Muzzil Khairat

𝐀 𝐍𝐞𝐰 𝐄𝐫𝐚 𝐟𝐨𝐫 𝐀𝐧𝐭𝐢-𝐂𝐨𝐫𝐫𝐮𝐩𝐭𝐢𝐨𝐧: 𝐔𝐧𝐯𝐞𝐢𝐥𝐢𝐧𝐠 𝐌𝐚𝐥𝐚𝐲𝐬𝐢𝐚'𝐬 𝐍𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐀𝐧𝐭𝐢-𝐂𝐨𝐫𝐫𝐮𝐩𝐭𝐢𝐨𝐧 𝐒𝐭𝐫𝐚𝐭𝐞𝐠𝐲 (𝐍𝐀𝐂𝐒) As Certified Integrity Officers (CeIOs), we are at the forefront of promoting ethical practices and preventing corruption within organisations. The recent launch of Malaysia's National Anti-Corruption Strategy (NACS) on May 7, 2024, signifies a significant step forward in our collective fight against corruption. This article explores the key aspects of the NACS and its potential impact on strengthening Malaysia's anti-corruption landscape. The NACS follows the recently concluded National Anti-Corruption Plan (NACP) 2019-2023. We can expect the NACS to capitalise on the NACP's successes and address areas requiring further focus. The NACS focus on five main strategies: • 𝗘𝗱𝘂𝗰𝗮𝘁𝗶𝗼𝗻: Focus on educating various groups, including children, youth, the public, and private sectors to increase awareness of corruption and its negative impact, and to promote a culture of integrity and ethical conduct. • 𝗣𝘂𝗯𝗹𝗶𝗰 𝗔𝗰𝗰𝗼𝘂𝗻𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆: To strengthen accountability mechanisms and processes such as introduction of Public Procurement Act and enhancing access to information in order to foster a more transparent and accountable public sector that discourages corrupt practices. • 𝗩𝗼𝗶𝗰𝗲: To provide platforms and engagements to include voices from Civil Society Organisations. • 𝗘𝗻𝗳𝗼𝗿𝗰𝗲𝗺𝗲𝗻𝘁: Emphasises the importance of effective legal and enforcement frameworks to deter and punish corruption. • 𝗜𝗻𝗰𝗲𝗻𝘁𝗶𝘃𝗲𝘀: To incentivise ethical behaviour and good governance practices within public and private sectors such as offering tax rebates and reduction, revision of witnesses’ allowance, and incentives to whistleblowers. The NACS presents a renewed opportunity for CeIOs to play a vital role such as: • 𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗲 𝗡𝗔𝗖𝗦 𝗽𝗿𝗶𝗻𝗰𝗶𝗽𝗹𝗲𝘀 𝗶𝗻𝘁𝗼 𝗼𝗿𝗴𝗮𝗻𝗶𝘀𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗽𝗼𝗹𝗶𝗰𝗶𝗲𝘀 𝗮𝗻𝗱 𝗽𝗿𝗼𝗰𝗲𝗱𝘂𝗿𝗲𝘀. • 𝗗𝗲𝘃𝗲𝗹𝗼𝗽 𝗮𝗻𝗱 𝗱𝗲𝗹𝗶𝘃𝗲𝗿 𝗲𝗳𝗳𝗲𝗰𝘁𝗶𝘃𝗲 𝗮𝗻𝘁𝗶-𝗰𝗼𝗿𝗿𝘂𝗽𝘁𝗶𝗼𝗻 𝘁𝗿𝗮𝗶𝗻𝗶𝗻𝗴 𝗽𝗿𝗼𝗴𝗿𝗮𝗺𝘀 𝗳𝗼𝗿 𝗲𝗺𝗽𝗹𝗼𝘆𝗲𝗲𝘀. • 𝗘𝘀𝘁𝗮𝗯𝗹𝗶𝘀𝗵 𝗮𝗻𝗱 𝗺𝗮𝗶𝗻𝘁𝗮𝗶𝗻 𝘀𝗲𝗰𝘂𝗿𝗲 𝗰𝗵𝗮𝗻𝗻𝗲𝗹𝘀 𝗳𝗼𝗿 𝗶𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴. • 𝗖𝗵𝗮𝗺𝗽𝗶𝗼𝗻 𝗮 𝗰𝘂𝗹𝘁𝘂𝗿𝗲 𝗼𝗳 𝗶𝗻𝘁𝗲𝗴𝗿𝗶𝘁𝘆 𝘄𝗶𝘁𝗵𝗶𝗻 𝗼𝘂𝗿 𝗼𝗿𝗴𝗮𝗻𝗶𝘀𝗮𝘁𝗶𝗼𝗻𝘀. The launch of the NACS marks a new chapter in Malaysia's fight against corruption. As CeIOs, we are well-positioned to contribute significantly to the strategy's success. By actively promoting the NACS principles and continuously improving anti-corruption measures within our organizations, we can help create a more ethical and transparent Malaysia. 𝑆𝑜𝑢𝑟𝑐𝑒: ℎ𝑡𝑡𝑝𝑠://𝑤𝑤𝑤.𝑠𝑝𝑟𝑚.𝑔𝑜𝑣.𝑚𝑦/𝑎𝑑𝑚𝑖𝑛/𝑢𝑝𝑙𝑜𝑎𝑑𝑠_𝑝𝑢𝑏𝑙𝑖𝑐𝑎𝑡𝑖𝑜𝑛/𝑠𝑡𝑟𝑎𝑡𝑒𝑔𝑖-𝑝𝑒𝑚𝑏𝑎𝑛𝑡𝑒𝑟𝑎𝑠𝑎𝑛-𝑟𝑎𝑠𝑢𝑎ℎ-𝑛𝑎𝑠𝑖𝑜𝑛𝑎𝑙-2024-2028--𝑒𝑛-08052024.𝑝𝑑𝑓

