Position Paper

Trading with Trust in
the new Digitalised
World:How Digital Trust canenable Regional Trade1With business increasingly digital,
Trust has never been more important.

PURPOSE
Over the past two years, our world has completely transformed due to a digital
revolution accelerated by the Covid-19 pandemic. In the New Normal, citizens havecome to expect digital interaction in all areas of life including how we work, learn,connect, and shop. Businesses globally have had to speed up the adoption of digitaltechnology to accommodate a strong growing preference for digital, contactlessconsumption. Spending on digital and technology initiatives as well as numbers offull-time equivalents in digital and technology roles increased during the pandemic
despite budget cuts elsewhere in the business.1
However, the rapid digital growth raises questions on trust in the new digital
environment, tools, and the companies that provide the digital experience.2 This
joint paper between the Asian-Oceanian Computing Industry Organization(ASOCIO) and SGTech aims to show how the Asia Pacific region (APAC) can continue
to drive economic growth in digital trade by leveraging on the pillars of digitaltrust—identity, security, privacy, and data protection—to create an inclusive,
innovative, globally connective, and integrated economy.
ASOCIO is an ICT federation whose members include ICT associations representing
24 economies throughout APAC. Its influence covers more than 10,000 ICT
companies and represents approximately USD 800 billion of ICT revenue in theregion. ASOCIO’s objective is to promote, encourage, and foster relationships andtrade among its members and to develop the computing industry in the region.
SGTech is the leading trade association for Singapore's tech industry. Representing
over 1,000 member companies ranging from top multinational corporations, large
local enterprises, vibrant small and medium-sized enterprises, and innovative
startups, it is the largest community in Singapore where companies converge toadvocate for change and drive what enables tech innovation and accelerates techadoption to spur greater sustainability in the sector. SGTech's mission is to catalysea thriving ecosystem that powers Singapore as a global tech powerhouse.

1
2

2

McKinsey (2021)
Chakravorti, Bhalla, Chaturvedi (2021)

Chairman’s Statement
As ASOCIO, our objective is to develop the ICT industry across the Asia Oceania
region by promoting trade as well as fostering relationships between its member
economies. This has been our mission and objective since our founding in 1984.
With the global economy becoming increasingly digital, the world has also seen the
rapid rise in misinformation, consumer scams, cybersecurity attacks and data
breeches. Under such circumstances, Trust has never been more important as the
key ingredient to ensure continued cross-border business transactions andsustaining global trade.
As such, we stand behind the recommendations outlined in this paper. We believein the importance of sustaining regional trade as the digital economy grows, andencourage our member economies to nurture greater Digital Trust across the region
by:
1. Exploring interoperable, regional Digital Identity systems;
2. Working towards mutual recognition of Trust Marks;
3. Harmonising standards for cybersecurity, privacy, data protection, andintellectual property to enable cross-border data flows;
4. Adopting standard data governance contractual clauses;
5. Establishing dispute resolution channels for regional consumer and businessprotection.
This is our pledge as a federation of ICT associations representing 24 economies
throughout in the Asia-Pacific region, a region accounting for USD 800 billion of ICTrevenue. We will strive to promote the best practices and recommendation outlinedin the paper, in hopes to bring about a more prosperous future for the digital
economy in the region.
David Wong Nan Fay
Chairman
ASOCIO

3

METHODOLOGY
ASOCIO and SGTech commissioned Eden Strategy Institute in 2022 to conduct ananalysis of the trends and challenges in physical and digital trade based on
secondary research to identify trade opportunities in the region where digital trust
can serve as a driver for inclusive, cohesive, and innovative economic growth in
APAC.
As part of the research, Eden interviewed experts in IT across the APAC region
including policymakers, consultants, private sector practitioners, and academia todevelop a holistic perspective of the unique digital trust challenges from a nationaland regional perspective. Eden also leveraged its insights from a 2022 Digital Trust
Global Landscape Study, commissioned by SGTech.

THE APAC DIGITAL TRADE OPPORTUNITY
The pace of the digital change in the vast and culturally diverse APAC region has
been rapid; 60 million people in Southeast Asia became online consumers during the
pandemic.3 Major drivers of this growth are the increase in internet connectivity andsmart phone penetration—consumption of mobile data in South and Southeast Asia
will triple between 2022 and 2025—that democratizes access to online
consumption and new digital skills.
Some of the most prominent sectors to benefit from the digital revolution are
eGovernment services, mobile financial services including payments, andeCommerce. The use of in-person government services halved across APAC nationsin the last two years with 77 percent of citizens now primarily using digital platforms
to access government services.4 APAC eCommerce is expected to reach USD 2
trillion by 2025. 5 The growth in online sales has spurred adoption of digital
payments such as mobile wallets; new fintech models such as Buy Now Pay Later(BNPL) are replacing credit cards in some markets.6
The region’s digital transformation is opening new economic opportunities for
citizens—especially the younger generation as digital natives—and businesses inthe digital economy. For example, Philippines and Malaysia are the top twocountries in global eCommerce retail growth, increasing by 25 percent and 23
percent per year respectively.7 Countries such as India, Bangladesh, Pakistan, andPhilippines ‘export’ online labour to the West.8 Social media has dissolved
boundaries for businesses to reach consumers across borders with new forms ofengagement such as livestreams, with consumers accessing digital content andmarketplaces globally. The increase in digital activity has spurred an explosion in
data, which has become a valuable asset for businesses looking to generate moretrade with insights derived from analytics.

