Looking back at 2023, looking forward to 2024: A reflection and outlook of TMT and IP developments

1.   Overview

The pace of technological advancement underwent a step change in the past 12 months as generative AI was launched as a practicable tool for achieving efficiencies across a wide horizon of endeavours (from scientific to the mundane). A starting pistol having been sounded, law and policy makers are considering how best to regulate this new frontier, noting that data and intellectual property laws need to be bent into shape to accommodate these advancements.

In this article, we will look at relevant laws from the position of Hong Kong; we also comment on comparators from other jurisdictions which may inform Hong Kong’s legal and regulatory responses in the coming period.

2.   Data Privacy

2.1  Export out of Mainland China

Exporting personal data out of China remains a significant compliance burden for multinational companies operating in China. To date, we have only seen a handful of PRC organisations (or even multinational companies) that have filed Protection Impact Assessment (PIA) reports and standard contracts for export of personal information. This is perhaps owing to an expectation that the draft relaxation measures announced by CAC on 28 September 2023 (for details, see our previous article: https://www.kwm.com/hk/en/insights/latest-thinking/cross-border-data-transfers-in-china-cac-proposes-important-regulatory-relaxations.html) will come into force soon. When these relaxation measures will come into force is not known (previously hoped to be November 2023 – i.e. before the end of the grace period for making standard contract filings) but this will likely be one of the most anticipated legislative changes in 2024.

Looking further down the year, practical difficulties and uncertainties may arise as CAC filing volumes increase over time. These will need to be ironed out and one could expect the CAC to announce further measures or guidelines – with a view to striking a balance between regulation and personal privacy rights. 

2.2  The Guangdong-Hong Kong-Macao Greater Bay Area (GBA) Standard Contract

Closely related to the previous topic is the GBA standard contract for transfer of personal data (“GBA Standard Contract”). This was announced in December 2023 (for details, see our previous article (in Chinese only): https://www.kwm.com/cn/zh/insights/latest-thinking/guidelines-for-the-implementation-of-standard-contracts-for-cross-border-personal-information-transfer-within-gba.html). The GBA Standard Contract carries significance for economic growth in this region by facilitating transfer of personal data within the GBA. The GBA Standard Contract has three key advantages over the incumbent PIPL standard contract:

• No upper limit to the volume of personal data processed. This means that mandatory CAC security assessment is no longer required even if the existing volume threshold is met.
• Simplification of Protection Impact Assessment (PIA). PIA content requirement is approximately reduced by half. The deleted requirement is typically content that most companies would struggle to complete owing to difficulty or complexity. This opens up the possibility that internal legal and compliance teams can conduct the PIA themselves without engaging professional consultants or external lawyers.
• Simplification of filing procedures. PIA is no longer required to be filed together with the standard contract but should still be conducted within the 3 months prior to filing with regulators (i.e. Guangdong Province CAC and OGCIO) (Office of the Hong Kong Government Chief Information Officer). Given the various simplifications, inspection time by regulators is also reduced from 15 working days to 10 working days to speed up the process.

The GBA Standard Contract could be seen as a first small step towards legal harmonisation of the 3 GBA legal jurisdictions in the area of data privacy. It is expected that more GBA specific legislation will be rolled out in the coming years as GBA economic activity takes off.

3.   Artificial Intelligence (AI)

In February 2023, Time magazine placed a screenshot of a conversation with ChatGPT on its cover, writing that "The AI Arms Race Is Changing Everything" and "The AI Arms Race Is On. Start Worrying". The whole world witnessed a remarkable upsurge in both growth and awareness of generative AI, signifying a significant milestone in its development. This also brought along numerous legal issues.

3.1  Is AI generated content eligible for protection by copyright?

Despite the relatively short existence of generative AI, the issue of whether AI created content is capable of copyright protection has become a subject of intense legal debate.

A central question is the level of human input required in the creation process to secure copyright protection for a work (or content). This is closely tied to two fundamental requirements for copyright protection:

• Authorship: an author is the person or entity that creates a work. Generally, the author is the first owner of the work.
• Originality: it is a requirement that the work must originate from the author.