20

The Malaysian Industrial Court has ruled that secret recordings of meetings can be used as evidence in cases of wrongful dismissal. This decision acknowledges the evolving nature of evidence gathering in the digital age, emphasizing that such recordings, if relevant and not violating privacy laws, can be pivotal in proving the facts of a case. This could significantly impact how evidence is presented in employment disputes moving forward. For more details, you can read the full article below. #WorkplaceRights #LegalUpdate #IRCourt https://lnkd.in/gd9yt-_J

7

PART 4B - The contrast between control measures and alleged systemic corruption seems baffling. In Malaysia, however, the situation is the flexibility that getting the standard certified by an organization is optional, not mandated to any government agencies let alone commercial organizations, though highly encouraged. Arguably, for the following reasons it is not mandated, likewise, the DOJ and the SEC too have not embraced the ISO 37001 standard. Time and financial resources are the grounds for many to avoid getting certified. Implementing the elements in the standard itself by referring to the ISO 37001 is a smart option. The organization both government agencies and commercial organizations perhaps should consider conducting corruption risk assessments (“CRA”) or corruption risk management (“CRM”) which is well spelled out in the Malaysian Standard instrument, MS 2764:2022 as issued by the Department of Standards Malaysia (“DOSM”) and the briery risk assessment (“BRA”) in the standard itself (Section 4.5 on BRA, 6.1 on action to address bribery risk  and Section 6.2 which requires a company’s risk management system has to be: measurable; tailored to the company’s risk profile; monitored; communicated internally and externally; and updated as appropriate.) Beyond CRA, entities should tailor their compliance programs to prevent and mitigate corruption risks. Effective programs require top-level commitment, robust CRM, and clear ABAC policies. Managing third-party and high-risk areas depends on these strong foundations. Compliance efforts must include communication, training, and ongoing monitoring for continuous improvement. Detecting and addressing fraud effectively is also crucial to combating corruption. As with any important compliance guidance program, ISO 37001 is sure to contribute to the overall implementation of effective ethics and robust compliance programs. Proactively contributing to combating bribery can be achieved by an ABMS, which this standard is intended to provide, and through leadership commitment to establishing a culture of integrity, transparency, openness, and compliance. Next Change: Part 5 of 6

