, indicate that enforcement authorities, such as public security agencies and the cyberspace administration agency, have started to consider their roles in enforcing the Cybersecurity Law. More enforcement actions could be expected in future.

Until next time, happy reading.