Graham Greenleaf’s ambitious new book sets itself the task of explaining, comparing, and critiquing Asian data privacy laws. The difficulty of this project is apparent even in the words of the title.
“Asia” is a slippery category in law and politics, so Greenleaf sensibly confines himself to 26 jurisdictions covering most of South, Southeast, and Northeast Asia. Nine major jurisdictions are examined in depth while the rest are surveyed more briefly. (North Korea, whose constitution laughably guarantees its citizens “inviolability of the person and the home and privacy of correspondence”, is summarily treated in three pages as an appendix to the chapter on South Korea.)
The regional and sub-regional focus of the book is one of its strengths. Much of comparative law tends to assume Western norms as a baseline against which “other” jurisdictions are evaluated. Though Greenleaf is guilty of this also by taking the OECD and European norms as the benchmarks, this is defensible as these are the standards by which Asian states often measure themselves. One of his major contributions is the analysis of the interaction between the various jurisdictions and the ways in which they have adapted to and learned from one another’s experiences. Unlike Europe, for example, most of Asia’s data protection laws have not been driven by human rights concerns or regional treaty obligations. Though OECD and EU norms have clearly had an impact, economic interests were more significant. Noting that his book is not a “sociological study”, Greenleaf refers in passing to work that suggests that many Asian countries view privacy protections instrumentally, while their European counterparts view privacy as an intrinsic good. Given the breadth and depth of his analysis, it would have been interesting to develop these ideas further—at least with respect to the data protection laws that have been adopted.
The next term in the book’s title, “data privacy”, is Greenleaf’s preferred term over data protection. As he acknowledges, however, privacy is a contested concept with vague edges—it is telling that even the European Union now barely uses the word “privacy” in its forthcoming General Data Protection Regulation. Data protection is the more common term in legislation, but Greenleaf adopts data privacy to denote a bundle of rights benefiting data subjects. The implicit aim is to defend a human rights based conception of data protection, though this normative project is also not fully developed.
Yet it is “laws” that presents the most difficult challenge. Many of the legal regimes that Greenleaf considers are extremely recent: of the 26 jurisdictions considered, 14 have significant data protection laws—six of which were adopted in the last five years. The remaining 12 countries have more basic protections in place, but across the region there is a significant gap between law in the books and law in action. It is telling that the book’s table of legislation runs to 18 pages while its table of cases runs to four.
The volume is organised around three parts. Greenleaf first sets out the history of data protection laws in Asia, the international norms and institutions that have influenced them, and the standards against which he proposes to assess them.
The comparison of the various laws is divided into three categories, which essentially look at their context, content, and enforcement. Context embraces the applicable national and international laws bearing on privacy. Evaluation of content is based primarily on minimum or “first generation” standards, which trace their origin to European norms but are now embraced by about a hundred data protection laws around the world. Greenleaf suggests that, because more than half of those jurisdictions are non-European, accusations of eurocentrism can be dismissed—though elsewhere he acknowledges that many laws would not have taken the form they have without pressure from the OECD and EU. A tentative alternative thesis is that “common technological problems” might explain the similarity in laws, but this is raised only in passing. He also evaluates the laws based on “second generation” standards that build explicitly upon the 1995 EU Directive—such as minimal collection, data export restrictions, and deletion protocols—denoting these as “European” principles. APEC, interestingly, appears to have generated little traction in relation to its three distinctive principles of preventing harm, choice, and accountability.
A trickier area to benchmark is the enforcement of such standards. Greenleaf considers both the emergence of international standards specific to data protection and more general regulatory theory, in particular responsive regulation. The first approach yields fairly thin gruel. Practice is still evolving and there is no clear international or industry standard of enforcement beyond, arguably, the need to have a data protection authority to oversee implementation, a right to seek compensation when data protection rules are broken, and recourse to the courts to challenge adverse decisions.
Greenleaf puts more hope in responsive regulation. This theory posits a hierarchy of sanctions and a hierarchy of support strategies, as well as a degree of transparency to ensure that stories of success and failures are visible to consumers as well as those being regulated. He uses this to develop a basic test of whether there is a sufficient range of penalties, whether all such penalties are in fact used, and the degree of transparency seen in the regulating body.
Part two surveys the various jurisdictions and makes up the bulk of the book. Each chapter contains a potted history and overview of the legal system in question—significantly adding to the heft of the book, but probably appropriate as a reference point for those interested in a specific territory. The survey is thorough but occasionally raises questions that might have warranted further exploration. Hong Kong, for example, is one of Asia’s most litigious societies and yet provision in its Ordinance for individual lawsuits has seen only one successful and one misconceived claim in 15 years; this is merely noted as “puzzling”. The chapter on China touches on the extremely brief history of constitutional challenges before the Supreme People’s Court, the sole example of which coincidentally concerned privacy. In 2001, an appeal decision held that identity theft for the purposes of gaining entry into a business school programme not only contravened China’s General Principles of the Civil Law but also violated the plaintiff’s constitutional rights. Seven years later, however, the Supreme People’s Court withdrew its decision on the constitutional question without further explanation.
In other areas, the pace of change poses problems. South Korea, for example, is lauded for its innovative and expansive law, yet just before the book would have been going to press it suffered one of the worst data breaches in history, including the theft of personal details of more than half the population. And there is also, inevitably, the occasional error—such as the start of Singapore’s colonial history being offset by a century.
But these are mere quibbles. The thoroughness and rigour of Greenleaf’s analysis is certain to make this the standard reference for some years, aided by the fact of his commitment to ongoing updates through an SSRN page, which already includes updates on Vietnam, China, India, Malaysia, Japan, and Singapore.
The third and final part attempts to draw some larger lessons, such as whether an “Asian privacy standard” is emerging (not really, though its countries are more likely to exempt the public sector from coverage), what can be learned from the approach to enforcement in different Asian jurisdictions (they remain primarily reactive, with few steps being taken towards systemic enforcement), and some speculation as to future directions. In this last section, the fact that Greenleaf completed the work just as Edward Snowden was making his revelations of the surveillance activities of the US National Security Agency may colour the analysis slightly. Though there was, perhaps, a brief hesitation in the move to cloud computing as consumers understood the possibility of NSA surveillance, any concerns appear to have been largely overcome. This is consistent with the history of surveillance by the state, with periodic reaction to scandal skewing public attitudes against surveillance after revelations of abuse—but in favour of still greater surveillance after failure to prevent an attack. Nevertheless, Greenleaf is certainly correct in his assessment that data protection laws (and, perhaps, privacy protections) will continue to strengthen across Asia. Key challenges will lie in the area of regulating data exports, a fundamental challenge posed by the globalized information economy.
In a fast-changing area of research, Graham Greenleaf has provided an invaluable reference work. To those interested in getting up to speed on specific jurisdictions, the survey chapters offer quick but thorough introductions to the laws in place. More importantly, however, his assessment of the various Asian jurisdictions highlights the experimentation and innovation that has characterized legal developments in the last decade or so. Express prohibitions of any disadvantage for refusing to supply more personal data than is needed (South Korea, Singapore), the unbundling of different forms of consent (Malaysia), and the extension of access rights to a portable digital copy of data (Philippines) might not point to the emergence of an “Asian” standard as such, but they do show how data protection laws across Asia have been more than mere legal transplants.