3

I am very excitied in taking part of the JCAA Arbitration Days 2024. I will be speaking as a panelist on "GC and Management Insights: Best Practices on Crisis and Dispute Management" today with the esteemed colleagues! Please join if you can. #JCAA #arbitration

28

3 Comments

The Bill to amend the Personal Data Protection Act 2010 was tabled for 1st reading (https://lnkd.in/grdtFdJh). Here's a summary and some thoughts: Biometric Data as Sensitive Data 1) The Bill proposes “biometric data” as sensitive personal data, defined as any personal data resulting from technical processing relating to the physical, physiological or behavioral characteristics of a person.  2) Indeed a wide definition. Would the definition cover CCTV recording of a person? The Minister should consider including a "negative-list", to provide examples of data which would not fall within the definition of "biometric data". As drafting reference, section 3(2) of the Sedition Act has a list of publications which would not be deemed as having seditious tendency. Appointment of Data Protection Officer 3) Data controllers must appoint a DPO. 4) The Bill does not set out the selection criteria or qualifications of the DPO. These would likely be addressed in regulations or guidelines. Issues to consider: (a) Can a foreign person or a person residing outside of Malaysia be appointed a DPO? (b) Can a parent company appoint 1 DPO for multiple subsidiaries? (c) Must the DPO be an employee of the data controller or can the function be outsourced? Data processors subject to the Security Principle  5) Currently, data processors are not subject to the Processing Principles. These obligations are imposed on a data controller. The Bill proposes for data processors to be made subject to the Security Principle.  6) Moving forward, data processors may request for indemnities from data controllers. Some may increase service fees, to cover the new risk exposure and compliance obligations. Data Breach Notification 7) A data controller must notify a data breach, as soon as practicable. 8) Data subjects must also be notified if the breach is likely to cause significant harm. 9) The Bill does not set out the notification timeline or what is meant by “significant harm”, which is likely to be explained in guidelines. Other points The Bill does not include a "right of private action" by data subjects. It also does not provide for any power for the Commissioner to claim monetary compensation for victims of a breach. Such a right would have been useful for data subjects to independently enforce their rights. As it stands, data breaches are enforced as criminal offences, with no remedies to compensate victims. The requirement for certain classes of data controllers to be registered (and the renewal of the registration) should have been removed. The registration serves no clear purpose. For implementation of codes of practice, the Commissioner can designate classes of data controllers, so that they are made subject to the applicable codes of practice.

50

The Book on SINS OF CORRUPTION, credit, and acknowledgment for having divinely authored by respective religious scholars in educating and combatting corruption. Thank you Transparency International-Malaysia as recently launched by the Malaysian Anti-Corruption Commission. I will attempt to summarize the book in the coming days/weeks to further help share the values and teachings of all the main religions and their perspectives against corrupt practices. Credit to TI-M for the below video as my "trailer" for the next "chapters" of this "movie" will be on ABAC as follows: Chapter 1 - from Islamic Perspective Chapter 2 - from Buddhism Wealth Culture Chapter 3 - from Hindu Philosophy Chapter 4 - from the Sikh View Chapter 5 - from Taoism Teachings Standing together in strengthening anticorruption values. #anticorruption

