114A Evidence Act 1950

Bread & Kaya: Tracing someone online

Bread & Kaya: Tracing someone online
Nov 17, 2014

– Getting the IP address is one way, but may not always be possible
– On issue of defamation, Section 114A has been applied retrospectively

ONE of the most difficult issues to deal with in cybercrime or cyber-bullying cases is finding the perpetrator online. My years of blogging have brought me some experience in dealing with this issue, especially when dealing with ‘trolls.’

I am glad to say that it is not impossible. Some guesswork is needed. Normally, such a perpetrator is someone you know, although he or she may or may not be close to you. Sometimes, however, it would be just a stranger.

There was one case where the perpetrator was found to be a friend’s spouse whom the victim had only met a few times. Strangely, there was no animosity between these parties.

In one case which I was personally involved, I made a guess on the possible perpetrator and worked from there. Eventually, the person confessed after being confronted.

Getting the Internet Protocol (IP) address of the perpetrator is one of the conventional ways to track someone down. Internet service providers (ISPs) assign unique IP address to each user account. However, IP addresses may not be retrievable if the person is on a proxy server.

Another problem is the jurisdictional issue. Many servers storing such IP addresses may be located overseas and owned by foreign entities. One may have to initiate legal action overseas to get such data, and many of these service providers do not release their user information easily due to data protection laws or their strict privacy practices.

In the recent case of Tong Seak Kan & Anor v Loke Ah Kin & Anor [2014] 6 CLJ 904, the Plaintiffs initiated an action for cyberspace defamation against the 1st Defendant.

In tracing the perpetrator, who had posted defamatory statements on two Google Blogspot websites, the Plaintiffs filed an action called a John Doe action in the Superior Court of California. In compliance with the Court order, Google traced the blogs to two IP addresses which were revealed by Telekom Malaysia Bhd to be IP addresses belonging to the 1st Defendant’s account.

In the same case, the High Court had held that the controversial Section 114A (2) of the Evidence Act 1950 applied retrospectively.

S. 114A (2) provides that the burden of proof lies on the subscriber of an ISP to prove that a certain statement was not published by him or her. The 1st Defendant failed to convince the Court that s. 114A (2) does not apply because the defamatory statements were published before the enforcement date of s. 114A(2).

This retrospective stand however was not followed in the case of PP v Rutinin Bin Suhaimin [2013] 2 CLJ 427 as the High Court held that s. 114A does not apply retrospectively.

Perhaps the distinguishing factor between these cases is that the first case involved a civil dispute whereas the latter is a criminal prosecution.

Readers may recall that the #Stop114A campaign was initiated to get this law repealed. I am proud to say that Digital News Asia (DNA) was one of the organisers and participants in shutting down its website for one day. The campaign attracted the attention of Prime Minister Najib Razak but unfortunately, the law remained.

Going back to the case, the Court held that the 1st Defendant had failed to prove that he was not the publisher of the content. The 1st Defendant is now liable for a payment of RM600,000 (US$180,000) as damages to the Plaintiffs.

Not all tracing of a perpetrator requires an IP address. In Datuk Seri Anwar Bin Ibrahim v Wan Muhammad Azri Bin Wan Deris [2014] 3 MLRH 21, Opposition leader Anwar Ibrahim (pic) sued Wan Muhammad Azri Bin Wan Deris, allegedly a well-known blogger called Papagomo, for defamation.

In proving the identity of Papagomo, instead of tracing the IP address of Papagomo, the Court relied on the statement of a person who had met Papagomo in person before. The former also took a picture with Papagomo and this picture was tendered in Court.

There are other unconventional methods to identify a person online. I have heard of a private investigator entering a person’s home without knowledge to gain access to the computer of that person.

Many people do not password-protect their home computers and leave their email and other online accounts still logged into. This allows the private investigator to easily access a person’s emails and other online accounts without any technical skills.

One method that I always use is to find something unique in the content posted by the perpetrator. For example, I recently concluded that a website was held by a cyber-squatter by doing a Google search on certain sentences that appeared on the website. The cyber-squatter’s website looked like a legitimate website, but the search revealed that the same facade had been employed by the cyber-squatter on several websites using well-known brand names.

