Love.Law.Robots. by Ang Hou Fu

law

Large language models like #ChatGPT present a unique opportunity to train #lawyers in new ways. I discuss a simple courtroom #simulator I created that is able to mimic the cuts and thrusts of advocacy, and wonder whether anyone will use it.

A cockpit with many lights; Photo by <a href="https://unsplash.com/@jojoblenke?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Johannes Blenke</a> on <a href="https://unsplash.com/photos/WknOx0jEMQE">Unsplash</a>

Read more...

Feature image

If you’re interested in technology, you will confront this question at some point: should I learn to code?

For many people, including lawyers, coding is something you can ignore without serious consequences. I don’t understand how my microwave oven works, but that will not stop me from using it. Attending that briefing and asking the product guys good questions is probably enough for most lawyers to do your work.

The truth, though, is that life is so much more. In the foreword of the book “Law and Technology in Singapore”, Chief Justice Sundaresh Menon remarked that technology today “permeates, interfaces with, and underpins all aspects of the legal system, and indeed, of society”.

I felt that myself during the pandemic when I had to rely on my familiarity with technology to get work done. Coincidentally, I also implemented my docassemble project at work, using technology to generate contracts 24/7. I needed all my coding skills to whip up the program and provide the cloud infrastructure to run it without supervision. It’s fast, easy to use and avoids many problems associated with do-it-yourself templates. I got my promotion and respect at work.

If you’re convinced that you need to code, the rest of this post contains tips on juggling coding and lawyering. They are based on my personal experiences, so I am also interested in how you’ve done it and any questions you might have.

Tip 1: Have realistic ambitions

Photo by Lucas Clara / Unsplash

Lawyering takes time and experience to master. Passing the bar is the first baby step to a lifetime of learning. PQE is the currency of a lawyer in the job market.

Well, guess what? Coding is very similar too!

There are many options and possibilities — programming languages, tools and methods. Unlike a law school degree, there are free options you can check out, which would give you a good foundation. (Learnpython for Python and W3Schools for the web come to mind.) I got my first break with Udemy, and if you are a Singaporean, you can make use of SkillsFuture Credits to make your online learning free.

Just as becoming a good lawyer is no mean feat, becoming a good coder needs a substantial investment of time and learning. When you are already a lawyer, you may not have enough time in your life to be as good a coder.

I believe the answer is a strong no. Lawyers need to know what is possible, not how to do it. Lawyers will never be as good as real, full-time coders. Why give them another thing to thing the are “special” at. Lawyers need to learn to collaborate with those do code. https://t.co/3EsPbnikzK

— Patrick Lamb (@ElevateLamb) September 9, 2022

So, this is my suggestion: don’t aim to conquer programming languages or produce full-blown applications to rival a LegalTech company you’ve always admired on your own. Focus instead on developing proof of concepts or pushing the tools you are already familiar with as far as you can go. In addition, look at no code or low code alternatives to get easy wins.

By limiting the scope of your ambitions, you’d be able to focus on learning the things you need to produce quick and impactful results. The reinforcement from such quick wins would improve your confidence in your coding skills and abilities.

There might be a day when your project has the makings of a killer app. When that time comes, I am sure that you will decide that going solo is not only impossible but also a bad idea as well. Apps are pretty complex today, so I honestly think it’s unrealistic to rely on yourself to make them.

Tip 2: Follow what interests you

Muddy HandsPhoto by Sandie Clarke / Unsplash

It’s related to tip 1 — you’d probably be able to learn faster and more effectively if you are doing things related to what you are already doing. For lawyers, this means doing your job, but with code. A great example of this is docassemble, which is an open-source system for guided interviews and document assembly.

When you do docassemble, you would try to mimic what you do in practice. For example, crafting questions to get the information you need from a client to file a document or create a contract. However, instead of interviewing a person directly, you will be doing this code.

In the course of my travails looking for projects which interest me, I found the following interesting:

  • Rules as Code: I found Blawx to be the most user-friendly way to get your hands dirty on the idea that legislation, codes and regulations can be code.
  • Docassemble: I mentioned this earlier in this tip
  • Natural Language Processing: Using Artificial Intelligence to process text will lead you to many of the most exciting fields these days: summarisation, search and question and answer. Many of these solutions are fascinating when used for legal text.

I wouldn’t suggest that law is the only subject that lawyers find interesting. I have also spent time trying to create an e-commerce website for my wife and getting a computer to play Monopoly Junior 5 million times a day.

Such “fun” projects might not have much relevance to your professional life, but I learned new things which could help me in the future. E-commerce websites are the life of the internet today, and I experiment with the latest cloud technologies. Running 5 million games in a day made me think harder about code performance and how to achieve more with a single computer.

Tip 3: Develop in the open

Waiting for the big show...Photo by Barry Weatherall / Unsplash

Not many people think about this, so please hang around.

When I was a kid, I had already dreamed of playing around with code and computers. In secondary school, a bunch of guys would race to make the best apps in the class (for some strange reason, they tend to revolve around computer games). I learned a lot about coding then.

As I grew up and my focus changed towards learning and building a career in law, my coding skills deteriorated rapidly. One of the obvious reasons is that I was doing something else, and working late nights in a law firm or law school is not conducive to developing hobbies.

I also found community essential for maintaining your coding skills and interest. The most straightforward reason is that a community will help you when encountering difficulties in your nascent journey as a coder. On the other hand, listening and helping other people with their coding problems also improves your knowledge and skills.

The best thing about the internet is that you can find someone with similar interests as you — lawyers who code. On days when I feel exhausted with my day job, it’s good to know that someone out there is interested in the same things I am interested in, even if they live in a different world. So it would be best if you found your tribe; the only way to do that is to develop in the open.

  • Get your own GitHub account, write some code and publish it. Here's mine!
  • Interact on social media with people with the same interests as you. You’re more likely to learn what’s hot and exciting from them. I found Twitter to be the most lively place. Here's mine!
  • Join mailing lists, newsletters and meetups.

I find that it’s vital to be open since lawyers who code are rare, and you have to make a special effort to find them. They are like unicorns🦄!