15

4 Comments

Landmark Fine Imposed under Thailand’s Personal Data Protection Act The Personal Data Protection Committee (PDPC) of Thailand’s Ministry of Digital Economy and Society (MDES) has announced the first administrative fine under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). A major private company was fined THB 7 million for noncompliance with specific PDPA requirements, resulting in the unauthorized disclosure of personal data to a call center gang (phone scam fraudsters). Key Findings of Noncompliance The PDPC determined that there were three key violations of specific requirements of the PDPA: - Failure to appoint a data protection officer (DPO): Despite processing personal data for over 100,000 individuals as part of its core operations, the company did not appoint a DPO. - Inadequate security measures: The company lacked the required security measures, leading to a data breach involving a call center gang, causing widespread damage. - Delayed data breach notification: The company did not notify authorities of the data breach within the required timeframe and failed to address the breach promptly, making it impossible to remedy the situation. In addition to the monetary fine, the PDPC, along with the PDPA’s Expert Committee, issued a corrective order requiring the company to undertake the following actions and notify the Office of the PDPC of the relevant correction measures within seven days of receiving the order: - Implement up-to-date security measures: The company must improve its current security measures to prevent future breaches and ensure that the security measures are up-to-date with changing technologies. - Raise awareness of personnel: The company must provide training to relevant personnel to ensure awareness of data compliance and protection practices. This significant administrative action establishes a precedent for addressing data breaches in both governmental and commercial sectors in Thailand. It also confirms the importance of PDPA compliance, particularly the need for robust security measures, timely breach notifications, and the appointment of a designated DPO. The monetary fine highlights the financial and reputational risks tied to noncompliance. Organizations need comprehensive data protection safeguards, not only for regulatory adherence but also for protecting personal data and maintaining public trust. This landmark decision establishes a new standard for data protection and compliance in Thailand. Businesses operating in or with connections to Thailand should reassess their data protection strategies to ensure they meet the latest legal requirements and avoid similar breaches and penalties in the future.

123

2 Comments

FGV Holdings Berhad submits petition to US Customs and Border Protection (CBP) for modification of WRO I led Tay & Partners' ESG Practice Group, as one of FGV Holdings Berhad's legal advisors. FGV Holdings Berhad’s commitment to the three pillars of its Group Sustainability Policy (GSP), which are promoting inclusive economic growth, respecting human rights and protecting the environment has transformed FGV into a responsible and sustainable company that continues to champion the sustainability agenda as part of its mission and vision. https://lnkd.in/gT4cSZJd #ESG #CBP #WRO #UScustoms #malaysia #USA #Environmental #Social #Governance #employmentlaw #industrialrelations #hr #humanresources #humanresource #legal #FGV #sustainability #labourandemployment #labourlaw #petition #labour #labor #palmoil

15

[𝗡𝗲𝘄 𝗔𝗠𝗣 𝗺𝗲𝗱𝗶𝗮𝘁𝗶𝗼𝗻 𝘀𝘂𝗰𝗰𝗲𝘀𝘀] “The parties met for the first time at the mediation and had the opportunity to directly communicate with each other in their own words. The sincere tone of the interaction was in sharp contrast to the typical hardline stance conveyed through the lawyers' correspondence,” shared Ms Sok Ling MOI, who mediated this latest case under the WIPO-Singapore ASEAN Mediation Programme (AMP). With a quick and amicable resolution reached in under 8 hours, both parties enjoyed business continuity as well as significant time and cost savings, as compared to a litigation process that could take up to 2 years.   More businesses are seeing the benefits of mediation, as a pragmatic, flexible path to resolving an IP dispute, and “with malicious intent ruled out and misunderstanding unravelled, the dispute can be cleared for resolution ... like magic”.   Find out how you can tap the AMP to manage your IP disputes at www.ipos.gov.sg/mediation.   More about this latest mediation success here: https://lnkd.in/gSeQhZux

23

Tackling Private Sector Bribery: A Landmark Case in Malaysia The recent enforcement of Malaysia’s anti-bribery laws against Pristine Offshore Sdn Bhd marks a significant step in the fight against corruption in the private sector. The Malaysian Anti-Corruption Commission (MACC) charged the company and its former director, Chew Ben Ben, with bribery to secure an oil exploration subcontract. This case underscores the importance of stringent anti-corruption measures and compliance within corporate governance. In complex legal disputes involving bribery and arbitration, having access to all crucial information can be the key to securing a favorable outcome. Comprehensive intelligence gathering and thorough investigation are essential for uncovering the truth and ensuring justice. #AntiBribery #Arbitration #CorporateGovernance #RiskManagement #Compliance