3

World Economic Forum (2022) A
Deloitte (2022)
5World Economic Forum (2022) A
6
Techwire Asia (2022)
7
World Economic Forum (2022) A
8
Ibid.
4

4

Research in 2022 shows that most enterprises in the region have received buy-infrom stakeholders to increase IT investments in their budget, compared to only 15
percent of enterprises in 2021, with major spending categories including security,
risk management, cloud computing, digital workspace, and IT automation. 9

9Bajwa (2022)

5

AN END-STATE VISION FOR APAC TRADE
APAC economies strengthened intraregional trade linkages amid the pandemic rose
to its highest level in three decades; it grew 29.6 percent in the first three quartersof 2021, compared with the global trade growth of 27.8 percent.10 In addition tocreating greater inclusivity and shared prosperity, fostering digital trade createsinter-dependencies across countries, helping the region become more cohesive andattractive to international investors. Digital services trade in the region has morethan tripled from 2005, achieving over USD 1.5 trillion in 2020; digital services tradeis showing rapid growth relative to total services.11 The region has a tremendous
opportunity to grow digital trade by developing a regional economy which is
Inclusive; Innovative; Globally-connected; Integrated and Cohesive. 12
Inclusive
Businesses of all sizes, including startups as well as micro, small and medium
enterprises, will have equal opportunity to trade goods and services across borders.
Currently, many SMEs are facing issues with complying with digital laws andregulations due to various resource constraints, and are encountering complex
customs administrations which present delays and added costs.13
Innovative
The free flow of data across borders is a driver of innovation as it enables
information, ideas, and knowledge-sharing, as well as collaboration and crosspollination among individuals and companies. In places with restrictions on digitalcollaboration, people are less likely to experiment and innovate.14
Globally-connected
APAC businesses gain access to new international markets by being integrated into
global and regional value chains, expanding their growth potential, influence, andfootprint.
Integrated and Cohesive
International trade is frictionless because of interoperable technological andgovernance systems. APAC businesses are able to work with each other seamlessly,
encouraging new business relationships and collaboration across national borders.

10

Asian Development Bank (2022) A
Asian Development Bank (2022) B
12
ASEAN (2015)13
World Economic Forum (2022) B
14
Pepper, Garrity, La Salle (2016)
116

THE NEED FOR DIGITAL TRUST
However, digital trade in the Asia-Pacific region continues to be stifled by four key
frictions to trade.
1. Verification. Companies are not always able to verify if an overseas
counterparty they are trading with is in fact the entity it purports to be, andmay prefer to only deal with parties they already know and trust. In theabsence of trusted relationships, there is always the concern that the trade
may not actually go through.
2. Standards. Even when one party has a local trust mark obtained from thegovernment, it is not always easy for a trading partner overseas tounderstand the exact level of assurance this provides around its cyberhygiene, or to navigate the local data protection frameworks and regulations.
3. Contracting. When entering into a contract, a company might be hesitant toaccept the different contract terms and data policies from its counterparty ina different jurisdiction, which affects its accountability to its own clients andconsumers.
4. Recourse. In the event of a disagreement, there are not many mediation
options that can expertly handle cross-border digital disputes in a costeffective way.
These issues all signal a lack of trust in digital transactions. Okta’s State of Digital
Trust Report 2021 found that 58 per cent of Asian respondents are unlikely topurchase a product from a digital brand they did not trust; an average of 38 per centindicated that they would delete their account with the company, after losing trust
in its brand due to a data breach or misuse of data.15 They create considerable
uncertainty, inability to forge cross-border agreement, and resulting duplication.
These frictions, in turn, will stifle cross-border digital trade.
Instead, we envisage a future where Digital Identity allows new counterparties todirectly and efficiently verify each other’s identities. A set of harmonized standards,
trust marks, regulations, and even contract terms will ease the overseas that many
multinational headquarters need to incur when managing their operations acrosscountries, while simplifying the amount of checking, reconciliation, and negotiation
required to trade regionally. A well-functioning, expert regional mediation hub will
supplement trust technologies such as Distributed Ledgers; Privacy Enhancing
Technologies; as well as Governance, Risk, and Compliance systems, to ensure that
digital contracts are fairly enforced in the event of disputes.
Digital Trust is a key enabler for this end-state vision. From getting users to trust
digital products and services, to building seamless digital transactions forenterprises, digital trust is a critical part of driving and maximizing the full potentialof the digital revolution. It is important to note that some member economies still
face financial, technological, social, and political challenges in large-scale
15

7

Okta (2021)

digitization. For these countries, the concept of digital trust may seem like asecondary concern in the face of trying to overcome digitization challenges.
Nonetheless, we argue that digital trust needs to evolve in parallel with societal
developments, in order for countries to reach a vision of an inclusive, innovative,
globally-connected, integrated and cohesive APAC region.
Cybersecurity is typically the first component of digital trust that comes to mind,
and the pillar of digital trust that has been most widely written about recently. In
2021, Asia was the most targeted region for cyberattacks globally, with member
economies of Japan, Australia, and India bearing the brunt of server access andransomware attacks.16 Across the region, experts place a strong emphasis on
developing cybersecurity legislation, and putting in place cybersecure systems andprocesses. However, cybersecurity is but one component of digital trust. 17 In thiswhite paper, we will explore and focus on the other pillars of digital trust such as
digital identity, privacy, and data protection – additional pillars equally important inbuilding this end state vision for the APAC region.18

16

Yu (2022)
Eden Research and Analysis (2022)
18
Ibid.
17

8

Inclusive. Promote inclusive growth with digital identificationand the mutual recognition of trust marks

