On 9 January 2023, the National Assembly of Vietnam issued Law No. 15/2023/QH15 on Medical Examination and Treatment, which sets out a significant number of new regulations on healthcare and medical activities. The New Law will take effect on 1 January 2024, replacing the current Law No. 40/2009/QH12 on Medical Examination and Treatment dated 23 November 2009.
Australia’s new Register of Foreign Ownership of Australian Assets is expected to commence on 1 July 2023. Expanding on the existing registers for water interests and agricultural or residential land, the new Register will record foreign interests in a broader range of Australian land, entities, businesses and assets, with significant penalties for non-compliance.
Foreign persons who acquire relevant Australian interests, as well as some Australian entities that could become “foreign” due to ownership changes, may need to implement additional compliance processes to ensure they satisfy the new requirements.
On 24 February 2023, the Prime Minister and Minister of Finance, YAB Dato’ Seri Anwar Ibrahim re-tabled the Malaysian Budget 2023 themed “Building Malaysia Madani.” The MADANI Budget is focused on addressing the current economic challenges, inspiring confidence with institutional and governance reforms and facilitating social justice by reducing inequality.
In brief
Change may be upon the horizon for data protection in Malaysia. An effort which started with a public consultation exercise in 2020 to align the Personal Data Protection Act 2010 (“PDPA”) with other data protection laws across the globe, will hopefully, translate into law in 2023 under the new Minister of Communications and Digital.
In this alert, we look back at the proposed changes to the PDPA, the latest developments under the new administration so far and what to expect in the days ahead.
In depth
A look at the recent past
The public consultation paper on the review of the PDPA issued by the Personal Data Protection Department (“JPDP”) in 2020 had identified 22 proposed improvements to the PDPA. In 2022, the then Communications and Multimedia Minister had indicated that certain amendments to the PDPA was due to be tabled with the Malaysian Parliament for approval in October 2022. Some of these include:
The requirement for data users to appoint a data protection officer
Mandatory data breach notification
Data processors being obligated to comply with the security principle under the PDPA
Introduction of data portability
Introduction of blacklisted countries such that transfers of personal data to these countries will be prohibited
(collectively, the “2022 Proposals”).
The dissolution of the Malaysian Parliament on 10 October 2022 and subsequent general election, put this on hold.
Developments in the last 90 days
On 2 December 2022, Fahmi Fadzil became the new Minister of Communications and Digital (“Minister”), with oversight of the JPDP. There has been substantial developments in this space since then, and which we highlight in more detail below.
Introduction of the General Code of Practice of Personal Data Protection (“General CoP”)
The General CoP was issued by the Personal Data Protection Commissioner (“Commissioner”) and took effect from 15 December 2022. The General CoP (which appears to apply to selected classes of data users) introduces new legal requirements to be complied with, including additional mandatory information for inclusion into personal data protection notices, and further seeks to provide best practice recommendations with respect to the implementation of principles under the PDPA and its subsidiary legislation. More information on the General CoP can be found in our previous alert.
Proposed Upgrades to the JPDP and New Cybersecurity Commission
The Minister had announced his plans of turning the JPDP into a statutory department to ensure that it has sufficient resources to tackle among others, personal data leaks and execute its functions more effectively. At present, the JPDP is merely a government department under the Ministry of Communications and Digital (“Ministry”).
There are also plans to establish a Malaysian Cyber Security Commission as a move to strengthen cyber security, with the Ministry working together with related agencies such as CyberSecurity Malaysia to set up such a commission. This proposal is currently still at preliminary stages but may be tabled with the Malaysian Parliament in June 2023.
MoU between Malaysia and Singapore on cooperation in personal data protection, cybersecurity and digital economy
In January 2023, a Memorandum of Understanding (MoU) was signed by Singapore and Malaysia to co-operate on areas of personal data protection, cybersecurity and digital economy. As part of this MoU, the countries agreed to:
An exchange of knowledge and expertise on personal data protection policies and regulations (including monitoring and reduction of cybersecurity incidents)
Facilitate the promotion of cross-border data flows (including to develop and implement the Asean Cross-Border Data Flow Mechanism under the Asean Framework on Digital Data Governance).
Amendments to the PDPA: Redux
These latest developments all provide an indication that the protection of personal data is a key focus of the Minister. Particularly, the Minister had during an interview with a local radio station highlighted that only about 20 companies had been fined for data breaches in the past six years, at RM 24,000 each on average. Lamenting this, the Minister opined on the need to review the laws related to data protection given that data is a national treasure.
Accordingly, the Minister announced that the JPDP is seeking to improve on the 2022 Proposals before tabling a draft bill to amend the PDPA. In addition to the likely retention of the 2022 Proposals, some of the proposed improvements include increasing the amount of fines and penalties against data users found to be misusing data. Timeline wise, the Minister intends to present a draft amendment bill to the PDPA, at the Malaysian Parliament before the end of 2023.
Concluding remarks
With the increasing prevalence of data breaches in Malaysia, the proposals to have an empowered JPDP (with the ability to impose higher fines), alongside a more robust PDPA framework (which requires mandatory data breach notifications), is welcomed. All organisations who process personal data may therefore wish to take pro-active steps to, assess, review and update their existing data processing policies, systems, procedures and processes, against these proposals in anticipation of it being rolled-out in the near future.