2

Our Atty. Recolito Ferdinand N. Cantre Jr. is a Finalist in the Data Privacy and Protection Lawyer of the Year Category in the 2024 Asian Legal Business Philippine Law Firm Awards. Atty. Cantre, who heads the Firm’s data privacy practice, spearheaded the review of a multinational client company’s credit review and scoring system, its collection process, and its proposed mobile phone application software updates and identified any potential insufficiency in the physical, operational, and technical protection measures and the risk of potential data breaches in the implementation thereof. Atty. Cantre guided and directed the Firm in the application of data privacy and protection standards laid down under the DPA and other Philippine Data Protection Laws. In the Firm’s advice, special emphasis was placed on the higher standards expected of lending and collection agencies, considering the sensitivity and volume of the personal information and sensitive personal information that it handles. Following the recent issuances of the National Privacy Commission which apply particularly to the lending sector, lending companies in the Philippines, including any individual acting as such, are, by default, personal information controllers (“PICs”) and are thus made accountable as PICs for any data privacy violation done by any of its employees, agents, or engaged third-party processors. Following the advice of the Firm, the company was able to eliminate the risks of non-compliance with and, accordingly, the risks of liability for the hefty fines and other penalties under the DPA and other Philippine Data Protection Laws. Atty. Cantre has done similar comprehensive reviews of the data privacy compliance of clients of the Firm. Prior to joining SL Law, Atty. Cantre was the practice leader on data privacy compliance in his former law firm where he conducted comprehensive data privacy audits of members of several conglomerates and proposed measures to ensure full compliance. Beyond Data Privacy Compliance, Atty. Cantre, a Certified Public Accountant, is the co-head of the Firm's multi-awarded Taxation Practice. He heads the Transfer Pricing Practice, and co-heads the Banking and Financial Services Practice, Corporate Restructuring Practice, Mining and Natural Resources, among other commercial law practice areas. Atty. Cantre obtained his Juris Doctor degree from the University of the Philippines College of Law, graduating in the top quartile of the class of 2010. He is also a Certified Public Accountant, with a degree in Accountancy from the Jose Rizal University and ranking 15th in the May 2005 CPA Board Exams. Prior to law school, Mr. Cantre worked as a CPA in Punongbayan & Araullo (Grant Thornton) one of the Philippines’ Big 5 accounting firms. Straight out of law school, Mr. Cantre cut his teeth in taxation law in the International Tax Services Group of SGV & Co., the Philippines’ largest multidisciplinary professional services firm.

6

My commentary in MalaysiaNow touches on the key importance of FDI policy and how we should navigate the FDI environment to prevent overreliance. FDIs are no doubt an important element in Malaysia's economic growth - and the slew of accommodating policies to attract FDIs into the country has been ongoing in the MADANI government. In particular, our semiconductor industry, one of the biggest in the world, is a result of FDI inflows. However, it is important for the government to ensure that FDI trickles down to the rest of the economy rather than let it dictate the course of the economy. This is because foreign companies often have no interest in building Malaysia's economic resilience. Their focus is profit-driven, potentially leading to extractive practices. Overreliance also made Malaysia vulnerable when the foreign companies pulled out. Thus, I suggest a more balanced approach of encouraging domestic innovation and continuing to strategically attract FDIs for a more sustainable economy. Thanks, AhmadMustakim Zulkifli for approaching me for the comment. Also great to comment alongside thought leaders Amanda Yeo Yan Yin 杨颜殷 and Syed Ahmad Israa' Syed Ibrahim