INTEROPERABLE REGIONAL DIGITAL IDENTIFICATION
Issue
APAC is highly-diverse in terms of culture, language, governance, and economic
development. Businesses incorporated in countries with geopolitical and economic
instability may find it difficult to build trust with international customers; thisapplies particularly to SMEs as they are not able to rely on their brand and reputation
to establish integrity and track record. 19
Solution
Digital Identification (“Digital ID”) can create a trustworthy system to enable easy
end-user identity verification. For individuals, digital ID contains personal
information such as legal name, gender, address, photograph, and biometrics. For
businesses, it can contain company registration numbers, bank accounts or sector
and industry memberships. In business and finance, customer identification andverification are critical first steps to avoid losses and fraud, and to better understandthe counterparties to the transaction. Beyond identification, corporate digital ID canlink to other information and attributes about the identity which facilitates knowyour-customer (KYC) and other mandatory due diligence procedures.20
Implementation Considerations
Digital identities have the potential for abuse and misuse if they are notintentionally designed to protect privacy, as well as the individual or corporation’s
autonomy to control the use of the data. While Aadhaar has been held up as theposter child for centralized digital ID, it has come under criticism for privacy andsecurity lapses, and for its compulsory use for accessing services which may
systematically exclude certain marginalized societal segments such as refugees.21
Corporate digital ID is interlinked with individual digital identity as it requires
external users to identify and authenticate individuals that claim to represent a
company as their representatives, owners, and controllers.22 The digital identity
should also include the company’s track record. Another consideration for thecentralized digital identity system is that there is a new industry of third-party

19

Ibid.
Bank for International Settlements (2022)
21
Access Now (2021)
22
Bank for International Settlements (2022)
20

9verification services that is needed, if certain countries don’t trust another country’s
accrediting organization.
An alternative to the centralized database is decentralized identifiers (DID), withblockchain technology a critical enabler of DID. 23A DID is where there is no central
database and every stakeholder – whether government, ministry, or business – getsto choose its own system. The benefits of DID is enhanced privacy and protection,
as no single entity has control over the ledger, making it less susceptible to misuse,and entities have control over who views the data. 24 For it to interlink globally,
different platforms or sources of data need to be interoperable. To achieve this,international standards such as UN/CEFACT guidelines for digital identity could be
the starting point when designing a national or regional digital identity system.25
Additionally, there are also cultural factors to account for in establishinginteroperable digital identities, such as the issue of non-romanised naming systems
across the APAC region.26
With interoperable digital identity systems, businesses from different countries andof all sizes will be able to establish trust relationships enabled by technology.
Case study
Several countries in the region have successfully developed digital identities. India
enrolled 99 percent of Indian adults, roughly 1.3 billion people, in Aadhaar, India’s
centralized digital ID programme. 27 Aadhaar collects residents’ biometric data – iris
scans, fingerprints, and photographs – and issues residents with a 12-digit identity
number. As the world’s largest biometric identification,28 the government stores thedata in a central database and third-party services can access the database toconfirm identities when needed. Singapore’s Personal Access Pass (Singpass) has
evolved as a gateway to allow convenient and secure access to over 1,700 digital
services offered by more government and private sector entities.29 CorpPass is theauthorization system for corporate entities to manage digital service access of
employees who need to perform corporate transactions and access government
services.30

23

Eden Strategy Institute research and analysis; Monro (2021);
Venture Beat
25
Eden Strategy Institute research and analysis - Wanawit
26
Ibid.
27
Riddhima (2022)
28
Nandi (2019)29
Singapore Government Developer Portal
30
CorpPass
24

10

MUTUAL RECOGNITION OF TRUST MARKS
Issue
Trust marks are a mechanism that helps consumers recognized trusted providers
and make informed decisions on whether to buy goods or services.31 Trust marks
have the potential to drive inclusiveness, enabling even small and microbusinesses
to trade internationally. However, there are multiple, competing trust marks whichleads to consumer and business confusion over their applicability and comparability.
A European Commission survey on trust marks found that 53 percent of consumers
do not trust a trust mark, because they did not know what the criteria was forgetting a trust mark and how the trust mark was evaluated.32 Some examples ofexisting trust marks include the ISO 27001, BSI Mark of Trust, Singapore’s Data
Protection Trustmark Certification (DPTM), Cyber Security Agency of Singapore(CSA) Cyber Trust Mark, and the EU Trust Mark.
Trust marks have also been criticized for acting as a barrier to entry for business who
cannot afford to obtain the trust marks, instead of ensuring that data is secure andprivate.33
Solution
As more countries in the APAC region start obtaining or developing trust marks, it isimportant to achieve consensus in the comparability of trust marks so thatcompanies can transact with other companies confidently, even if they obtained adifferent trust mark. For example, the requirements for the ISO 27000-1
certification can be mapped against those for a DPTM certification; this can also
demonstrate how different trust marks best complement each other.
Engaging third party accreditation bodies who can provide professional mapping
services for the different certifications can also enhance the credibility andcongruency of different trust marks.
Implementation considerations
Creating consumer awareness on the scope of different trust marks is key inlegitimizing trust marks in the eyes of consumers. When consumers are familiar withhow trust marks are developed, the importance of these trust marks, and thefunctions of different trust marks, they are more likely to readily patronize
businesses that have been awarded such trust marks.

31

Next Generation Internet (2020)
European Consumer Centres’ Network (2013)
33
Eden research and analysis – Wanawit Akhputra
32

11

Innovative. Enable cross-border information flows withmultilateral frameworks which are critical for big data
analytics. With more information and flow of ideas, companies
can create innovative products and services.

ENABLING CROSS-BORDER DATA FLOWS
Issue
Free flow of data across borders enables the diffusion of advanced technologies,
economic growth, and innovation.34 Massive volumes of data travel across borders
daily to support economic activity, research, and transactions along the value chain;
this has become even more important due to the Covid-19 pandemic wheretransacting online has become the new normal.35
As member countries in APAC recognize the importance of digitalization and takeaction to support its growth, cross-border data flows become a priority to facilitate
further digitalization. However, there is a concerning trend on the rise of restrictions
on data flow, such as data localisation requirements in particular. Somegovernments have opted to create rules requiring that data, or certain types of data,remain onshore and are not transferred between countries. While these data
localisation laws are seen to provide more safety and security for domestic data,
they may not work as intended; for data security, investment in infrastructure andmaintenance is more important than the physical location of data.36
Data localization laws cause friction in business transactions and increased expenses
for compliance. For example, a company might not be able to transfer data
seamlessly to its subsidiary or partner in another country. Both parties have limited
data on which to run analytics which typically surface new information insights.
Without these insights, the ability of the company to innovate for new products andservices may be hindered, affecting the customer experience.
Solutions
Creating a balanced regulatory environment that is attractive to business while
protecting data security and privacy can be challenging, especially in countries thatare just starting to prioritize digital growth. One solution could be for countries tojoin multilateral cross-border frameworks and certifications such as the Asia Pacific34