Conclusion

So, do lawyers need to code? To me, you need a lot of drive to learn to code and build a career in law in the meantime. For those set on setting themselves apart this way, I hope the tips above can point the way. What other projects or opportunities do you see that can help lawyers who would like to code?

#Lawyers #Programming #LegalTech #blog #docassemble #Ideas #Law #OpenSource #RulesAsCode

Author Portrait Love.Law.Robots. – A blog by Ang Hou Fu

Feature image

I wrote this “emergency” post to note that after what seemed to be a lifetime of debate, the government has given the most unambiguous indication that section 377A of the Penal Code will be repealed.

Section 377A is a provision inherited from our colonial masters criminalising sex between men, including in private.

Although this is a hot topic and has something to do with law and love, I've stayed away from it on this blog mainly because you can find other places with better write-ups on it. In case anyone wants my opinion on it, I don't know why it's taken so long and become so hard.

e-Archive | SAcLJ | AP Journals Onlinee-First MenuEven the former Chief Justice waded in.

Section 377A is ridiculous because it's straightforward why it should be repealed. Simply stated, we don't put men who have sex with each other in jail. However, the repeal of section 377A has become an apocalyptic symbol of the downfall of society for some.

This brings me to the uneasy compromise: I wouldn't accept having a constitutional amendment to “enshrine” marriage between a man and a woman for the repeal of section 377A. It's like we decided to recognise the dignity of gay couples only to take it away at the same time.

Not just vanilla illegal, but constitutionally illegal. They're going to amend the supreme law of the land—the one that all other laws have to align with—to say that we, Singapore, as a country, do not and will not recognise same-sex couples as a legal family unit. https://t.co/MwTPijlzvO

— Kirsten Han 韩俐颖 (@kixes) August 21, 2022

I am not sure this constitutional amendment makes sense politically. Section 377A is inherited, so we can't blame the government of the day for it. On the other hand, they will own a constitutional provision which apparently can't be challenged in court, so they can't pass off its effects to the courts as they do for the death penalty.

Constitutional amendments are easy now because the government has had a supermajority forever. It's not clear whether this will be the case in the future. If for some reason, we are stuck with something more challenging to change than section 377A, we now risk splintering society even further with no easy way out.

I feel that this “compromise” was meant to end the debate on LGBTQ issues by giving these weird people whatever they were clamouring for in the first place.

Bigger fights are on the way: workplace discrimination is among the most interesting ones for me. Marriage for all sorts of couples? That's another big one that we've never debated (but is now going to be constitutionally enshrined?).

Will Singapore’s new workplace discrimination law be a win for equality?By conflating protectionism with traditional workplace discrimination, we risk creating a watered-down law that fails to address the real discrimination faced by people from from marginalised groups.JomDaryl Yang

So, I honestly think this compromise is a trojan horse, and I would never have accepted it if it was up to me. However, that's my principles, and I think the current situation demands we take what the government of the day has given us.

If you, like me, feel a bit discouraged that this debate has ended this way, I would remind myself of this: There is one difference between the people who would like marriage equality and those who don't. Only one of these groups has real victims who are hurt by the policies we chose as a society. When we recognise them, there is only one answer to these questions.

So, have faith that love conquers all. Good night.

#blog #News #Newsletter #Government #Law #Singapore

Author Portrait Love.Law.Robots. – A blog by Ang Hou Fu

Feature image

A recent disciplinary case in Singapore, [Law Society of Singapore v Mohammed Lutfi bin Hussin](https://www.elitigation.sg/gd/s/2022SGHC182) , highlights a common pitfall in legal practice. A lawyer failed to witness the signing of conveyancing documents personally but attested to doing so. Few people may pay attention to a routine conveyancing transaction. Still, this time, the transaction was tainted by fraud: a mortgagor had submitted false documents to a mortgagee to obtain a higher loan. The lawyer’s license was suspended for three years for claiming to have witnessed the signing when he didn’t.

There’s an uncharacteristic lack of remorse on the lawyer’s part compared to other disciplinary cases. Here’s how he described his practice, which seems rather ordinary at first glance:

This was a routine purchase of the Property by [a buyer] financed by a loan taken from a bank. The transaction could be carried out without my seeing [the Buyer]. My staff are fully capable of dealing with routine transactions such as [the Buyer’s] purchase of the Property. If anything out of the ordinary crops up, they will inform me and I will then see [the Buyer] and sort out whatever problem has arisen. There were no issues at all relating to [the Buyer’s] purchase and for that reason, I did not have to see him.

In contrast, here’s what the Court of 3 Judges (in charge of lawyer discipline) thought of that:

[The lawyer] had put in place a “system” pursuant to which he entrusted his non-legally trained staff to carry out conveyancing transactions, including witnessing the execution of conveyancing documents, so that he did not have to meet his own clients, unless he deemed it necessary. Under this “system”, he presupposed that everything was in order until and unless his staff flagged any issues. In relation to [the Buyer’s] conveyancing transaction, nothing out of the ordinary was brought to his attention. He therefore assumed that all was in order and never met [the Buyer], notwithstanding the fact that the latter had engaged him as his conveyancing solicitor.

It’s important to note that witnessing someone sign a document isn’t likely to have stopped the fraudulent transaction. The nub of the issue was that the lawyer had claimed to do something he did not. The Court recognized that some might call this “technical dishonesty”.

But what’s the point of witnessing someone sign a document? The main idea is that it prevents fraud. Anyone can put anyone’s signature anywhere. The lawyer ensures the signor’s identity, understands the document, and there are no signs of duress or misunderstanding.

Who wants to do an E-Will?COVID-19 offers an opportunity to relook at one of the oldest instruments in law — wills. Is it enough to make them an electronic transaction?Love.Law.Robots.HoufuA similar problem persists in the area of wills and testaments.

Post-pandemic, though, alternatives are apparent but with questionable legality. If a lawyer witnesses a signing through Zoom, does it count? If e-Signature can be used, what value does being in person add? Banks don’t use lawyers to prevent fraud all the time too. Document submission, such as income and particulars, can now be received directly through the relevant government agency and authenticated fairly securely by the applicant. The wonders of SingPass!