20

23 Comments

Happening in 15 mins time! If you happen to be in the area, do drop by MBFC Tower 1, #14-02 for a briefing on the impact of the new 𝙋𝙖𝙮𝙢𝙚𝙣𝙩 𝙎𝙚𝙧𝙫𝙞𝙘𝙚𝙨 (𝘼𝙢𝙚𝙣𝙙𝙢𝙚𝙣𝙩) 𝘼𝙘𝙩 𝟮𝟬𝟮𝟭 ("𝙋𝙎𝘼𝘼") and 𝙋𝙖𝙮𝙢𝙚𝙣𝙩 𝙎𝙚𝙧𝙫𝙞𝙘𝙚𝙨 𝙍𝙚𝙜𝙪𝙡𝙖𝙩𝙞𝙤𝙣 (w.e.f. 4 April 2024) on your business. The PSAA expands the current scope of regulated payment services under the 𝙋𝙖𝙮𝙢𝙚𝙣𝙩 𝙎𝙚𝙧𝙫𝙞𝙘𝙚𝙨 𝘼𝙘𝙩 𝟮𝟬𝟭𝟵 (“𝙋𝙎𝘼”) and gives the Monetary Authority of Singapore (MAS) more powers under the PSA to impose consumer protection measures on DPTSPs [PS-G03]: (1) an opt-in regime requiring DPTSPs to obtain express consent from customers to be treated as accredited investors; (2) segregation of customers' assets; (3) implementing robust risk management controls; (4) requirement to make certain disclosures to customers; (5) restrictions on dealing with assets belonging to retail customers. 𝗘𝘅𝗽𝗮𝗻𝗱𝗲𝗱 𝘀𝗰𝗼𝗽𝗲 𝗼𝗳 𝗿𝗲𝗴𝘂𝗹𝗮𝘁𝗲𝗱 𝗽𝗮𝘆𝗺𝗲𝗻𝘁 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀: 👉🏻 custodial services for DPTs 👉🏻 facilitation of transmission and exchange of DPTs 👉🏻 facilitation of cross-border money transfers between different countries (including moneys not received in Singapore) Looking forward to hear from Nizam Ismail and TzeChing Chang on what needs to be done in order for impacted entities to continue their activities while MAS reviews their licensing application. Kudos to Digital Assets Association and Chia Hock Lai 谢福来, CFtP for organising this event.

8

https://lnkd.in/gcCdqD2Z Sharing here our latest take on AI Governance. Still no “laws” on AI systems here in the Philippines but a couple of privacy rules are in place — usually on automated profiling and decision making. (Sound familiar?). Risk-based approaches are here to stay. Thanks Hans R Ong and Gabriel Tabeta for your content contribution.

29

The plaintiff's claim was dismissed (the plaintiff's rights are invalid). This is the 77th revision that has been declared "invalid" by the Tokyo District Court. https://lnkd.in/diWcXNWD https://lnkd.in/dqttnrhx The plaintiff's claim was dismissed (the plaintiff's rights are invalid). This is the 77th revision that has been declared "invalid" by the Tokyo District Court. It is unclear whether the plaintiff Sapiens Co., Ltd., the patent owner, has verified the validity of its patent No. 4,059,802 (image display method). "Validity" means, for example, conducting an "invalidation document investigation" on the company's patent, and being confident that the company's patent is solid even if an "invalidation trial" is filed by a third party such as an interested party. Despite this, Sapiens Co., Ltd. and others believed that the patent granted by the Japan Patent Office was valid and sued the defendant Z Holdings Corporation for patent infringement. However, the Tokyo District Court ruled that "The inventions in question are found to have a reason for invalidation due to lack of inventive step due to invention Otsu 22. The inventions in question are found to be invalid in a patent invalidation trial, so the plaintiffs cannot exercise their right to claim damages against the defendant for infringement of the patent right in question." In the end, the plaintiffs lost the case. As a basis for this, "Otsu 22 Invention" (JP Patent Publication No. 11-232433) is listed as a prior art document. This document was not found at the examination stage of the Japan Patent Office. The IPCC searcher (Takei Kesahiko) presented the examiner with "X Document" (JP Patent Publication No. 11-088866), which does not include the above-mentioned "Otsu 22 Invention" (JP Patent Publication No. 11-232433), and three other "Y Documents". Of these documents, the examiner presented "X Document" (JP Patent Publication No. 11-088866) to the applicant as prior art. After that, the applicant submitted a "Procedural Amendment" and the examiner ultimately made a "Decision to Register". However, the patent owner lost the case in the Tokyo District Court as described above. The root cause of this case is that the Patent Office was unable to find the "Otsu 22 Invention" (JP Patent Publication No. 11-232433) presented by the Tokyo District Court. If only the IPCC searcher (Takei Kesahiko) had found the "Otsu 22 Invention" (JP Patent Publication No. 11-232433). The cause is that the prior art search, especially the [search formula], was not created correctly. The classification ("FI" and "F-term") of the "application information" of this "Otsu 22 Invention" (JP Patent Publication No. 11-232433) is listed on the right side of the publication.

1