World Economic Forum (2021)
Ibid.
36
GSMA (2018)35

12

Economic Cooperation (APEC) Cross Border Privacy Regulation (CBPR), whichfacilitates international data flows by harmonizing standards across areas of digitaltrust, enabling companies to feel safe transferring data. Currently, nine countries
participate in the CBPR, including the United States, Mexico, Canada, Japan, South
Korea, Singapore, Chinese Taipei, Australia, and the Philippines.
Developed by all 21 APEC economies, an APEC economy must demonstrate that it
can enforce compliance with the CBPR System’s requirements before joining. 37
CBPR sets up a network of reciprocally and mutually-agreed on regulations which
preserve individual nations’ privacy regulations. 38 The CBPR is separate from, anddo not supersede, domestic legal requirements.39 CBPR system requirements
include enforcement, accountability, consumer empowerment, and consistent
protections.40 Certified companies and governments under the APEC CBPR System
can transfer personal data across borders without meeting additional requirements.
Privacy Enhancing Technologies (PETs) are also another emerging privacy solution.
PETs comprise of a broad range of software and hardware technologies, including
Synthetic Data, Differential Privacy, Federated Learning, Homomorphic Encryption,
Secure Multi-party Computing, Zero Knowledge Proof, and Trusted Execution
Environments (TEEs).
PETs allow businesses to extract value from data without exposing the data itself,
thereby protecting personal data and commercially-sensitive information. This
increases the options for B2B data collaboration, enables cross-border data flows,
and increases the availability of data for developing AI systems.41
Implementation Considerations
In assessing whether a country is ready to join the CBPR, or putting policies in place
to do so, technology practitioners need to be involved in the policymaking stage toensure that the policies are actually workable as some policymakers will not have in
depth insights to the tech implications of the CBPR system requirements.42
Some state-of-the-art PETs require complex architectures and integrations to bebuilt. Specialist engineering capabilities are often needed, such as data sciencebackgrounds with grounding in cryptography and security. Some PET techniquessuch as Homomorphic Encryption and Multi-party Computing require high levels ofcomputing power. This will improve with R&D, and will become less of an issue in themedium-term.43
Case study
Cross-border data flows are important to stimulate innovation and economic
growth across different sectors. For example, in the energy sector, wind turbine
manufacturers use data from turbines to maintain and optimize wind energy parks
37

APEC
Business Times (2019)
39
Ibid
40
APEC
41
IMDA
42
Eden Strategy Institute – Wanawit Akhputra
43
Eden Research and Analysis (2022)
38

13

across different countries. These data flows are essential to identify areas where
they can reduce operational costs as well as data analytics to optimize productive,
subsequently increasing the competitiveness of their product.44
In the medtech sector, for example, hearing aid manufacturers rely on data flow tocustomize how devices can fit to customers’ ears. Pre-sale, they scan customers’ ear
channels to create a precise 3D-model of the inner ear. Post-sale, they support
remote technical calibration for better delivering of the hearing aid. This is the samefor high-end dental procedures such as invisible braces. Such processes involvecross-border flows of personal and health data.

44

OECD (2019)14

Globally-connected. Promote global connectivity and accessto regional and international markets by harmonising
standards for cybersecurity, privacy, data protection, andintellectual property

HARMONISING STANDARDS TO IMPROVE GLOBAL CONNECTIVITY
Issue
Currently, cybersecurity, privacy, and data protection laws across the region are notharmonised, creating a complex landscape of requirements for companies in APAC
to navigate through. Some APAC members have very high stringent levels of
security, privacy, and data protection requirements. For example, South Korea has
been granted an adequacy decision by the European Commission, which means that
there can be transfers of personal data from the European Economic Area (EEA) to
private and public entities in South Korea, with no requirement for additionaltransfers tools, conditions, or authorizations from data protection regulators in the
EEA.45
In navigating this complex landscape, larger companies are usually able to accept
additional expenses in compliance costs and hire external consultants to supportthem; however, smaller companies are usually unable to justify the additional
expense and are left to navigate the requirements, often deterring them fromaccessing international markets.
Solution
There needs to be regional consensus on the standards of data protection,
cybersecurity, data protection, and intellectual property. To do so, countries should
strengthen their commitments to align their national laws to multilateralframeworks such as the ASEAN Data Management Framework which was developedby the ASEAN Working Group on Digital Data Governance and designed to provide
voluntary and non-binding guidance based on best practices in data management
for businesses.46 The DMF also provides a step-by-step guide for businesses to set
up a data management system, which includes data governance structures andsafeguards.

45

O’Donoghue and Ibranimova (2021)
Allen and Gledhill (2021)

46

15

Additionally, countries should join the APEC Cross Border Privacy Regulation (CBPR)
aims to facilitate global data flows, but requires countries to adhere to a minimum
requirement under certain systems.47 In doing so, companies from all member
countries, and of all sizes, would be able to reduce compliance costs whentransacting across borders since all member countries will meet minimum
requirements on cybersecurity, privacy, data protection, and intellectual property.
Implementation Considerations
It might be challenging to gain consensus in APAC on the minimum standards of all
the components—cybersecurity, privacy, data protection, intellectual property—
without too much dilution given the diversity of cultural, geopolitical,
infrastructural, and technological factors. Policymakers will have to work together
with industry and technology practitioners to understand the realities on the
ground, and priorities for harmonization.48

47
48

APEC
Eden Strategy Institute – Aung Zwar Lwin

16

Integrated and Cohesive. Adopt standard contractual clauses
and regional consumer protection recourse mechanisms tocreate an integrated and cohesive economy