The specifics of these two requirements vary among jurisdictions. Below is a snapshot of how these requirements have been/ may be applied in the US, UK, China, and Hong Kong in relation to AI generated content.  

United States

In the US, human authorship is a “bedrock” requirement for copyright protection. Recent cases such as “Zarya of the Dawn”[1], “A Recent Entrance to Paradise”[2] and “Théâtre D’opéra Spatial”[3] have seen the District Court for the District of Columbia and the United States Copyright Office (“USCO”) affirmed this requirement.. Notably, the USCO rejected arguments that prompts entered by human users when generating work using Midjourney constitute sufficient human authorship in the cases of “Zarya of the Dawn” and “Théâtre D’opéra Spatial”.

United Kingdom

The UK copyright regime offers a perhaps more modern approach to generative AI works. The Copyright, Designs and Patents Act 1988 (“CDPA”) recognises that where a work “is generated by computer in circumstances such that there is no human author”, the author of the work is “the person by whom the arrangements necessary for the creation of the work are undertaken”[4].

This “arrangement” approach bypasses the human authorship hurdle. However, the question of what exactly constitutes these necessary arrangements in AI-generated works remains uncertain. Should it be the AI system developer or the user who provides the specific prompts?

Further, the originality requirement can still pose challenges. Traditionally, the UK's test for originality is simply that the work is the author's own skill, labour, and effort, which is not copied from others (also known as the “sweat of the brow” test). However, the EU has established in a separate test of “author's own intellectual creation”. This has been interpreted to mean that the work must exhibit creativity through the author’s free choices,  so that the work can be stamped with the author’s “personal touch”.

The EU standard seems to require human input to meet the originality requirement, making it more difficult to afford copyright protection to AI-generated works. It remains to be seen whether the UK courts will apply the EU standard of originality in relation to AI generated work.

China

Interestingly, China provides a contrasting perspective in the case of Li v Liu[5]. In this case, the Beijing Internet Court considered whether a picture generated by Stable Diffusion (another AI image generator) is an intellectual creation of a natural person (the plaintiff in this case). The Court ruled that, by making prompts and setting parameters for the AI and finally selecting the picture, the plaintiff provided sufficient intellectual inputs in the images created.

The court further ruled that although the plaintiff did not physically draw the specific lines, their role in designing character styles, arranging the final layout and composition, and experimenting with different prompt words and technical parameters satisfied the requirement of originality.

Hong Kong

Hong Kong also adopts the "arrangement approach" similar to the UK, whereby the author of AI generated work can be the individual responsible for making the necessary arrangements for its creation. However, as Hong Kong has never been an EU member, legal scholars believe that it is unlikely for the EU standard of originality to change the Hong Kong’s law on originality[6]. It is expected that the UK's "sweat of the brow" test will continue to be applied in Hong Kong.

3.2  AI regulation

In response to the rapid advancements in AI, China, EU and the UK have swiftly taken action to address the emerging challenges and opportunities presented by the new AI epoch.

China's AI regulations stand as the most comprehensive in the word, addressing a wide range of aspects including deep fakes, data privacy in AI development, and the use of generative AI technologies and the handling of training data employed by generative AI models.

EU has agreed on the proposal for the Artificial Intelligence Act (“EU AI Act”)”[7], which will establish a risk-based approach whereby legal intervention is triggered according to the risk level of the AI systems.

A UK White Paper titled “A pro-innovation approach to AI regulation” suggests a proportionate and pro-innovation regulatory framework for AI, which aims to strike a balance between promoting innovation and addressing the risks of AI. A key feature is that existing regulators (such as the regulators responsible for national security or medical care) will play a key role on a non-statutory basis, leveraging their expertise to tailor the application of the principles to specific AI contexts.

In addition, 28 countries including China, USA, EU and the UK signed the Bletchley Declaration on 1 November 2023, agreeing the need to identify and collaboratively manage risks related to AI. The Bletchley Declaration confirmed a multilateral commitment to ensure beneficial, responsible, and safe development and use of AI technologies through setting up a process for global collaboration on frontier AI safety.