The question is, would the lawyer have escaped sanction if there was actually a “system” in place? The Court describes this as a “non-system” because the lawyer had abdicated his responsibilities to non-legally trained staff. But what if the lawyer had implemented a system to train his staff on when to escalate, use checklists, verify the work, and carry out audits? Would that be enough? Or is the point that no matter what, the lawyer must be physically present?

We aren’t going to find out because everyone understands that witnessing a signing has to be personal. Furthermore, this is a strict requirement promulgated by legislation, so it’s non-negotiable.

These issues are essential because conveyancing is a prime example of volume work in the legal profession. If a lawyer has to be physically present at every stage of the transaction, this would slow down the process and make it expensive. The practice would be harder to justify in the face of more efficient and cost-effective solutions. More people would believe its objective is to maintain a monopoly for lawyers. Even lawyers may be hard-pressed to find efficient ways to do business and inadvertently find themselves on the wrong side of the law.

For now, legal innovators trying to automate manual processes or implement a “system” would have to be careful if they involved any attestation. It’s the law; you can’t change it, and breaking it would get you in hot soup, no matter how dissatisfied you would be.

The Importance of Being AuthorisedA recent case shows that practising law as an unauthorised person can have serious effects. What does this hold for other people who may be interested in alternative legal services?Love.Law.Robots.HoufuAn earlier post explored another common pitfall.

#Law #Lawyers #E-signature #Employee #LawSociety #Singapore #SupremeCourtSingapore #tech

Author Portrait Love.Law.Robots. – A blog by Ang Hou Fu

Feature image

In one of my more popular posts last year, I remarked glibly that turning the outcome of 5 million random Monopoly JR games into a truth was magical. It wasn't funny because there was magic involved (there's none). It was funny because as a lawyer I couldn't wrap my head around it.

That's because this profession is very adverse to numbers and data. I don't know the reasons why, but you can witness the dismissive attitude towards it in a recent case heard at the US Supreme Court:

Roberts: Is there any evidence that 15 weeks is so much worse than viability?
Reproductive Rights lawyer: [data data data]
Roberts: “Putting the data aside…”

— Elie Mystal (@ElieNYC) December 1, 2021

Or the uproar when the Supreme Court of Canada tried to describe its reasons in a diagram:

I stand by my concerns! ;)

— Amy Salyzyn (@AmySalyzyn) November 23, 2021

A disturbing statistic fails to convince

the city.Photo by Tamara Gore / Unsplash

There's nothing funny about the death penalty in Singapore, though. A group of 17 Malays on death row for drug offences challenged their sentences. They don't allege that anything in particular happened to them. Instead, they point to statistics cobbled together from public sources showing that Malays were overrepresented in the death row — Malays made up 77% of Singaporeans on death row for drug offences, even though they only form 13.5% of the general population.

They thus alleged that the investigation and prosecution of drug offences discriminated against them, even if it was unconscious or not deliberate.

Unsurprisingly, the case was dismissed late last year. The judgement displays all the high watermarks of the scepticism the law has against statistics. Take this critical part of the judgement at [71] as an example:

Further, even if the plaintiffs’ statistical data is accepted as complete and accurate, the only variables reflected are the ethnic group and nationality of each offender. No account is taken of the multitude of other variables that would have contributed to the convictions and sentences in each case. The manner in which the plaintiffs’ statistics are presented therefore presupposes that all these offenders were equally situated and that the sole reason for differential treatment was their ethnicity, which are the very facts the plaintiffs bear the burden of showing.

Any statistics presented as evidence will always have these problems because it is in the nature of statistics. Take a simple linear regression below as an example. The blue dots are samples and the red line is a linear regression, calculated by minimising the distances among all the samples. Only two variables are presented. The majority of the samples actually do not “fit” the line. This might be caused by some particular circumstance unique to the sample. “Common sense and logic” still tell us that there is a trend.

Source: https://simple.wikipedia.org/wiki/File:Linear_regression.svg

As such, the fact that not all accused are given death sentences or some get reduced sentences does not invalidate the trend that the cases are showing. If there was no discrimination, we would see a random distribution, not a trend.

Even if we recognise that there is a trend, or in the context of the case that there is an overrepresentation of a particular community in sentencing, it doesn’t tell us why this is happening.

The problem starkly illustrates the conundrum that correlation does not imply causation.

Source: xkcd

We know how many people are given death sentences under the law, but there may be several reasons why there may be idiosyncrasies:

  • Police are over-policing a particular community
  • Prosecutors are less “lenient” towards a particular community
  • Courts are inclined to give particular sentences
  • A particular community is more “prone” to this type of criminal activity
  • A particular community is less able to fight charges due to fewer resources (e.g. access to good legal advice)

A statistic alone would not be able to differentiate the cause or how much.

Without saying as much, the court appeared to have a lot of difficulty grappling with what exactly is causing the trend. At once, it isn’t sure whether the plaintiff’s case of discrimination is direct or indirect (see paragraph 62). Earlier in the judgement, we are treated to a scintillating report of double-crossing witnesses and a potential smoking gun, which was ultimately excluded (see paragraphs 5 to 15). In conclusion, the statistic by itself was not sufficient to prove or ground any case in discrimination under constitutional law.

The prosecution also went over a list of complaints that are commonly associated with statistical data (see paragraph 33):

  • The makeup of the data does not explain itself — why from 2010? How is a particular offender considered as part of the Malay community or some other community based on the reported case alone?
  • The data is selective and biased. No unreported cases. No cases from persons who avoided the death penalty in certain circumstances.

There are other potential problems. We don't know how significant this survey was,(the judgement does not say) but given that only 8 death sentences were passed in 2020, the number of cases considered is not likely to be significant. This means that cases affected by outliers such as random prosecution or offender decisions are likely to have a more significant impact on the sample and the result. This doesn’t mean that there was no discrimination — it means measuring it using statistics is difficult.

Ultimately, the number of people sentenced to death alone is probably not nuanced enough to tell us how fair or unfair a law is.

One should not take this too far though — the statistics prepared by the applicants might be based on the only information publicly available. Without easy access to complete and accurate data, it’s unfair to blame its imperfections on the applicants. However, this might also be the case where information isn’t even collected. How do we express the decisions of courts, prosecutors or the police in data and quantify bias in that?