* * * * *
This client alert was issued by Wong & Partners, a member firm of Baker McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “partner” means a person who is a partner or equivalent in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
On 31 May 2021, the Personal Data Protection Commission received a complaint that RedMart Limited was collecting images of the physical National Registration Identity Card and other identification documents of suppliers making deliveries to its warehouses.
From 31 January 2023, the Info-Communications Media Development Authority implemented the full SSIR regime. All organizations that use short message service (SMS) with sender identification are required to register their Sender IDs with the Singapore SMS Sender ID Registry. Non-registered SMSes have been labelled as “Likely-SCAM” and will be blocked from later this year. Organizations are encouraged to register their Sender IDs if they have not done so.
In brief
On 10 February 2023, the Government of Vietnam issued the new Decree No. 03/2023/NĐ-CP on regulating the functions, duties, powers and organizational structure of the Vietnam Competition Commission (“Decree 03”). Decree 03 will take effect on 1 April 2023.
Key takeaways
Decree 03 provides the following new key regulations:
The official English name of the authority will be the Vietnam Competition Commission (VCC). Meanwhile, the Vietnamese name is “Uy Ban Canh Tranh Quoc Gia”.
The VCC shall take over the role of the Vietnam Competition and Consumer Authority (VCCA) in the state management of competition matters under the Competition Law once Decree 03 comes into effect.
In depth
Since Competition Law No. 23/2018/QH14 (“Competition Law”) was passed back in 2018, the VCC was mandated as the leading authority responsible for the state management of competition matters under the Competition Law. However, there have been no further developments as to the establishment of this authority until recently, nearly four years after the Competition Law came into effect.
Specifically, on 10 February 2023, the Government of Vietnam issued Decree 03.
The VCC’s organizational structure shall consist of 15 officers, including one president and several vice presidents,1 and the headquarters shall be located in Hanoi.2 Within the VCC’s organizational structure will be the following departments:
Competition investigation agency
Secretariats of councils dealing with competition cases
Competition supervision board
Other units established under the VCC to perform the function of state management of competition, protection of consumers’ interests and management of multi-level marketing activities3
Pursuant to Decree 03, the VCC is tasked with handling competition proceedings in accordance with the Competition Law, controlling economic concentration activities, handling requests for exemptions and appeals of settlement decisions of competition cases, and performing the tasks of state management of competition, protection of consumers’ interests and management of multi-level marketing activities as prescribed by law.4
As for the operation of the current authority, the VCCA, pursuant to Decree No. 96/2022/ND-CP on the functions, tasks, powers and organizational structure of the Ministry of Industry and Trade of Vietnam (MOIT), the VCCA will continue to perform its functions and duties in accordance with current legal regulations until the Government stipulates the functions, tasks, powers and organizational structure of the VCC.5 Accordingly, by operation of law, once Decree 03 has taken effect (i.e., 1 April 2023), the VCCA’s functions shall cease.
Decree 03 shall also supersede Decree No. 07/2015/ND-CP dated 16 January 2015 on the functions, tasks, powers and organizational structure of the previous Vietnam Competition Council (i.e., “Hoi Dong Canh Tranh” in Vietnamese), and Decision No. 24/2015/QD-TTg dated 30 June 2015 of the Prime Minister promulgating the regulation on organization and operation of the Vietnam Competition Council.
Under Decree 03, the VCC shall also be edited into relevant provisions under Decree No. 40/2018/ND-CP on the management of multi-level marketing activities, Decree 99/2011/ND-CP detailing and guiding the implementation of a number of articles of the Law on Protection of Consumer Rights, and Decree 54/2020/ND-CP amending and supplementing a number of articles of Decree No. 127/2015/ND-CP on the organization and operation of inspection activities in the industry and trade sector.
The long-awaited arrival of the VCC also means that we can expect to see more enforcement activities by the competition regulators, not only within the area of merger control, but also the enforcement of regulations on anti-competitive agreements and abuse of market dominance.
The full Vietnamese text of Decree 03 can be found here.
1 Article 4, Decree 03.
2 Article 4, Decree 03.
3 Article 5, Decree 03.
4 Article 2, Decree 03.
5 Article 5, Decree No. 96/2022/ND-CP issued by the government on the functions, tasks, powers and organizational structure of the MOIT, dated 29 November 2022.
The Monetary Authority of Singapore issued the Notice on Business Conduct Requirements for Corporate Finance Advisers on 23 February 2023. This comes around 14 months after the MAS issued the Consultation Paper P020-2021 which proposed to introduce regulatory requirements on the conduct of due diligence by corporate finance advisers, strengthen public confidence and promote informed decision making by investors through quality disclosures.
Indonesia has been in the headlines with its 2022 G-20 presidency from December 2021 through November 2022. During its presidency, Indonesia was supportive of international community tax initiatives such as carbon tax policies and the global minimum tax. Domestically, the Indonesian government introduced tax reforms to update its tax systems and align its tax policies with international standards. In an article published in Tax Notes International, Baker McKenzie’s Ria Muhariastuti and Harizka Rizal discuss the Indonesian government’s efforts to reform its tax policies to meet international standards.
On 7 March 2023, the Chair of the Australian Competition and Consumer Commission, Gina Cass-Gottlieb, announced the ACCC’s compliance and enforcement priorities for 2023/24 and the market studies and advocacy work that the ACCC would continue this year. Ms. Cass-Gottlieb identified a range of industry sectors, as well as specific competition and consumer law issues that will be the focus of the ACCC’s compliance and enforcement activities for 2023/24. Many of these areas continue from last year.