STANDARD DATA GOVERNANCE CONTRACTUAL CLAUSES
Issue
Smaller companies may not have the financial capacity to hire legal and complianceexpertise; hence, they might not have appropriate contractual documents required
to transact with larger or more sophisticated companies. This disadvantage isexacerbated when transacting with international jurisdictions, as the level ofcontractual protections and legal expertise required are even more important given
the differences in legal jurisdictional requirements. 49
Clauses that are particularly prominent are data governance clauses and dispute
resolution clauses: data governance clauses as data protection breaches carry large
penalties in certain jurisdictions; dispute resolution clauses, as customers needrecourse in case the transaction goes awry for a variety of reasons including productand service quality, shipment delay, and product safety. Hence, without sufficient
contractual protections and legal expertise, smaller businesses are likely to bedisadvantaged in winning business opportunities with larger companies nationally,
regionally, and internationally.
SolutionStandard contractual clauses such as the ASEAN Model Contractual Clauses(MCCs)50 may be included in binding legal agreements between parties transferring
personal data to each other across borders. When businesses agree on widelyrecognized standard contractual clauses, they can contract with regional andinternational parties easily as both parties have reassurance on each other’scontractual obligations.
Implementation Considerations
Countries may face challenges in raising awareness about these standard
contractual clauses and garnering widespread adoption. Businesses will need to be
educated about the tangible benefits of adapting their operations to use new
methods such as standard contractual clauses.

49
50

Eden research and analysis (2022)
PDPC

17

Case study
The European Commission’s Standard Contractual Clauses (SCC) governs crossborder data transfers and data exchanges between data controllers and processors.
SCCs are the mostly widely used mechanism among the business community inEurope. In a survey of 300 companies, 85 percent of companies use them; of theSMEs surveyed, 70 percent use them. Almost all industry sectors rely on SCCs fortheir transfers, with the ICT sector being the largest at 37 percent, andmanufacturing coming in second at 22 percent.51

51

Digital Europe (2020)

18

DISPUTE RESOLUTION FOR REGIONAL CONSUMER PROTECTION
Issue
Consumers and businesses are wary in transacting with suppliers which are not able
to project legitimacy if they do not have a household brand name or have notattained a certain size or longevity of operations. This issue is more prominent incross-border transactions as cross-border dispute resolution rights and mechanisms
are complex and uncertain; customers may seek to only buy low value items fromoverseas suppliers because the quantum of losses is negligible even if thetransaction goes awry. For example, a company in Malaysia had bought a productfrom a Chinese vendor which arrived faulty. However, the recourse mechanisms
were complex and time consuming, so much so that they accepted the losses
without making much effort to obtain a refund or exchange. However, thisexperience is likely to discourage them from making high-value cross-borderpurchases in the future. 52
Solution
Harmonizing consumer protection laws and driving development of regional
consumer recourse mechanisms to enforce these laws are possible solutions.
Customers should be able to file a complaint to a central regional consumer body,or work through their national authority to obtain resolution from the seller’snational authority53. In this way, customers will feel secure in transacting crossborder as there are similar protections and certain dispute resolution mechanisms
in case issues arise with the transaction such as faulty goods, shipping delays, orsafety flaws.
Implementation considerations
To achieve this, we need increased collaboration between consumer protection
authorities across the region. Currently, the level of sophistication in consumer
protection authorities across the region in terms of enforcement abilities andprocesses vary widely. Through collaboration, consumer protection authorities canshare good practices and strengthen each other’s institutional processes. 54
Case study
The EU has a cooperation framework legislation called the Consumer Protection
Cooperation Regulation, that allows national authorities from all countries in theEuropean Economic Area to jointly address breaches of consumer rules when the
trader and the consumer are established in different countries. Collectively, thenational authorities form a European enforcement network: The "CPC Network".
National enforcement authorities have strong powers to address illegal practices
and identify dishonest traders. They can request information from domain registrars
and banks to detect the identity of the responsible trader, carry out mystery
shopping, for example, to check geographical discrimination or after-salesconditions, and to order the immediate take-down of websites hosting scams.

52

Eden research and analysis
Modrall and Haverals (2021)
54
Eden research and analysis
53

19

The European Commission coordinates the cooperation between these authorities
to ensure that consumer rights legislation is applied and enforced in a consistentmanner across the Single Market. It can alert the CPC network and coordinate EUwide enforcement action to tackle practices which harm a large majority of EU
consumers. Authorities can accept commitments from the businesses concernedthat they will correct their practices, provide remedies and compensation to theconsumers affected.55

55

European Commission

20

Evaluating approaches for varying levels of Digital Maturity
Certain Digital Trust approaches might be more appropriate to a particular country
or company’s operating context, depending on its level of digital maturity. For
example, countries early in their digital journeys might start by developing digital
identity systems, so that counterparties may first identify each other before data
will flow across borders. Similarly, data governance standards will have to beestablished before trust marks can be awarded.
To help assess the level of digital maturity in a company’s or country’s digitaltransformation journey, we can examine the use of Digital Maturity Models. We haveidentified four key categories of Digital Maturity Models, depending on theparticular use case and business objectives. For example, countries or organizations
can internally devise different indices, to measure different aspects of digitalmaturity. However, indices are typically not accredited and may differ acrosscompanies, and so may not be typically be used by companies to qualify new
counterparties to trade digitally. Instead, while international standards such ISO
27000-1 may not offer comprehensive prescriptive detail, they are effective in
helping organizations harmonize their digital practices.
Given that the maturity models differ in scope and use case, each type of model will
be developed by different private or public sector stakeholders in varying ways. For
example, in the case of trust marks and legislation, government agencies will beheavily involved, with support from the private sector. For instance, in Singapore,
the Infocomm Media Development Authority (IMDA) appoints assessment bodies
that will verify whether applicant organisations satisfy the requirements for the
Data Protection Trustmark and the APEC Cross Border Privacy Rules (CBPR) System,
before issuing these certifications. Such a top-down approach facilitates mutual
recognition of such certification across borders.