Another point — while the data may not be perfect, proving something in law is not the same as in science. For example, in the criminal standard of proof, an accused is convicted when there is no reasonable doubt, and we accept circumstantial evidence even when we pass the death penalty for murder. I would believe that it is possible to form a winning case using statistics in combination with other evidence.

However, an advocate will need to be able to explain numbers and statistical concepts to a judge. This will not be an easy task in most contexts, and will only be reserved for the most confident of advocates.

Conclusion

This was one of many bad outings for statistics in the law. It might have been caused by a poor understanding of statistics or the limitations of using statistics in the legal sphere. I have yet to see a judgement demonstrate a sound grasp of these issues. If you do, please share!

#Singapore #SupremeCourtSingapore #DataScience #Judgements #Law

Author Portrait Love.Law.Robots. – A blog by Ang Hou Fu

Feature image

Regular readers might have noticed the disappearance of articles relating to the Personal Data Protection Commission’s decisions lately. However, as news of the “largest” data breach in Singapore came out, I decided to look into this area again.

My lack of interest paralleled the changing environment, which allowed me to keep up-to-date on them:

  1. The PDPC removed their RSS feed for the latest updates;
  2. I am not allowed to monitor their website manually; and
  3. The PDPC started issuing shorter summaries of their decisions, which makes their work more opaque and less interesting.

Looking at this area again, I wanted to see whether the insights I gleaned from my earlier data project might hold and what would still be relevant going forward.

Data Science with Judgement Data – My PDPC Decisions JourneyAn interesting experiment to apply what I learnt in Data Science to the area of law.Love.Law.Robots.Houfu

Something big struck, well, actually not much.

Photo by Francesca Saraco / Unsplash

The respondent in the case that had attracted media attention is Reddoorz, which operates a hotel booking platform in the budget hotel space. The cause of the breach is as sad as it is unremarkable — they had left the keys to their production database in the code of a disused but still available version of their mobile app. Using those keys, bad actors probably exfiltrated the data. This is yet another example of how lazy practices in developing apps can translate to real-world harm. They even missed the breach when they tried to perform some pen tests because it was old.

PDPC | Breach of the Protection Obligation by CommeasureBreach of the Protection Obligation by CommeasurePDPC LogoRead the PDPC’s enforcement decision here.

The data breach is the “largest” because it involved nearly 6 million customers. Given that the resident population in Singapore is roughly 5.5 million, this probably includes people from around our region.

The PDPC penalised the respondent with a $74,000 fine. This roughly works out to be about 1 cent per person. Even though this is the “largest” data breach handled under the PDPA, the PDPC did not use its full power to issue a penalty of up to $1 million. Under the latest amendments, which have yet to take effect, the potential might of the PDPC can be even greater than that.

The decision states that the PDPC took into account the COVID-19 situation and its impact on the hospitality industry in reducing the penalty amount. It would have been helpful to know how much this factor had reduced the penalty to have an accurate view of it.

In any case, this is consistent with several PDPC decisions. Using the PDPC’s website’s filters, only three decisions doled out more than $75,000 in penalties, and a further 4 doled out more than $50,000. This is among more than 100 decisions with a financial penalty. Even among the rare few cases, only 1 case exercised more than 25% of the current limit of the penalty. The following case only amounts to $120,000 (a high profile health-related case, too!).

The top of the financial penalty list (As of November 2021). Take note of the financial penalty filters at the bottom left corner.

This suggests that the penalties are, in practice, quite limited. What would it take for the PDPC to penalise an offender? Probably not the number of records breached. Maybe public disquiet?

In a world without data breaches

Throttle Roll - Swap Meat MarketPhoto by Parker Burchfield / Unsplash

While the media focuses on financial penalties, I am not a big fan of them.

While doling out “meaningful” penalties strikes a balance between compliance with the law and business interests, there are limits to this approach. As mentioned above, dealing with a risk of $5,000 fines may not be sufficient for a company to hire a team of specialists or even a professional Data Protection Officer. If a company’s best strategy is not to get caught for a penalty, this does not promote compliance with the law at all.

Unfortunately, we don’t live in a world without data breaches. The decisions, including those mentioned above, are filled with human errors. Waiting to get caught for such mistakes is not a responsible strategy. Luckily, the PDPA doesn’t require the organisation to provide bulletproof security measures, only reasonable ones. Then, the crux is figuring out what the PDPC thinks is enough to be reasonable.

So while all these data protection decisions and financial penalties are interesting in showing how others get it wrong, the real gem for the data protection professional in Singapore is finding someone who got it right.

And here’s the gem: Giordano. Now I am sorry I haven’t bought a shirt from them in decades.

There was a data breach, and the suspect was compromised credentials. However, the perpetrator did not get far:

  • The organisation deployed various endpoint solutions
  • The organisation implemented real-time system monitoring of web traffic abnormalities
  • Data was regularly and automatically backed up and encrypted anyway

Kudos to the IT and data protection team!

Compared to other “Not in Breach” decisions, this decision is the only one I know to directly link to one of the many guides made by the PDPC for organisations. “How to Guard Against Common Types of Data Breaches” makes a headline appearance in the Summary when introducing the reasonable measures that Giordano implemented.

The close reference to the guides signals that organisations following them can have a better chance of being in the “No Breach” category.

An approach that promotes best practices is arguably more beneficial to society than one that penalises others for making a mistake. Reasonable industry practices must include encrypting essential data and other recommendations from the PDPC. It would need leaders like Giordano, an otherwise ordinary clothing apparel store in many shopping malls, to make a difference.

A call from the undertaking

Photo by Nicola Fioravanti / Unsplash

The final case in this post isn’t found in the regular enforcement decisions section of the PDPC’s website — undertakings.

If you view a penalty as recognising a failure of data protection and no breach as an indicator of its success, the undertaking is that weird creature in between. It rewards organisations that have the data protection system for taking the initiative to settle with the PDPC early but recognises that there are still gaps in its implementation.

I was excited about undertakings and called them the “teeth of the accountability principle”. However, I haven’t found much substance in my excitement, and the parallel with US anti-corruption practices appears unfounded.

