Our Senior Associate Mr. Terence Lau presented a webinar for The Hong Kong Institute of Chartered Secretaries (“HKICS”) entitled “IPO 101: An Overview of a Listing Project” on 18 November 2020. In this course, Terence offered a detailed explanation of listing criteria as well as suitability for listing. The syllabus dissected IPO projects and included topics such as reorganisation, due diligence, prospectus drafting and share offer. The webinar also gave an overview of the IPO process pre-IPO investment.

Terence specialises in advising listing applicants, sponsors and underwriters in a broad range of corporate finance transactions, including initial public offering on The Stock Exchange of Hong Kong Limited, subsequent share issues, shares placement, rights issue, open offer and convertible bonds. Terence also advises listed issuers on regulatory and compliance matters.

Please contact Mr. Terence Lau for any enquiries or further information.

Mr. Terence Lau (left) and Ms. Polly Wong, Fellow of HKICS (right)

Stevenson, Wong & Co. is honoured to be recognised as a Senior Member by the City University of Hong Kong Foundation (CityU) for our firm’s continuous contribution and support towards the university.

Our firm has been nurturing the future generation of young lawyers by sponsoring academic prizes at local universities since 2010. Our annual fellowship, “Stevenson, Wong & Co. Fellowship 2020/21- LW 4643 Cyber Law Course” , is awarded to one PCLL student who was a full-time student of the Bachelor of Laws with Honours (LLB) in the School of Law and has achieved the highest mark in Cyber Law as part of his/ her LLB degree completed immediately prior to entering the PCLL programme.

On 20 November 2020, our firm’s partner Milly Hung was invited to attend the student award presentation ceremony at The Faculty of Law, The University of Hong Kong (HKU), to present prizes on behalf of Stevenson, Wong & Co.

Our firm’s partner, Ms. Milly Hung (in the middle), presented the Stevenson, Wong & Co. Prizes to Miss. Chan Gee Ting (on the left), awardee of the Prize in Employment Law & Practice and Miss. Ho Ka Hei (on the right), awardee of the Prize in Commercial Dispute Resolution.

Stevenson, Wong & Co. has been nurturing the future generation of young lawyers by sponsoring academic prizes at local universities since 2010. This year, we are honoured to be the HKU sponsor of the prizes for commercial dispute resolution and employment law & practice.

Congratulations to the 2 talented students for their outstanding performances.

Please contact Ms. Milly Hung for more information or enquiries.

Asian Legal Business (ALB) has just released the ranking of the Top 50 largest firms in Asia 2020. Stevenson, Wong & Co. has once again been listed as one of the largest Hong Kong domestic law firms for 5 consecutive years.

Established in 1978, Stevenson, Wong & Co. has more than 170 experienced lawyers and staff. Our aim is to provide clients with innovative and effective solutions for their personal or commercial problems with our local and international expertise. During these unprecedented times, we strive to ensure that communication with and services to our clients remain unaffected whilst balancing the emotional and physical well-being of our staff. We look ahead to 2021 with both caution and optimism as we continue to provide uninterrupted quality legal services to our clients.

Under these unprecedented times, we strive to ensure that communication and our services to clients remain unaffected whilst the emotional and physical well-being of our staff are just as important. As we look ahead to 2021, we will continue to enhance the quality of our services to our clients and all look forward to a better tomorrow.

We would also like to take this opportunity to congratulate our association firm, AllBright Law Offices, for being ranked as the top 4th largest domestic law firms across Asia.

About ALB and Asia’s Top 50

ALB is a leading law journal published by Thomson Reuters and is considered as one of the most influential legal media in Asia. Organised by ALB, Asia Top 50 aims to identify and rank the largest law firms across Asia by their size and number of lawyers.

For the full ranking, please click here.

Please contact Mr. Willy Cheng, Mr. Hank Lo or Ms. Catherine Por for any enquiries or further information.

Our partner and head of SW Private Client Wendy Lam and senior associate Calvin Lo were invited by Manulife Hong Kong to speak at the legacy planning seminars on 11 & 19 November. The webinars successfully attracted an audience of more than 200 agents and high-net-worth clients.

During the webinars, Wendy and Calvin introduced and explained the pros and cons of different legacy planning tools, including wills, trusts, enduring power of attorney and insurance policies. By analysing a legacy dispute of a celebrity, they illustrated the importance of legacy planning and offered solutions to avoid future challenges on the validity of wills and trusts.

Please contact Ms. Wendy Lam for more information or further enquiries.

Apart from our Personal Data (Privacy) Ordinance (“PDPO”), the European Union’s GDPR which takes effect from 25 May 2018 is an important breakthrough in our data privacy legislation having considered its wide geographical application and the severe monetary penalty to be imposed, as shown in a recent Germany’s case that €35.3 million fine was imposed against an international retailer which adopted inappropriate measures in monitoring and processing the personal data of several hundred employees at one of its branch in Nuremberg.

What are the basic principles for processing data under GDPR?