21Digital Maturity Model
Standards56:
e.g. ISO 27000 -1
ISO 27001 is the only
auditableinternational
standard that defines therequirementsofaninformation
security
management
system(ISMS)

Benefits• Standards such as ISO
27000-1 are recognizedgloballyasabenchmark of goodpractices, and adds
credibility
totheorganization while alsoenhancing
their
competitivenessandreputation

Indicese.g. Digital IntelligenceIndex (DII) by the Fletcher
School at Tufts University
inpartnershipwith
Mastercard• ISO
2700-1
also
supports compliancewith laws such as GDPR,
enabling organisations
toavoid
costlypenalties due to noncompliance• Enables comparisons
betweendifferent
countriesororganisations along aclearly defined set of
metrics

Trust Marks andCertifications
e.g. Cyber Trust Mark,
Digital Trust Label

56

IT Governance Ltd

22• Different indices will
targetparticular
aspects
ofdigitalmaturitythat
anorganization may want
to focus on. For
example,the
DII
provides insight on how
to enhance digitalcompetitiveness, whilst
Deloitte’s
DigitalMaturityModelevaluates
digitalcapabilities• As these tend to be
more localized, they
are more attuned to
local,
regional,orindustry-specificcontextual

Disadvantages• Getting accredited inthese standards canbe an additional
business
expensewhich may be costly(both in time andfinances)intheshort-term for SMEs
in particular. For
example, SMEs may
need
to
pay
consultancy
fees,
applicationfees,
assessment fees, as
well
andmaintenance fees.
• Since indices areoften not companyspecific, they may
more relevant forinternalplanning
purposes and may beless effective inenhancingacompany’s
credibility
withexternal parties• JustaswithStandards, becomingawarded with a Trust
Mark can be an
additional business
expense which may
be costly in therequirements
nuances

Legislation
e.g. GDPR

and• Certifications such as
CBPR, which target
APAC, enhance crossbordercollaboration
among organisations
through data flows• Lowest
markofcredibility
forcompliant companies• Where legislations cut
across more than one
jurisdiction,
thisenhances a company’sgeographical reach23

short-term,
especially for SMEs.

• Smaller businesses
may struggle to stay
up to date with legal
requirements
and
may
be
overwhelmed withlegal terms andrequirements• Non-compliancewould be very costly
for small businesses

Conclusions
As digitization and the need for digital trust becomes more prominent, the role ofthe IT professional needs to evolve in line with it. IT can no longer be viewed as asiloed department within the organization. IT feeds into all the organization’s
processes, and forms part of the organization’s competitive advantage in a digitalworld.
IT professionals have a critical role to play in being involved in policymaking, to offer
technological perspectives on creating and enforcing new digital trust initiatives
such as data sharing protocols. To contribute effectively, IT professionals across
APAC ought to upskill continuously and stay informed on the most material issues
facing digital trust in the region. Multilateral frameworks and policies are a key
driver for regional, large-scale change; IT professionals need to be involved theprocess of developing these frameworks and policies to ensure that they are
realistic and technologically feasible in each country’s context. Cross-border IT
talent readiness will also ease discrepancies in capabilities across APAC.
The new IT professional needs to be strategic, business-minded, and future-oriented
to offer views on not only the best IT systems the company can implement, but also
how companies can build trust through these digital systems with their vendors andcustomers in order to gain a competitive advantage. We envisage that this will pave
the way for more companies to appoint Chief Trust Officers, that steward anorganization’s numerous trust initiatives, and acts as a business partner to the Csuite to enable their respective functions with trust. Companies will be able to drive
business growth with Chief Trust Officers that ably understand, communicate, andadvocate for how digital trust initiatives drive growth. For example, companies will
now appreciate that undertaking the CBPR is not only a certification programmethat builds credentials, but ultimately enables innovation, facilitates cross-borderdata flows, and in so doing creates tangible business value.