If there are images involved, a Google Image search would be useful to find whether other websites are hosting the same image.

It is of utmost importance that one must have reliable evidence to prove the identity of a perpetrator before suing or charging them. The person doing such investigation should be knowledgeable enough to conduct the investigation, know the rules of producing evidence and testifying in Court, and to thwart all challenges by the perpetrator’s lawyers.

Failure to do so would result in the case being dismissed or in a worst scenario, an innocent person being charged or sued in Court.


First published on Digital News Asia on 17 November 2014.

Netizens v the Government

2012 saw the intensified battle between netizens and the authorities. The former desires protection of their right to freedom of expression and anonymity whereas the latter desires control and governance. Through this battle, the authorities introduced many new legislations to govern the use of internet.

In July 2012, the Malaysian Government enforced s. 114A of the Evidence Act 1950 (114A). Under 114A, a person is deemed to be a publisher of a content if it originates from his or her website, registered networks or data processing device of an internet user unless he or she proves the contrary. This new law sparked a massive online protest dubbed the Malaysia Internet Black Out Day or also the Stop114A. Protesters replaced their Facebook and Twitter profile picture with the Stop114A banner whereas website operators displayed the Stop114A banner on their websites. Within two days, the Stop114A Facebook gained 43,000 likes from 400 likes (currently 49,000). It is probably one of Malaysia’s most successful online campaigns.

On the business side, the Association of the Computer and Multimedia Industry of Malaysia (Pikom), who represents the information and communications technology (ICT) industry in Malaysia, backed calls for a review of 114A whereas the Federation of Malaysian Manufacturers (FMM) has expressed concerns over the recent inclusion of 114A and its impact on businesses.

Interestingly, the Malaysian Government passed the Cyber Centre and Cyber Cafe (Federal Territory of Kuala Lumpur) Rules 2012 and Consumer Protection (Electronic Trade Transactions) Regulations 2012. The former requires any person operating a cybercafé and cyber centre to maintain a customer entry record and a record of computer usage for each computer whereas the latter requires online business owners and operators to provide their full details, terms of conditions of sale, rectification of errors and maintenance of records.

Philippines netizens also protested against their newly introduced cyberlaw. In October 2012, Philippines passed the Cybercrime Prevention Act of 2012 with the aim to prevent cybersex, online child pornography, identity theft and spamming. However, under the new act, a person found guilty of libellous comments online, including comments made on social networks such as Facebook and Twitter or blogs, could be fined or jailed. In protest against the new law, anonymous activists hacked into government websites, journalists have held rallies and many Facebook users have replaced their profile picture with a black screen. Protesters say the new law could be used to target government critics and crack down on freedom of speech.

Japan netizens on the other hand had milder protest against a new law that makes Japan-based internet users who download copyright infringing files. Violators will face up to two years in prison or fines of up to two million yen. In July 2012, about 80 masked people, calling themselves allies of the global hacker group Anonymous, picked up litter in Tokyo Saturday as a sign of protest.

In early 2012, China required users of the popular microblogging platform, Weibo, to register their real names. Subsequently, later in the year, China legalized the deletion of posts or pages which are deemed to contain “illegal” information and required service providers to hand over such information to the authorities for punishment.

On a brighter note, the South Korean Constitutional Court ruled that a law requiring South Koreans to use their real names on Internet forums was unconstitutional. The Court said that the requirement amounts to prior censorship and violated citizens’ privacy.

In the United States, a handful of US states, including Illinois, California and Maryland, passed laws making it illegal for employers to ask for potential employees’ Facebook or other social media passwords.

A person who retweets a defamatory tweet is potentially liable for defamation. In the UK, Lord McAlpine (Robert Alistair McAlpine) a former politician who worked for Margaret Thatcher, announced his intention to pursue action against 10,000 Twitter users for defamation including those who had retweeted the defamatory tweets. In this case, Lord Alphine was linked by some social media users after BBC News reported that a senior politician was involved child sex abuse. Interestingly, these users may apologize to Lord McAlphine by completing a form downloadable from his solicitors’ website!

