22 | KROLL ONTRACK | Report

Japan, Hong Kong and Singapore are geographically small countries, but each one is an important global economic power: Japan is the third largest economy by GDP and the fourth largest economy by buying power; Hong Kong is a global centre for banking and financial services; Singapore has been ranked as one of the most open and pro-business economies in the world.

However, although the economies of these countries are firmly established, in terms of ediscovery all three countries are very much emerging markets compared to the United States and the United Kingdom. That being said, each year growth in the APAC region continues and the gap between the Western and the Eastern ediscovery markets gets smaller.

What is unique about ediscovery in the APAC region?Of the three discussed, Japan is the most developed ediscovery market in the APAC region. It is the home of some of the world’s largest corporations, such as Nissan, Hitachi and Toyota. Equally, the Japanese marketplace is attractive for foreign companies, and Japan is host to many subsidiaries of leading United States and European Union companies. This global marketplace means that although there is no formal ediscovery requirement in Japanese law, Japanese businesses and subsidiaries based in Japan often involve U.S. and EU-based litigation and regulatory investigations.

In terms of managing ediscovery projects, Japan is unusual in that paper discovery is still used extensively. Information governance is also unpredictable in Japan, with many companies not fully understanding their company’s data architecture.

Singapore is the first country in the APAC region to have opt-in ediscovery guidance written into legislation. The guidelines recommend that ediscovery be used in the following scenarios:

■■ Where the claim or the counterclaim exceeds $1 million;

■■ Where documents discoverable by a party exceed 2,000 pages in aggregate or;

■■ Where documents discoverable in the case or matter are comprised substantially of electronic mail and/or electronic documents.

Although this guide was introduced in 2009, companies and law firms have been slow to adopt ediscovery technology. However, adoption is steadily increasing, especially following several amendments to the guidance in 2012 which give more authority to the court to order that discovery be handled electronically.

Hong Kong is a global centre of finance, with many banks, brokerages, private equity funds and other financial institutions based there. In recent years, financial regulators have been very active in investigating non-compliance and enforcing severe sanctions. For example, in 2014 alone, the Securities and Futures Commissions reported undertaking over 2,000 investigations. The Hong Kong Competition Commission has also been active and is using increasingly sophisticated methods to access electronic data for investigations, including dawn raids and mobile ediscovery technology.

Demand for ediscovery in Hong Kong is driven by this regulatory scrutiny, both in a reactive and proactive

APAC: Ediscovery's Eastern Edge

NEW FRONTIERS IN EDISCOVERY | 23

sense. Companies doing business in Hong Kong are starting to take compliance seriously and are turning to ediscovery providers for assistance with internal compliance audits and dawn raid preparation.

Regarding litigation, Hong Kong has also adopted limited procedures for ediscovery. Known as Practice Direction PDSL 1.2, the purpose of the directive is to provide a framework for ediscovery that encourages parties to be reasonable, proportionate and cost-effective. However, the directive only applies when the claim or counterclaim exceeds HK$8 million and there are at least 10,000 documents to disclose. This means ediscovery is still more commonplace in larger cases.

What are the obstacles to using technology in the discovery of data?Although Japan has no privacy laws preventing data from leaving the country, there are prevailing cultural attitudes that mean companies have a strong preference for data staying in Japan. Despite its global economy and international outlook, Japanese businesses can have a nationalistic attitude toward data leaving the company. In additional to this, employees are also very loyal towards their employers, and ensuring Japanese data stays within Japan until a review is completed makes cooperation easier.

The Japanese language also brings with it some obstacles. Unlike other countries in the APAC region, most business is conducted in the native language rather than in English. This means ediscovery technology must be able to cope with processing Japanese characters and Japanese-speaking forensics experts, ediscovery consultants and document reviewers should be on hand to oversee any projects.

In Singapore, local privacy laws restrict the transfer of sensitive data from Singapore to other countries. Introduced in 2014, the Personal Data Protection Act (PDPA) comprises various rules governing the collection, use, disclosure and care of personal data and aims to regulate the flow of personal data. The PDPA covers personal data stored in electronic and non-electronic forms.

Enforcement of the PDPA is strict and companies found contravening the law may be required to:

■■ Stop collecting, using or disclosing personal data in contravention of the Act;

■■ Destroy personal data collected in contravention of the Act;

■■ Provide access to or correct the personal data; and/or

■■ Pay a financial penalty of an amount not exceeding $1 million.

However, mobile ediscovery technology is proving to be a popular solution that enables companies to process data without violating the PDPA.

In Hong Kong there are no obstacles to using ediscovery technology. Companies are open to using the technology and are actively using it in litigation, regulatory and compliance scenarios.

Who is using ediscovery technology?In Japan, Hong Kong and Singapore, the users of ediscovery technology are largely limited to law firms and solution providers. For countries in less established ediscovery markets, companies rarely have the in-house expertise to manage such technology. Ediscovery solution providers and law firms often collaborate in both the smaller, local litigation as well as for larger cross-border investigations, internal investigations and multi-jurisdictional litigation.

Corporations in these countries have yet to develop in-house solutions, though as mentioned earlier, Hong Kong-based companies are becoming more aware of the need for compliance audits and may, in the future, seek to develop their own solutions.

What data protection and privacy laws are impacting ediscovery?Singapore has the most recent and strictest data protection laws and it is best if personal data does not leave Singapore.

24 | KROLL ONTRACK | Report

Hong Kong does have some data protection rules such as the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (Ordinance) which regulates the collection of personal data, the retention of data and an individual’s access to personal data. Much of the Ordinance relates to direct marketing activities and so is not directly applicable to ediscovery. Crucially, the Ordinance does not currently regulate the transfer of personal data outside of Hong Kong which means law firms and companies have greater choice of technology/vendor.

Japan does not have any notable privacy laws that can affect ediscovery.

What best practices guide ediscovery in the region?In Japan:

■■ Understand a company’s data architecture before beginning a project in order to ensure all the required data is captured. Japanese companies often have sprawling data estates and a lack of knowledge about where data is held.

■■ Ensure all ediscovery professionals are able to speak Japanese to native levels before ediscovery starts.

■■ Research and understand Japanese business culture. Japan has many social mores related to conducting business and misunderstanding these can result in offence, which in turn can halt a project or result in poor working relationships with Japanese clients.

In Singapore:

■■ Understand local data protection laws and how they apply to your case.

■■ Use technology such as privacy filters and mobile ediscovery solutions to ensure compliance.

In Hong Kong:

■■ Prepare your company for dawn raids. In-house counsel need to be ready for regulatory scrutiny.

■■ Think beyond emails and documents when it comes to collecting data. Business in Hong Kong is increasingly conducted via messaging and chat systems such as WeChat and Bloomberg Chat.

■■ Ensure your forensics team is able to collect and extract data from these sources in a defensible manner.