24

References
Purpose
McKinsey & Company. (2021, December 16). The New Digital Edge: Rethinking
Strategy for the postpandemic era. McKinsey & Company. Retrieved August 24,
2022, from https://www.mckinsey.com/business-functions/mckinseydigital/our-insights/the-new-digital-edge-rethinking-strategy-for-thepostpandemic-era
Chakravorti, B., Bhalla, A., & Chaturvedi, R. S. (2021, August 31). How Digital Trust
varies around the world. Harvard Business Review. Retrieved August 24, 2022,
from https://hbr.org/2021/02/how-digital-trust-varies-around-the-world
Bajwa, K. (2022, January 1). Digital priorities in the new normal. Business Times.
Retrieved August 23, 2022, from https://www.businesstimes.com.sg/lifeculture/digital-priorities-in-the-new-normal
The APAC digital trade opportunity
Deloitte. (July,2022) Accelerating digital government for citizens in the Asia-Pacific:
Deloitte Australia: Economics. Deloitte. (2022, July). Retrieved August 24,
2022, fromhttps://www2.deloitte.com/au/en/pages/economics/articles/acceleratingdigital-government-citizens-asia-pacific.html
World Economic Forum (2022, February) B. How digitalization is making South andSoutheast Asia Engines of growth. World Economic Forum. (2022, February 10).
Retrieved
August
23,
2022,
from
https://www.weforum.org/agenda/2022/02/digitalization-south-southeast-asia/
Devanesan, J. (2022, May 25). Mobile wallets are beating traditional payments in
Apac. Tech Wire Asia. Retrieved August 24, 2022, fromhttps://techwireasia.com/2022/05/its-endgame-for-traditional-payments-asmobile-wallets-emerge-victorious/
An end-state vision for APAC trade
Asian Development Bank. (2022, February 15) A. Trade integration deepens in Asiaand the Pacific Amid Pandemic. Asian Development Bank. Retrieved August24, 2022, from https://www.adb.org/news/trade-integration-deepens-asiaand-pacific-amid-pandemic
Asian Development Bank. (2022, February) B. Asian Economic Integration Report
2022 - Advancing Digital Services Trade In Asia And The Pacific. Retrieved
August 24, 2022, fromhttps://www.adb.org/sites/default/files/publication/770436/aeir-2022highlights.pdf
25World Economic Forum. (2022, August) B The Digital Divide: Why SMEs Must Cross
borders. World Economic Forum. (2022, August 3). Retrieved August 24, 2022,
from https://www.weforum.org/agenda/2022/08/smes-small-mediumbusiness-cross-border-enterprise/
ASEAN. (2015, November). ASEAN Economic Community Blueprint 2025 . Retrieved
August 24, 2022, from https://asean.org/wp-content/uploads/2021/08/8.March-2016-ASCC-Blueprint-2025.pdf
Pepper , R., Garrity, J., & La Salle, C. (2016). Cross-border data flows, Digital
Innovation, and Economic Growth. The Global Information Technology Report2016. Retrieved August 24, 2022, fromhttps://www3.weforum.org/docs/GITR2016/WEF_GITR_Chapter1.2_2016.pdf
Okta. (2021, May). The State of Digital Trust: A snapshot of trust in an increasingly
digital Asian society. Retrieved August 26, 2022, fromhttps://www.okta.com/sites/default/files/202105/ASIA_DigitalTrustReport.pdf
The need for Digital Trust
Yu , E. (2022, February 24). Asia most targeted region in 2021, taking on one in fourcybersecurity attacks. ZDNET. Retrieved August 25, 2022, fromhttps://www.zdnet.com/article/asia-most-targeted-region-in-2021-taking-onone-in-four-cybersecurity-attacks/
Hassan, N. (2019, October 12). Getting digital IDs right in Southeast Asia. The
Diplomat. Retrieved August 26, 2022, fromhttps://thediplomat.com/2019/10/getting-digital-ids-right-in-southeast-asia/
Leung, D., Nolens, B., Arner, D., & Frost, J. (2022, June 16). Corporate Digital
Identity: No silver bullet, but a silver lining. The Bank for International
Settlements. Retrieved August 26, 2022, fromhttps://www.bis.org/publ/bppdf/bispap126.htm
Interoperable regional Digital Identification
Riddhima, D. (2022, April 25). On biometric ids, India is a 'laboratory for the rest of
the world'. The Christian Science Monitor. Retrieved August 30, 2022, fromhttps://www.csmonitor.com/World/Asia-South-Central/2022/0425/Onbiometric-IDs-India-is-a-laboratory-for-the-rest-of-the-world
Nilekani, N. (n.d.). India's Aadhaar System: Bringing E-government to life. Chandler
Institute of Governance. Retrieved August 30, 2022, fromhttps://www.chandlerinstitute.org/governancematters/indias-aadhaarsystem-bringing-e-government-to-life
Singpass – your improved digital ID. Singapore Government Developer Portal. (n.d.).
Retrieved August 30, 2022, from26

https://www.developer.tech.gov.sg/products/categories/digitalidentity/singpass/overview
Nandi, S. (2019, December 12). Aadhaar a game changer but concerns on security
remain. mint. Retrieved August 30, 2022, fromhttps://www.livemint.com/news/india/aadhaar-a-game-changer-butconcerns-on-security-remain-11576090533817.html
Busting the dangerous myths of big ID programs. Access Now . (2021, October).
Retrieved August 30, 2022, fromhttps://www.accessnow.org/cms/assets/uploads/2021/10/BigIDMythbuster.pdf
Corppass. (n.d.). Retrieved August 30, 2022, fromhttps://www.corppass.gov.sg/cpauth/login/homepage?URL=%2Fcorppass%2
Flogin%2Fsplogout&TAM_OP=login
Gupta, D. (2022, March 5). Decentralized identity using blockchain. VentureBeat.
Retrieved August 30, 2022, fromhttps://venturebeat.com/datadecisionmakers/decentralized-identity-usingblockchain/
Monro, S. (2021, October 6). Decentralisation the way forward for Digital Identity
Management in Asia. Frontier Enterprise. Retrieved August 30, 2022, fromhttps://www.frontier-enterprise.com/decentralisation-the-way-forward-fordigital-identity-management-in-asia/
Mutual recognition of Trust Marks
Report: Digital Trustmarks . Next Generation Internet . (2020). Retrieved August 30,
2022, from https://www.ngi.eu/wp-content/uploads/sites/48/2020/01/NGIForward-Digital-Trustmarks.pdf
Elliott, H., & Droemann, M. (2020, January 30). A trustmark for the internet? nesta.
Retrieved August 30, 2022, from https://www.nesta.org.uk/blog/trustmarkinternet/
Enabling cross-border data flows
Advancing data flow governance in the Indo-Pacific: Four country dialogues. World
Economic Forum . (2021, April). Retrieved August 31, 2022, fromhttps://www3.weforum.org/docs/WEF_Data_Flow_Governance_2021.pdf
What is the cross-border privacy rules system. APEC. (n.d.). Retrieved August 31,
2022, from https://www.apec.org/about-us/about-apec/fact-sheets/what-isthe-cross-border-privacy-rules-system
Michalak, M. (2019, April 4). How ASEAN Can Effectively Address the Data Privacy
Conundrum. Business Times. Retrieved August 31, 2022, from27