4.   Intellectual Property

4.1  Copyright (Amendment) Ordinance 2022

After two unsuccessful attempts to update the Copyright Ordinance (Cap. 528) in 2011 and 2014, the Copyright (Amendment) Ordinance 2022 (“Amendment”) finally came into effect on 1 May 2023.

The following key changes have been introduced to the copyright regime in Hong Kong[8]:

• A new technology-neutral communication right for copyright owners to communicate their works to the public through any mode of electronic transmission;
• Criminal sanctions against infringements relating to the new communication right;
• New copyright exceptions;
• A safe harbour regime to encourage online service providers to cooperate with copyright owners in addressing online piracy and to protect them from liabilities for copyright infringement on their platforms; and
• Two additional statutory factors to consider in determining whether to award additional damages in copyright infringement cases.

Communication Right & Criminal Sanctions

Under the Copyright Ordinance, copyright owners are granted certain exclusive rights, including the right to copy, make copies available to the public, or broadcast their works in a cable programme, to prevent unauthorised dissemination of their works. However, these rights do not necessarily cover electronic transmission (such as streaming), which can occur without involving copying or broadcasting.

To fill this gap, the Amendment has introduced a technology-neutral communication right to the copyright regime, which gives copyright owners the right to communicate or prevent unauthorised communication of their works through any mode of electronic transmission.

In order to enhance the protection of the communication right, the Amendment has included a new criminal offence against acts of infringement of the communication right conducted for profit or to such an extent as to affect prejudicially the copyright owners. The elements and penalties associated with this offence mirror the existing offences against distribution of infringing copies of copyright work to the public under the Copyright Ordinance.

New Copyright Exceptions

In light of the introduction of the communication right and in response to the evolving needs of the digital age, the Amendment has expanded the scope of the copyright exceptions to include the following activities:-

• Communicating certain works or their copies by an educational establishment for certain educational purposes (e.g., giving instructions for distanced learning);
• Temporary reproduction of copyright works by online service providers as part of a technological process for more efficient transmission of the work (e.g., data caching);
• Media shifting of sound recordings for private or domestic use; and
• Fair dealing with copyright works for the purposes of (i) parody, satire, caricature and pastiche, (ii) commenting on current events, and (iii) quotation. 

Safe Harbour

The new safe harbour provisions provide online service providers (OSPs) with protection from liability for copyright infringement occurring on their platforms. To benefit from the safe harbour, OSPs must fulfil certain conditions, including taking reasonable steps to limit or stop infringement when notified by copyright owners and refraining from receiving direct financial benefits directly attributable to the infringement. However, OSPs are not obligated to monitor or identify infringing activities to qualify for the protection.

In February 2023, the Secretary for Commerce and Economic Development published a Code of Practice with guidance and procedures which OSPs may follow after receiving a notification of infringement. You may find the Code of Practice here.

In particular, the Code of Practice set outs a “notice and notice” system and a “notice and take down” system to provide guidelines for OSPs on how to effectively limit or stop copyright infringements. The “notice and notice” system requires OSPs to send a notice to users or subscribers that their account for online services has been identified in connection with an alleged infringement upon receiving a notice from copyright owners. The “notice and take down” system requires OSPs to remove or disable access to infringing materials upon receiving a notice of alleged infringement from copyright owners, and to also notify the users or subscribers of the online services about such removal or takedown of the materials.

Additional damages in copyright infringement cases

To incentivise copyright owners to enforce their rights and deter potential infringement, the Copyright Ordinance already listed three factors for the Court's consideration when determining whether to award additional damages in copyright infringement proceedings. These factors include: the flagrancy of the infringement, benefits gained by the defendant, and the accuracy of the defendant’s business accounts and records.

The Amendment introduced two more factors for the Court’s consideration of additional damages, namely: (a) the unreasonable conduct of an infringer after having been informed of the infringement; and (b) the likelihood of widespread circulation of infringing copies as a result of the infringement.