The GDPR holds the controllers legally accountable for their compliance with various principles in lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.[1] For example, if a Hong Kong company has to discharge its duties on integrity and confidentiality, it has to implement and set up appropriate cyber and data security measures, thus, to add in more stringent data security contractual provisions in their contracts with the data processors.

To what extent is a Hong Kong company affected?

The GDPR has an extra-territorial effect. A Hong Kong company may need to comply with the GDPR if it:

1. has no establishment[2] in the EU but offers goods or services to, or monitor the behaviour of individuals in the EU territory; or

2. has an establishment in the EU, where personal data is processed in the context of the activities of the establishment, regardless of whether the data is actually processed within the EU. [3]

Both data controllers and data processors are regulated when they process the personal data collected from the relevant activities.

Positive Examples:

• A Hong Kong online sales website, which uses English as language of instruction, has shipping destination to EU member countries
• A Hong Kong app which provides a location service to tourists from Hong Kong when they are travelling in the EU territory
• A EU group company which shares and transfers data to its HK subsidiary for storage and analysis

However, the processing activity related to offer of goods and services will only be caught when it intentionally targets individuals within the EU territory. If the processing relates to a service that is only offered to individuals outside the EU, but the service is not withdrawn when such individuals enter the EU territory, the related processing will not be subject to the GDPR.[4]

Negative Example:

• A Hong Kong mobile news app which provides daily news updates in Chinese language to the Hong Kong users (who provide Hong Kong mobile number in subscribing for the services). The news update services are not subject to GDPR when the Hong Kong users enter the EU territory.

What are the consequences if a company data practice falls below the GDPR standard?

The administrative fines for contravention of the GDPR consist of two tiers, depending on the types of violations. The lower tier fine can be up to €10 million, or 2% of the total worldwide annual turnover of preceding financial year (in the case of an undertaking), whichever is higher.[5] The upper tier fine can be up to €20 million, or 4% of the total worldwide annual turnover of preceding financial year (in the case of an undertaking), whichever is higher.[6]

Under what circumstances will companies be penalised?

Lower tier fines may be imposed if the company fails to comply with any of the following (non-exhaustive list):

1. obtaining parental consent for processing of children’s personal data;

2. processing personal data anonymously if it is not necessary to identify the data subjects;

3. giving data breach notification;

4. appointing data protection officer; or

5. others.[7]

Upper tier fines may be imposed if the company fails to comply with the following (non-exhaustive list):

1. complying with the basic principles for processing, such as obtaining consent before processing;

2. complying with the data subjects’ rights, such as right to erasure, right to object to processing;

3. transferring personal data to a recipient in a third country through lawful mechanism; or

4. others.[8]

What is the difference between ‘data controllers and data processors’ under GDPR and ‘data users’ under PDPO?

To put it simply, ‘controller’ usually refers to the people or companies which decide on how and for what purpose the personal data will be processed, whereas ‘processor’ refers to the people or companies which process the data on behalf of the controller.[9] A company can act in both capacities.

Meanwhile, ‘data users’ is a general concept used in Hong Kong under the PDPO. It is a collective term which covers both ‘data controllers’ and ‘data processors’ as used in GDPR. While GDPR regulates both controllers and processors, processors are not directly regulated by the PDPO.

Consent is a lawful ground for data processing under GDPR. Is it different from the current practice of obtaining consent in Hong Kong?

In Hong Kong, the practice of customers’ ticking in a consent box is usually relevant to the company’s use of the personal data for direct marketing activities. Consent is not a pre-requisite for the collection of personal data in the first place, but it is required when the data collected will be used for a different purpose.[10]

Under the legal principles briefly mentioned above, several lawful grounds are available for companies to collect and process any personal data. The giving of consent is one of them and is probably the most common ground provided that it must be freely given, specific, informed, and unambiguous.[11]

There are other major corporate measures required under GDPR but not under PDPO

The following (non-exhaustive) measures are necessary in demonstrating compliance with GDPR but are not legally required under the PDPO:-

Data protection officer (“DPO”)

Company, regardless of its size, is required to appoint a DPO if its core activities consist of processing which systematically monitor data subjects on a large scale, such as online tracking, profiling (predictions about individual’s preferences), or processing a large scale of sensitive personal data.

DPO is responsible for monitoring the compliance with GDPR and contacting with the supervisory authority.

Data breach notification and remedial actions

The data controllers are required to give notification to the EU regulators of a data breach without undue delay (and where feasible, no later than 72 hours after having become aware of it), unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

Other major corporate measures include (but not limited to):

• Internal data protection policy
• Data protection impact assessment
• Planned IT system to cover the concept of privacy by design and by default

This article is co-authored by Ms. Milly Hung, Partner of Litigation Department, Mr. Michael Lau, the Associate and Mr. Calvin Lo, the Trainee Solicitor of Stevenson, Wong & Co. Due to the impact of the Covid-19 Pandemic, the potential effects of GDPR to the processing of the staff health data do raise concerns. If you have any problem in relation to this matter, please contact Ms. Milly Hung.

This article is for information purposes only. Its content does not constitute legal advice and should not be treated as such. Stevenson, Wong & Co. will not be liable to you in respect of any special, indirect or consequential loss or damage.