Between February 2021, when the undertaking procedure was given legislative force, and November 2021, 10 organisations spanning different industries went through this procedure. In the meantime, the PDPC delivered 21 decisions with a financial penalty, direction or warning. I reckon roughly 30% is a good indicator that organisations use this procedure when they can.

My beef is that very little information is provided on these undertakings, which appears even shorter than the summaries of enforcement decisions. With very little information, it isn’t clear why these organisations get undertakings rather than penalties.

Take the instant case in November as an example. Do they have superior data protection structures in their organisations? (The organisation didn’t have any and had to undertake to implement something.) Are they all Data Protection Trust Mark organisations? (Answer: No.) Are they minor breaches? (On the surface, I can’t tell. 2,771 users were affected in this case.)

My hunch is that (like the Guide to Active Enforcement says) these organisations voluntarily notified the PDPC with a remediation plan that the PDPC could accept. This is not as easy as it sounds, as you might probably engage lawyers and other professionals to navigate your way to that remediation plan.

With very little media attention and even a separate section away from the good and the ugly on the PDPC’s website, the undertaking is likely to be practically the best way for organisations to deal with the consequences of a data breach. Whether the balance goes too far in shielding organisations from them remains to be seen.

Conclusion

Having peeked back at this area, I am still not sure I like what I find. There was a time when there was excitement about data protection in Singapore, and becoming a professional was seen as a viable place to find employment. It would be fascinating to see how much this industry develops. If it does or it doesn’t, I believe that the actions and the approach of the PDPC to organisations with data breaches would be a fundamental cause.

Until there is information on how many data protection professionals there are in Singapore and what they are doing, I don’t think you will find many more articles in this area on this blog.

#Privacy #PersonalDataProtectionCommission #PersonalDataProtectionAct #Penalties #Undertakings #Benchmarking #DataBreach #DataProtectionOfficer #Enforcement #Law ##PDPAAmendment2020 #PDPC-Decisions #Singapore #Decisions

Author Portrait Love.Law.Robots. – A blog by Ang Hou Fu

Feature image

I spent several nights and trips on aeroplanes thinking about how to innovate the contracting process in my company. Though I did do a lot of reading online and offline, it was a lonely journey. I had to separate the puff from the substance and the wheat from the chuff from what I was reading and planning. When I got to action, I realised that having ideas was the easy part; making them work is really tough. Some of that work showed its fruits, but much of it was still unfinished.

Why I would use Excel for my Contract Management SystemHow do I get on this legal technology wave? Where do I even start? A “contract management system” or a “document management system” (“CMS”) is a good place. Business operations are not affected, but the legal department can get their hands dirty and show results for it. If you wouldLove.Law.Robots.HoufuAn early effort. I have mixed views about this post 2 years later.

A tiny book review

At first, I was sceptical about reading another book on the process. Sign Here: The enterprise guide to closing contracts quickly “ by Alex Hamilton proved to be different. Alex Hamilton is a founder of Radiant Law, a law firm in the UK that focuses solely on the commercial contract process. They use technology and process improvement to deliver legal services differently. They've been doing it for ten years too, so they are here to stay. I was quite sure I would learn something different from this book.

Unfortunately, the book didn't teach me anything new. Instead, it validated many of my instincts and the conclusion I had reached after pondering the issue for years. That might sound like a nice ending, but I would rather read this from a book than cracking it from some stone and not being sure whether what I had was a real insight or baloney.

So, in short, I recommend the book. It put words to what my instinct and experience were telling me, and I am glad I read it. This is the real deal, in an accessible and practical format that anyone can read.

Sign Here: The enterprise guide to closing contracts quickly : Hamilton, Alex: Amazon.sg: BooksSign Here: The enterprise guide to closing contracts quickly : Hamilton, Alex: Amazon.sg: BooksAlex HamiltonI earn a commission from purchases made through this affiliate link.

Let's Pick Five

If you are not convinced yet, here are five lessons from the book. I think they're wise and spoke to my practical experience.

Thing 1: Speed matters when you're making contracts

Image by Free-Photos from Pixabay

The legal department is usually viewed as a roadblock. We stop others from making bad mistakes. We are the ones who are going to review the contract you just received from the counterparty. These points are valid, but there's a substantial cost in not acting fast. “Sign Here” raises lost revenue, postponed or even lost value and may even undermine relationships as the cost of delay in the contracting process. “Relationships are indeed being created and grown [as a result of the contract process], but successful relationships are often despite rather than because of the agreement.”

So speed really makes a difference. In my view, there's a customer relationship factor. Your internal customers like to hear a response from you. They can also tell our external customers that they care when they respond quickly.

Thing 2: There is no silver bullet

Photo by Cody Wingfield on Unsplash

“Sign Here” proclaims that despite vendors' claims, no single solution would solve all problems in the contracting process. I've always felt sceptical about silver bullet claims. I also felt unsure whether any completely new platform would succeed given its high costs.

There are two facets of real life that make any “silver bullet” difficult:

  • You don't live in a vacuum. I found several guerilla systems for contracting in the wild in my company. Expecting messy people to fit into your system would probably be a hard task, and I was not sure I was spending my capital effectively forcing people to like my favourite solution.
  • Resources are limited. It's simple. I have no budget, and I am still expected to do my regular work properly. Any innovation used to be nice to have. The amount of work it takes to put in a “silver bullet” solution (if there was such a thing) would have been extremely risky.

So no single solution works. You really have to go in there and figure out a good fit.

Thing 3: Change is a long series of steps

Image by wendy CORNIQUET from Pixabay

Related to the “silver bullet” fascination above is the belief that one solution solves all problems at once. It just doesn't work like that. Even if you had infinite resources and a highly motivated core of customers ready to do your bidding, the solution you have just implemented is not likely to be perfect now or in the future. The time horizon “Sign Here” suggests isn't months or years — it's weeks and then improved again later.

For myself, having users and putting solutions into production meant I had to fix bugs, answer questions and listen to suggestions. With some humility, I realised that these fixes and suggestions made the solution better. It also meant, sadly, that I had to get back to the drawing board.

Corollary to the fact that you will have to revisit your work repeatedly, it also means that you have to learn new things all the time continually. 😰😫

Thing 4: Be Clear and Reasonable

Photo by Timothy Meinberg on Unsplash

Consistent with the aim that contracts are relational rather than transactional, “Sign Here” recommends that terms aim first to be reasonable rather than extract maximum advantage, which is whittled down by mano-a-mano negotiations to something you can live with.