4.2  Patent Box

In his 2023 Policy Address, the Chief Executive of Hong Kong announced that the Government will introduce a bill in the first half of 2024 to implement the “Patent Box” tax incentive regime to provide tax concessions for qualifying profits sourced in Hong Kong and derived from eligible IP assets created through R&D activities.

The key elements of the proposed Patent Box regime are[9]:

• Concessionary Tax Rate: A reduction in the profits tax rate for qualifying profit (calculated by applying the nexus approach[10] for determining the portion of Eligible IP Income from an Eligible IP asset that can qualify for preferential tax treatment, which is computed based on a nexus ratio of the Eligible Expenditure) from 16.5% to 5%;
• Eligible IP Assets cover patents and other IP assets that are functionally equivalent to patents, such as copyrighted software and plant variety rights[11];
• Eligible IP Income includes:
  • income derived from an Eligible IP Asset in respect of the exhibition or use of, or a right to exhibit or use the asset (whether in or outside Hong Kong), or undertaking to impart, knowledge directly or indirectly connected with the use of the asset (whether in or outside Hong Kong);
  • income arising from the sale of an Eligible IP Asset; and
  • where the sales price of a product or service includes an amount which is attributable to an Eligible IP Asset – such portion of the income from those sales that, on a just and reasonable basis, is attributable to the value of the asset.
• Eligible Expenditure refers to expenditure incurred by taxpayers to develop the Eligible IP Asset. Acquisition costs of the IP asset are specifically excluded.
• Treatment of Losses – A loss incurred in relation to income benefiting from the Patent Box regime can be set off against other taxable profit. However, the loss adjustment will need to take into account the difference in tax rates (e.g., 16.5% standard profits tax rate versus 5% Patent Box tax rate).

The introduction of the Patent Box regime is to be welcomed as this reinforces the Government’s commitment to developing Hong Kong into a regional IP trading centre. Multinational companies should proactively consider registering their inventions in Hong Kong to take advantage of the 5% tax rate on the royalty and other income derived from their inventions.

5.   Cybersecurity

5.1  Will cybersecurity law come to Hong Kong in 2024?

Cybersecurity law plays a crucial role in addressing the challenges and risks associated with the rapidly evolving digital landscape. Hong Kong lags behind many other developed jurisdictions in enacting such law. The prolific hacking incidents involving the Hong Kong Consumer Council, Cyberport and Hongkong Post in 2023 were timely reminders that even the most esteemed of enterprises and institutions may be hacked. The need for a comprehensive set of laws that safeguards critical infrastructure, government systems and national security interests from cyber threats is clear in today's interconnected and digitised world.

Legislative work for cybersecurity was first foreshadowed in the Chief Executive’s 2021 Policy Address. In May 2022, in response to questioning from the Legislative Council the Government said it was considering legislation to clearly define cybersecurity obligations of critical infrastructure operators in Hong Kong. The public was told that a public consultation would be launched end of 2022 but that did not happen. Fast forward to October 2023, again in response to questioning from the Legislative Council the Government said “it is working on the draft legislative framework and soliciting initial views from the industry. The next step is to consult the Panel on Security of the Legislative Council and the public on the legislative proposals”[12].

It is possible that we may see a draft bill or a public consultation exercise in 2024. How cybersecurity law will impact critical infrastructure operators is not exactly known yet but one can expect the Government and the Legislative Council to take into account nearby jurisdictions (such as China and Singapore) when formulating the Hong Kong version of the law.

6.   Conclusion

As we conclude this reflective journey through the developments of 2023 and the anticipation of 2024, we are reminded that the only constant in the legal landscape is change. As we navigate the ever-evolving and increasingly complex regulatory environment, successful businesses tend to be more able to embrace new technologies, leverage the emerging trends, and transform their internal practices to adapt to the future.

We at KWM have a cross-border and multi-disciplinary team here to help you approach 2024 with resilience, armed with the lessons learned and embrace the opportunities that lie ahead.

* For purposes of this article, “Hong Kong” means “Hong Kong Special Administrative Region of the People's Republic of China”, and any reference made to “Mainland China”, “onshore” or “PRC” shall be construed as excluding Hong Kong, Macau Special Administrative Region and Taiwan.