The International Comparative Legal Guide To: Cybersecurity 2020
Total Page:16
File Type:pdf, Size:1020Kb
International Comparative Legal Guides Cybersecurity 2020 A practical cross-border insight into cybersecurity law Third Edition Featuring contributions from: Advokatfirmaet Thommessen AS Iwata Godo Pearl Cohen Zedek Latzer Baratz Allen & Overy LLP King & Wood Mallesons R&T Asia (Thailand) Limited Boga & Associates Lee & Ko Rajah & Tann Singapore LLP Christopher & Lee Ong Lee and Li, Attorneys-at-Law Ropes & Gray Cliffe Dekker Hofmeyr LEĜA SAMANIEGO LAW Creel, García-Cuéllar, Aiza y Enríquez, S.C. Lesniewski Borkiewicz & Partners (LB&P) Shardul Amarchand Mangaldas & Co. Eversheds Sutherland Maples Group Siqueira Castro – Advogados Faegre Baker Daniels McMillan Sirius Legal G+P Law Firm Mori Hamada & Matsumoto Stehlin & Associés Gikera & Vadgama Advocates Niederer Kraft Frey Ltd. Synch Gouveia Pereira, Costa Freitas & Associados, Nyman Gibson Miralis Sociedade de Advogados, S.P., R.L. ICLG.com ISBN 978-1-83918-005-7 ISSN 2515-4206 Cybersecurity 2020 Published by Third Edition 59 Tanner Street London SE1 3PL United Kingdom +44 207 367 0720 Contributing Editors: www.iclg.com Nigel Parker and Alexandra Rendell Allen & Overy LLP Group Publisher Rory Smith Associate Publisher James Strode Senior Editors Caroline Oakley Rachel Williams Deputy Editor Hollie Parker Creative Director Fraser Allan Printed by Stephens & George Print Group Cover Image www.istockphoto.com Strategic Partners ©2019 Global Legal Group Limited. All rights reserved. Unauthorised reproduction by any means, PEFC Certified digital or analogue, in whole or in part, is strictly forbidden. This product is from sustainably managed forests and controlled sources PEFC/16-33-254 www.pefc.org Disclaimer This publication is for general information purposes only. It does not purport to provide comprehensive full legal or other advice. Global Legal Group Ltd. and the contributors accept no responsibility for losses that may arise from reliance upon information contained in this publication. This publication is intended to give an indication of legal issues upon which you may need advice. Full legal advice should be taken from a qualified professional when dealing with specific situations. Table of Contents Expert Chapters 1 Effective Cyber Diligence – The Importance of Getting it Right Nigel Parker & Alexandra Rendell, Allen & Overy LLP 4 Franchising in a Sea of Data and a Tempest of Legal Change Paul Luehr, Huw Beverley-Smith, Nick Rotchadl & Brian Schnell, Faegre Baker Daniels 11 Why AI is the Future of Cybersecurity Akira Matsuda & Hiroki Fujita, Iwata Godo Country Q&A Chapters 15 Albania 144 Kosovo Boga & Associates: Genc Boga & Armando Bode Boga & Associates: Renata Leka & Delvina Nallbani 21 Australia 150 Malaysia Nyman Gibson Miralis: Dennis Miralis, Phillip Gibson & Christopher & Lee Ong: Deepak Pillai & Yong Shih Han Jasmina Ceic 159 Mexico Creel, García-Cuéllar, Aiza y Enríquez, S.C.: 29 Belgium Sirius Legal: Roeland Lembrechts & Bart Van den Brande Begoña Cancino 37 Brazil 165 Norway Siqueira Castro – Advogados: Advokatfirmaet Thommessen AS: Daniel Pitanga Bastos De Souza & João Daniel Rassi Christopher Sparre-Enger Clausen & Uros Tosinovic 43 Canada 172 Poland McMillan: Lyndsay A. Wasser & Kristen Pennington Lesniewski Borkiewicz & Partners (LB&P): Mateusz Borkiewicz, Grzegorz Lesniewski & 51 China Joanna Szumilo King & Wood Mallesons: Susan Ning & Han Wu 180 Portugal 59 Denmark Gouveia Pereira, Costa Freitas & Associados, Sociedade Synch Advokatpartnerselskab: Niels Dahl-Nielsen & de Advogados, S.P., R.L.: Catarina Costa Ramos Daniel Kiil 186 Singapore 66 England & Wales Rajah & Tann Singapore LLP: Rajesh Sreenivasan, Allen & Overy LLP: Nigel Parker & Alexandra Rendell Justin Lee & Yu Peiyi 75 France 194 South Africa Stehlin & Associés: Frédéric Lecomte & Mélina Charlot Cliffe Dekker Hofmeyr: Fatima Ameer-Mia, Christoff Pienaar & Nikita Kekana 82 Germany Eversheds Sutherland: Dr. Alexander Niethammer & 202 Spain Constantin Herfurth SAMANIEGO LAW: Javier Fernández-Samaniego & Gonzalo Hierro Viéitez 89 Greece G+P Law Firm: Ioannis Giannakakis & Stefanos Vitoratos 208 Sweden Synch Advokat: Anders Hellström & Erik Myrberg 97 India Shardul Amarchand Mangaldas & Co.: 216 Switzerland GV Anand Bhushan, Tejas Karia & Shahana Chatterji Niederer Kraft Frey Ltd.: Clara-Ann Gordon & Dr. András Gurovits 106 Ireland Maples Group: Kevin Harnett 223 Taiwan Lee and Li, Attorneys-at-Law: Ken-Ying Tseng Israel 115 Pearl Cohen Zedek Latzer Baratz: Haim Ravia & 230 Thailand Dotan Hammer R&T Asia (Thailand) Limited: Supawat Srirungruang & Visitsak Arunsuratpakdee 122 Japan Mori Hamada & Matsumoto: Hiromi Hayashi 238 USA Ropes & Gray: Edward R. McNicholas & Kevin J. Angle 130 Kenya Gikera & Vadgama Advocates: Hazel Okoth & 246 Venezuela Stella Ojango LEĜA: Carlos Dominguez & Hildamar Fernandez Korea 137 Lee & Ko: Hwan Kyoung Ko & Kyung Min Son XX ICLG.com Welcome From the Publisher Dear Reader, Welcome to the third edition of The International Comparative Legal Guide to Cybersecurity, published by Global Legal Group. This publication, which is also available at www.iclg.com, provides corporate counsel and international practitioners with comprehensive jurisdiction-by-jurisdiction guidance to cybersecurity laws and regulations around the world. This year, there are three general chapters which provide an overview of key issues affecting cybersecurity, particularly from the perspective of a multi-jurisdictional transaction. The question and answer chapters, which cover 32 jurisdictions in this edition, provide detailed answers to common questions raised by professionals dealing with cybersecurity laws and regulations. As always, this publication has been written by leading cybersecurity lawyers and industry specialists, to whom the editors and publishers are extremely grateful for their invaluable contributions. Global Legal Group would also like to extend special thanks to contributing editors Nigel Parker and Alexandra Rendell of Allen & Overy LLP for their leadership, support and expertise in bringing this project to fruition. Rory Smith Group Publisher Global Legal Group 122 Chapter 18 Japan Japan Mori Hamada & Matsumoto Hiromi Hayashi 1 Criminal Activity year or a fine of up to JPY 500,000 (Article 12). However, if the person committing (c) (Article 5) does not know that the recipient intends to use the identification code for an 1.1 Would any of the following activities constitute a Unauthorized Access, that person is subject to a fine of up to JPY 300,000 (Article 13). criminal offence in your jurisdiction? If so, please provide (B) The Penal Code provides for criminal sanctions on the creation details of the offence, the maximum penalties available, and and provision of Improper Command Records which give any examples of prosecutions in your jurisdiction: improper commands, such as a computer virus, to a computer (fusei shirei denji-teki kiroku). “Improper Command Records” mean (i) electromagnetic records that give a computer an Hacking (i.e. unauthorised access) improper command which causes the computer to be operated As background, there are two main laws criminalising cyber attacks, against the operator’s intention or fail to be operated in accord- namely (A) the Act on the Prohibition of Unauthorized Computer ance with the operator’s intention, and (ii) electromagnetic or UCAL Access (the “ ”), and (B) the Penal Code. other records which describe such improper commands. (A) The UCAL imposes criminal sanctions on any person who Under the Penal Code, any person who creates or provides, makes an Unauthorized Access to a computer (an “Access without any justifiable reason, Improper Command Records, or Controlled Computer”), the access to and operation of which who knowingly infects or attempts to infect a computer with are under the control of an administrator (the “Access Improper Command Records, is subject to imprisonment of up Administrator”). to three years or a fine of up to JPY 500,000 (Article 168-2). An “Unauthorized Access” means any action which operates an Any person who obtains or keeps Improper Command Records Access Controlled Computer by either (i) inputting an for the purpose of implementing such records is subject to identification code (shikibetsu-fugou) (e.g., password and ID) imprisonment of up to two years or a fine of up to JPY 300,000 allocated to a user who is authorised to access the Access (Article 168-3). Controlled Computer (an “Authorized User”), without the In addition, the Penal Code provides for the following additional permission of the Access Administrator or the Authorized User, penalties: or (ii) inputting any information (other than an identification (i) any person who obstructs the business of another by code) or command which enables that person to evade control causing a computer used in the business to be operated (e.g., cyber attack of a security flaw), without the permission of against the operator’s intention, or fail to be operated in the Access Administrator (UCAL, Article 2, Paragraph 4). accordance with the operator’s intention, by (a) damaging The UCAL prohibits the following actions: that computer or any electromagnetic record used by that (a) an Unauthorized Access (Article 3); computer, or (b) giving false information or an improper (b) obtaining the identification code of an Authorized User to command to the computer is subject to imprisonment of make an Unauthorized Access (Article 4); up to five years or a fine of up to JPY 1,000,000 (Article (c) providing the identification code of an Authorized User 234-2); to a third