https://www.businesstimes.com.sg/asean-business/how-asean-caneffectively-address-the-data-privacy-conundrum
Casalini, F., & Lopez Gonzalez, X. (2019, January 23). Trade and Cross-border Data
Flows. OECD iLibrary . Retrieved August 31, 2022, from https://www.oecdilibrary.org/docserver/b2023a47en.pdf?expires=1575651497&id=id&accname=guest&checksum=A9E4AF04E8
F810E54C1A414ED35E32ED
Schrems II Impact Survey Report. DIGITALEUROPE. (2020, November 27). Retrieved
September 2, 2022, from https://www.digitaleurope.org/resources/schremsii-impact-survey-report/
IMDA. (n.d.). Privacy Enhancing Technologies (PET) Sandbox. Retrieved September,
20, 2022, from: https://www.imda.gov.sg/programme-listing/DataInnovation/Privacy-Enhancing-Technologies-Sandbox
Harmonising standards to improve global connectivity
Singapore-led initiatives on Data Management Framework, model contractual clauses
for cross border data flows and information exchange mechanism approved at
first ASEAN digital ministers' meeting. Allen & Gledhill. (2021, February 25).
Retrieved September 1, 2022, fromhttps://www.allenandgledhill.com/sg/publication/articles/17823/ledinitiatives-on-data-management-framework-model-contractual-clauses-forcross-border-data-flows-and-information-exchange-mechanism-approved-atfirst-asean-digital-ministers-meeting
O'Donoghue, C., & Ibraimova , A. (2021, December 22). South Korea granted
adequacy decision. Technology Law Dispatch. Retrieved August 31, 2022, fromhttps://www.technologylawdispatch.com/2021/12/global-datatransfers/south-korea-granted-adequacy-decision/Standard data governance contractual clauses
PDPC: ASEAN Data Management Framework and model contractual clauses on crossborder data flows. Personal Data Protection Commission. (n.d.). Retrieved
September 2, 2022, from https://www.pdpc.gov.sg/help-andresources/2021/01/asean-data-management-framework-and-modelcontractual-clauses-on-cross-border-data-flows
Dispute resolution for regional consumer protection
European Union. (n.d.). Consumer protection and cooperation regulation. Retrieved
September 20, 2022, from https://ec.europa.eu/info/law/law-topic/consumerprotection-law/consumer-protection-cooperation-regulation_en
Modrall, J., & Haverals, J. (2021, December). The CPC network – consumer
protection, EU style. Global law firm | Norton Rose Fulbright. Retrieved
September 1, 2022, from28https://www.nortonrosefulbright.com/en/knowledge/publications/ac43bb19/the-cpc-network-consumer-protection-eu-style
Evaluating approaches for varying levels of Digital Maturity
IT Governance Ltd. (n.d.). Benefits of ISO 27001 Certification. Retrieved 19,
September, 2022, from https://www.itgovernance.eu/nl-be/iso-27001benefits-beContributors
We would especially like to express our gratitude to the following global experts
for their kind contributions to this study.
Japan• Mr. Ken Masuda, Chief Marketing Officer, Blockchain Hub, Inc; and CEO,Global Startup Hub, Inc.
Malaysia• Mr. Ong Kian Yew, CEO, PIKOM (The National Tech Association of Malaysia)
Myanmar• Ye Naing Moe, Director, Information Technology and Cyber Security
Department, Ministry of Transport and Communications• Aung Zayar Lwin, Executive Committee Member, Myanmar Computer
Federation (MCF)
Singapore• Ms. Jane Lim, Deputy Secretary, Ministry of Trade and Industry
Sri Lanka• Dr. Gihan Dias, Professor, Department of Computer Science and Engineering(CSE), University of Moratuwa• Mr. Nadarajah Nirmalan, President of FITIS (Federation of Information
Technology Industry Sri Lanka) Professional Consultancy Chapter (PCC)• Mr. Kushan Sharma, Chief Operating Officer, TechCERT (Cybersecurity
Company)
Taiwan• Dr. Ren Dar Yang, Executive Vice President, Institution for Information
Industry
Thailand• Mr. Wanawit Akhputra, Senior Advisor to Permanent Secretary, Ministry of
Digital Economy and Society (MDES)

29

The Asian-Oceanian Computing Industry Organization (ASOCIO) is a grouping of ICT
industry associations representing the Asian-Oceania region. Established in 1984 in
Tokyo, Japan, ASOCIO’s objective is to develop the computing society and industry
across the Asia Oceania region domain by promoting trade as well as fostering
relationships between its member economies. ASOCIO has created links between
ICT companies and the industry’s growth in member economies.

The explosive epidemic of COVID19 has led to the expansion of activities
in the cyber world by both companies and individuals, including the
expansion of work from home and developments in the European Commission. At
the same time, the way of thinking about cybersecurity has been changing
dramatically worldwide.
ASOCIO recognizes the necessity to review the foundation of cyber technology
utilization and policy vision in response to these changes in theenvironment, and to this end has established the NNEWG (New Normal Expert
Working Group).
NNEWG provides research, analysis, as well as recommendations by experts
from both technical and business perspectives.

30

SGTech, celebrating its 40th anniversary in 2022, is the leading trade association forSingapore's tech industry. Representing over 1,000 member companies ranging
from top multinational corporations, large local enterprises, vibrant small andmedium-sized enterprises, and innovative startups, it is the largest community in
Singapore where companies converge to advocate for change and drive whatenables tech innovation and accelerates tech adoption to spur greater sustainability
in the sector.
SGTech's mission is to catalyse a thriving ecosystem that powers Singapore as a
global tech powerhouse.

Eden Strategy Institute is an award-winning strategy consulting firm that drives
sustainable advantage through social innovation, shared value business models,sustainable transformation, inclusive finance, and impact assessment.
We help corporations, governments, and multilateral organisations plan and set up
industry blueprints, facilitate co-creation, forecast and evaluate the outcomes ofpolicy interventions in creating and sustaining economic and societal impact.
Our Practice Areas include Digital Trust, Smart Cities, Sustainability, Education
Innovation, Value-based Healthcare, and Public Service Transformation. To learn
more about our work, please visit edenstrategyinstitute.com.

3132