Related to the speed of contracting, clear and reasonable terms means that parties aren't sapped by the energy it takes to reach an agreement. I found internal customers are happy when they aren't fighting pointless battles, and when they don't have to explain to the counterparty or their legal department why our terms are so unfair. It also turns out that business folks aren't blind, and they like to discuss strategic matters that really matter to the deal. That starts with shunting out the stuff that doesn't matter.

Thing 5: Some technologies are more important than others

Image by Michael Schwarzenberger from Pixabay

I found the hardest issue with implementing change in contracting is what to prioritize. When you have limited time, resources and leadership capital, the changes you emphasize appears to be very significant. Document automation and AI contract review sound cool, while other less glorious things like storage systems and helpdesks also seem important.

One of the best parts about “Sign Here” is that it sets out a list of technologies you should focus on and why. Conversely, it also highlights technologies that you might hear about, but also their not-so-discussed limitations. It's one of the most fun parts of the book, so I won't spoil it for you.

Instead, I'd highlight the most important technologies that I thought were. It broadly matches the insights from the book.

  • Document template automation (Docassemble)
  • e-Signature (we just implemented DocuSign)
  • Intake system (I'm working on it)
  • Knowledge system (Probably try and perfect the SharePoint site we now have)

docassemble – Love.Law.Robots.Love.Law.Robots.Some of my posts on this blog on docassemble.

Conclusion

Buy the book!

#BookReview #LegalTech #Contracts #ContractManagementSystem #docassemble #E-signature #Law

Author Portrait Love.Law.Robots. – A blog by Ang Hou Fu

Feature image

I am not going to be shy about this. I really hate reading Non-Disclosure Agreements. Sometimes, they are known as NDAs, Confidentiality Agreements, and Mutual Confidentiality Agreements. Whatever guise they are in, they seem to say the same thing in many different ways. If there was a nuance, it's difficult to say what actual impact they have. Yet, we still have to figure it out and review them as necessary. Because somebody probably forgot to put in something that we need. Once they are signed, we move on. In short, a lot of time is spent on NDAs, but nobody cares. 🤢

That's what @thelawboutique_ execs Electra and Roisin found when they sat down to review the agreements they'd handled for their clients.

The #NDA effort-to-value ratio isn’t just appalling for the service providers – for in-house counsel it’s even worse. Can you relate? pic.twitter.com/CAuHQAkPQR

— oneNDA (@onendaclub) July 26, 2021

This kind of dysfunction is ripe for disruption. NDAs are probably one of the most straightforward problems in using AI for contract review. They have a certain structure and a limited set of clauses. You don't need to look far for an example — check NDAlynn. You can even enjoy NDALynn for free if you don't mind your document becoming part of the hivemind.

oneNDA is a different kind of disruptor. It suggests that life would be much easier for everyone if we sat together and agreed on one NDA. If you're curious what that crowdsourced NDA looks like, you can take a look at their website or download it here.

oneNDA Is Live! An M&A Module Is NextThe oneNDA project, which has sought to create a universal Non-Disclosure Agreement to cover confidential information, has gone live and is now available. However, the project will not stop th…Artificial Lawyerartificiallawyer

What I liked about oneNDA

  • It's short, simple and pretty. At two pages, they have really condensed the document into its finer parts.
  • The so-called “variables” only cover about half a page. Agreeing on the details of this document will probably take less than a few minutes. This is probably more substantial than many NDAs I have seen regarding time and costs saved (if that is the only thing you have to agree on).
  • It's licensed underCC BY-ND 4.0, a Creative Commons license. So yeah, I can share it here.

What I didn't like about oneNDA

  • Choices have been made, and not everyone will agree with them. You can check out their graveyard to read about what they decided to leave out in oneNDA. I can understand why they did it, but that will not stop anyone from adding it back in. You would then have to spend time reviewing it, which defeats the purpose.
  • It's licensed with ND (No Derivatives). This means you can't change and then distribute it, including sending it to your counter-party. It's a plausible controversy whether contract clauses can be copyrighted (they obviously can). I guess dictating how the NDA is used can help adoption by building a strong identity. In my view and having some background in open source, I honestly think this ND qualification is unnecessary. I would definitely think twice about these restrictions before using them.

My Conclusion

The creators of oneNDA have made a smart decision by aiming first for an NDA that is the simplest — having a commercial discussion. Logically speaking, it's like buttoning your shirt as you prepare for a business meeting. You shouldn't be spending much (if possible, any) lawyer or negotiation time on this sort of agreement. This NDA definitely helps you to reach that conclusion.

However, if you've reviewed enough NDAs, you would know that the arguments which prevent us from having a universal NDA aren't entirely rational. Somebody thinks their template is better, and we are going to have a debate over it. Sometimes it's easier to argue that we should stick to our template than selling a change which sounds like losing our freedoms. Maybe our language has been “tested”, and oneNDA hasn't. If I was conservative, having as many clauses in as possible is safer than leaving something out.

Reviewing NDAs is the express route to learning why contracts are dysfunctional.

Finally, there's a problem with NDAs. I first found out when I wrote my own NDA generator. Everyone sort of agrees that NDAs are low hanging fruit, but the reward of solving the problem isn't sweet or worth shouting to management. Nobody cares about NDAs, so nobody cares about the solution. Here lies an important lesson in innovation — some problems just aren't worth solving. The conclusion of my NDA generator was that people nodded at the “proof of concept”. Conversely, a letter generator that wasn't particularly complex or legal had a greater impact. They used it more often, and it saved them from learning how to choose a template.

On the other hand, like buttoning a business shirt, it wouldn't impress you if a button was in a different shape, or featured “magnets”.

oneNDA Is mediocreNDA: Thoughts on a Proposed Standard Nondisclosure Agreement – Adams on Contract DraftingoneNDA is a new initiative that “set out on a mission to standardise the NDA so that lawyers can spend less time on them and more time on more valuable work.” For more about oneNDA, go here. This week they released their “simple, plain English, open-source NDA,” also called, somewhat confusingly, on…Adams on Contract DraftingKen AdamsIt's great to know that I ain't alone in my conclusions.

So, while I am a firm supporter of standards, I am not excited about this one. oneNDA is great, but it is just another NDA.

Standards, the Importance of StandardsI explore the possibilities of using a taxonomy from the Legal Matter Standard Specification from SALI the Alliance.Love.Law.Robots.HoufuRead about a standard I am actually excited about.

Looking Forward

I may not be excited about oneNDA in its current state, but I am more curious about how technically they would implement modules for M&A. I hope it will be a useful tool that provides convenience and simplicity for users, and not just a choose your own NDA. Anything that keeps NDAs away from lawyers will be a boon for the whole process.

For now, count this sceptic out of the hivemind.

Enjoyed this post? You can read more about law or technology on Love.Law.Robots. by subscribing today. I post at least once a week and subscribers get a free members only newsletter. Thank you!

#Law #Contracts #Copyright #LegalTech #oneNDA

Author Portrait Love.Law.Robots. – A blog by Ang Hou Fu

Feature image

A lot of people in Singapore know about the Personal Data Protection Act in Singapore (PDPA). A lot of people also know about the Personal Data Protection Commission (PDPC). The PDPC enforces the PDPA. The PDPC has a good reputation amongst most Singaporeans for its proactive approach to protecting the personal data of ordinary Singaporeans. To most people, this is the data protection regime in Singapore. Full stop.

Far fewer people (and I dare say professionals too) are aware that there is a “right to private action” hidden somewhere in the PDPA. Section 48O, to be exact.

Now who would want to experience the stresses of litigation , paying legal fees (most of which can't be recovered) and the prospect of losing?

Someone with an axe to grind, like the parties in Bellingham v. Reed. It's the first case to test the right to private action in the High Court of Singapore (and possibly the Court of Appeal as well). As a result of the parties' honourable public service, we now know the limitations of the right to private action.

A Private Action Goes Nowhere

This tortured litigation started when a fund manager moved to a competitor. To drum up the new business, the fund manager contacted a potential customer using information from his previous role. What started as a breach of confidence action suddenly morphs into a data protection action when the fund manager's ex-employers added the affected data subject to the litigation.

In the court below, the data subject obtained a court order for the fund manager to stop using his data. This was in spite of the fund manager already stating clearly that he would not be using the personal data of the data subject or contacting him.

The appeal turns on whether the data subject suffered “loss and damage” as a result of the breach of the PDPA. On the facts, a monetary loss seems far-fetched. The data subject argued instead that he suffered “distress and loss of control over personal data”. This wasn't a type of damage commonly recognised under the law, like personal injury or monetary loss. Did the PDPA create a new kind of damage to be found under a private action?

The High Court held that the answer is no. The PDPA “was not driven by the need to protect an absolute or fundamental right to privacy”. A “privacy right” was not part of Singapore's constitution or implied by Singapore's international obligations. The Court commented that:

The purpose of the PDPA was as much to enhance Singapore’s competitiveness and to strengthen Singapore’s position as a trusted business hub as it was to safeguard individuals’ personal data against misuse.

Since the data subject only suffered distress and loss of control over personal data, which were not recognised under the law, the appeal succeeded and the data subject's orders was set aside.

Leave the Private Action Behind

Oddly, the balance struck here could eviscerate the private action under the PDPA. What kind of damages can an affected individual claim for a breach of data protection obligations other than distress and loss of control over their own data?

On the key question of whether the PDPA's private action recognises new heads of damages such as emotional distress or loss of control over personal data, I don't expect the Court of Appeal to come up with a different answer. There might be alternative explanations, but the policy behind it is quite clear.

Firstly, a right of private action would probably end up with lots of litigation against companies, many of which can be for fairly minor breaches. We might be using too much judicial resources on many small matters. Companies might end up being stuck in a mire of lawsuits instead of innovating.

Secondly, many of the structures of the legal system in Singapore would not benefit such private actions. This includes the nearly complete absence of class action suits in Singapore. A private suit is likely to be an exhausting and expensive affair, which would leave many individuals out in the first place.

Thirdly, and this was recognised at the High Court at paragraph 94, there are better avenues for individuals to vindicate themselves. Most importantly, the PDPC has powers to enforce the PDPA, and many of these remedies mirror what an individual would most likely want from an action. This includes the dreaded financial penalty, the basis of which is on compliance with law rather than what loss or damage was suffered. It's notable that an affected individual can appeal the PDPC's decision.

Will Increased Penalties Lead to Greater Compliance With the PDPA?When the GDPR made its star turn in 2018, the jaw-dropping penalties drew a lot of attention. Up to €20 million, or up to 4% of the annual worldwide turnover of the preceding financial year, whichever is greater, was at stake. Several companies scrambled to get their houses in order.Love.Law.Robots.Houfu

Furthermore, the Protection of Harassment Act (which has received far more attention from the government) could provide a more effective route for any intrusion into privacy.

So even though it appears odd that the private action would be extremely limited under the PDPA, this “balance” might be palatable. The private action looks likely to remain as a relic for the most irrational parties. It speaks volumes that the only reported case of a private action in more than 5 years of the PDPA is going to the Court of Appeal.

Is a Constitutional Right necessary?

While I agreed with the result, the reasoning left me unsatisfied. By adamantly insisting that the PDPA was different from other privacy and data protection regimes in western liberal democracies, the High Court appeared to suggest that we compromised something by striking a balance. Or worse, that we are involved in a switch and bait whereby we have meaningless rights in the PDPA.

Any talk about human rights should keep a close eye on its efficacy, in this case whether data subjects can enforce their rights effectively. It's quite clear that individuals can't realistically take companies to task on data protection on their own. The PDPC has had far more success using its enforcement powers.

So, maybe the Court of Appeal can come up with a better way to explain this. However, I wouldn't be holding my breath on this one. This case is a rare sighting, and cases like this will remain rare.

In the meantime, we should train our focus on the PDPC. Full stop.

#Privacy #Singapore #Law

Author Portrait Love.Law.Robots. – A blog by Ang Hou Fu

Feature image

It must be hard to be an NUS student these days. One of the top universities in Singapore (and Asia) keeps appearing in the news for naughty transgressions, and getting allegedly easy treatment from the courts. Arguing whether NUS students get preferential treatment touches on the fairness of the courts as well as whether those in the higher echelon of society get to enjoy privilege. Can exhortations on how the Court works overcome people’s innate fears and prejudices of those in power? I doubt it. More data is needed.

A strong desire to show that justice is done

An NUS student was initially sentenced to probation for molesting a woman in a train station. Probation is a process where once you complete its requirements without incident, ends in a clean record. Amidst a public outcry and the intervention of the law minister, the prosecution appealed. The High Court, presided by the Chief Justice, increased his sentence to two weeks of jail.

The judgements in this case are among the most fascinating.

The State Court isn’t wrong

The lower court (State Court) judgement is no longer available because LawNet only provides the latest three months for the public, so you would have to contend with my memory and a Mothership report.

The State Court judge wrote this during the public furore for the case. It contained a gem which rarely appears in judgements from the State Court: “ The order of probation should not be seen as a soft option. ” Sure, the State Court needs to justify its decision for scrutiny on appeal. However, claiming that probation is not a soft option appears to be a direct appeal to the public.

(By the way, when a State Court decision is appealed, the Court must write a judgement. Public attention and “pressure” as alleged by Mothership does not figure in this practice.)

The State Court’s reasoning appeared reasonable and in line with the sentencing practices of the Court. An appeal court can’t possibly substitute its decision for the State Court without explaining why the State Court is wrong. Will the appeal fail? Will the public see that justice is not “served”?

The Chief Justice cries foul

Key to justifying its decision to allow the appeal, the Chief Justice called for a psychiatric report of the accused. The report provided crucial pieces of information which the State Court did not have. The accused remained “in denial” of the offence. He was still doing pornography. He was able to “compartmentalise” his behaviour. As such, he failed to show an extremely strong propensity for reform. All this explained the State Court’s failure to reach the same decision as he did.

The Chief Justice’s conclusion: the system works.

The Chief Justice also remarked that he had on the same day, allowed another accused, who was “not a graduate”, to community-based sentencing. That case “did not attract any media or public interest”. The failure to report positive outcomes, the Chief Justice argued, creates the misconception that judges are not doing justice. These remarks were extraordinary because they usually do not appear in a court judgement.

Ironically, the media did not report the Chief Justice’s remarks. It is not surprising that the media does not report such positive outcomes and they do not figure prominently in the public’s mind. People react strongly to the oppression of the weak or when the powerful receive better treatment. That’s when they reach the conclusion that criminal justice is not working.

Another NUS student in hot soup

It has been only a few months since the Terence Siow case that another NUS student raised eyebrows again for getting probation. The new case shared many similar contours with Terence Siow’s case. They involved NUS students. The accused also perpetrated violence against females — Yin tried to strangle his girlfriend.

Would the criminal justice system now get an outcome which “aligns” with popular opinion again? If you were betting for such an outcome, the Terence Siow case actually shows that these things are by no means assured. For example, the Chief Justice can’t possibly know that Terence Siow was still watching porn when his case went up for appeal.

This may explain why, unlike Terence Siow, this case is not being appealed. The High Court recently dismissed an appeal from the prosecutor regarding an SMU student filming showers. The High Court in the latter case, stated that community-based sentencing is not a soft option.

Unable to satisfy the public through outcomes in the courts, the Ministry of Law announced a review of the penalty framework. It isn’t immediately clear (at least to me) what such a review would entail when the courts are adamant that the system is working. This is a developing issue, so more will come.

We can’t tell whether the system is working without data

Figuring out what to fix will be very difficult. We are not sure what we are trying to fix in the first place. Fundamentally, we do not know in the first place if university students receive “lighter” sentences because they are university students. It would be ironic if such a review attempts to raise the bar for probation and community sentences so high that even non-graduates cannot reach it.

There is scant public information on what goes on in the criminal justice system. We don’t know how often a graduate or a non-graduate gets away with “lighter” sentences. This provides fertile ground for suspicions, reinforcing personal experiences and even conspiracy theories. Solving this would entail analysing closely the decisions judges make with respect to each accused and the crime.

Such information might be available from appeal decisions, but they only represent a small subset of cases. In fact, such cases will probably over-represent graduates because they are more likely to appeal.

Having a data-driven approach solves two problems. The court will not be required to convince the public of esoteric legal concepts. The media will never report such complexity anyway either. We also do not have to decide whether the Chief Justice’s personal experience or the layman’s experience of the justice system is more compelling. The data can serve as a source of truth for our arguments to improve the system.

Barriers to a data-driven approach

Judges may not be comfortable having their decisions analysed in such detail. They may not like the data to show that someone is softer than the others on certain kinds of accused persons. However, if judges can remain steadfast in the face of public opinion, I am sure that a bunch of numbers are not going to overcome their desire to do right in the cases before them. Instead, such statistics may serve as another guardrail to remind judges when they are facing an outlier. This is nothing new — sentencing guidelines and appeals to higher courts already perform such checks.

I expect that the data is not going to be completely positive. The real fight in criminal matters, like most litigation, happens way before the Court hears the case. Getting referrals to a psychiatrist, writing contrite letters at the first opportunity, and testimonials from influential people can make the difference. It happens that graduates are more likely to get legal advice, know where to find a psychiatrist and have important people around them as well. It sounds unfair that well-resourced accused persons get lighter sentences, but to a judge, this is the evidence before him. If the Ministry’s review ends up increasing legal aid to many accused persons, that would be pretty great.

Of course, detailed data is not required to conclude that NUS students get off easier. However, if the ministry’s review ends up as a full-throated exhortation that the system works and it should work well for everyone, I am afraid we have learnt nothing much from this except whose opinion is stronger.

Conclusion

It’s great that young Singaporeans now care more about the criminal justice system and its outcomes. For many, this would be their first experience understanding the intricacies of this complex system. This is not the time to justify lofty concepts or point to personal experiences. It’s also great that the ability to analyse a judge’s decision-making in detail is largely available to us. Hopefully, this will spur better change to society’s benefit.

#Singapore #Law

Author Portrait Love.Law.Robots. – A blog by Ang Hou Fu