In the UK, it is an offence to publish the identity of victims of certain offences which include rape. Footballer Ched Evans was convicted by the Court for rape of a 19 years old woman. The woman’s name was circulated on social networking sites, including Twitter and Facebook, after Evans’ conviction. 9 people were fined after admitting to revealing online the identity of the woman.

Meanwhile back home, the Kota Kinabalu High Court overturned Rutinin Bin Suhaimin’s acquittal for posting an “annoying” comment on the Sultan of Perak’s website. Rutinin was charged under s. 233 of the Communications and Multimedia Act 1998. The Sessions Court had earlier acquitted him without calling for his defence because, among others, the prosecution failed to prove that Rutinin was the person who posted the insulting comment. The Court held that, although 114A of the Evidence Act 1950 is not applicable because the alleged offending act was committed before the enforcement date of 114A, the circumstantial evidence is sufficiently strong to conclude that the accused had used the internet account that was registered in his name at the material time.

The developments in 2012 show the involvement of the authorities in clamping down the notion of the Internet being the Wild, Wild West. However, such clap down must be monitored by netizens.

In December 2012, the International Telecommunication Union (ITU) brought together regulators from around the world to re-negotiate a decades-old communications treaty. Google and 1000 over organizations around the world claimed that some governments want to use the closed-door meeting to increase censorship and regulate the Internet and had started an online campaign.

At the end of the closed-door meeting, 89 countries including Malaysia signed the treaty, while 55 countries said they would not sign or that additional review was needed.

With the new technology, websites and novel functions, all Governments will have to step out their game to protect the rights of netizens and businesses. New laws must not be onerous but in the same time protect victims of cybercrimes and preserve the right of freedom of expression.



This article was supposed to be published in the Putik Lada of The Star Newspaper. It was also supposed to be the 2013 installation of my yearly social media update articles. Unfortunately, The Star Newspaper discontinued the Putik Lada column before my article could be published.

GE13 Candidates and 114A

Published on LoyarBurok on 16 April 2013.



I am no expert in election laws but GE13 Candidates should take note of this. If you are running a blog, I suggest you moderate or close the comments section until and after the 13th General Election.

The reason why I say so is because s.114A(1) of the Evidence Act 1950 and the Election Offences Act 1954. S. 114A(1) provide the following:

“A person whose name, photograph or pseudonym appears on any publication depicting himself as the owner, host, administrator, editor or sub-editor, or who in any manner facilitates to publish or re-publish the publication is presumed to have published or re-published the contents of the publication unless the contrary is proved”.
In simple words, if your name, photograph or pseudonym appears on any publication depicting yourself as the aforesaid persons, you are deemed to have published the content unless you prove otherwise.

Also, if you have in any manner facilitated to publish or re-publish the publication, you are presumed to have published the content of the publication.

This means that website owners are deemed to be publishers of contents of a publication although the author of the publication is someone else.

Further, it is not possible for website owner to prove that he is not a publisher due to the wording of the section i.e. the words “in any manner facilitates to publish or re-publish the publication”. By providing a virtual platform, the website owners facilitate to publish or re-publish a publication.

In this regard, you will potentially commit an election offence if someone posts a comment which falls within the scope of corrupt practice. If found guilty of an election offence, the election of a candidate will be declared void (s. 32 of the Election Offences Act 1954).

What I have mentioned is not without basis. A similar scenario had happened after the 12th General Elections. In Kho Whai Phiaw v Chong Chieng Jen (Election Petition No.: 26-01-2008-I), an elector in the Bandar Kuching constituency presented an election petition to have Mr. Chong Chieng Jen’s (representative of the Democratic Action Party (DAP)) election declared void.

The elector sought to have Mr Chong’s election avoided on the ground that the latter had engaged in the corrupt practice of (i) undue influence and (ii) bribery, to procure his victory in the election. The elector alleged, among others, that a letter from one Mr Smith published on the comment section of Mr Chong’s blog site is said to contain certain threatening statement. The elector alleged that Mr Chong had exercised undue influence over the non-Muslim voters in the Bandar Kuching constituency through Mr Smith’s letter appearing on his blog site.

Fortunately for Mr Chong, the High Court held that Mr Smith’s letter was posted by one commentor by the name “Responsible Christian Voter” (‘RCV’). Mr. Smith was the author of the letter and it was RCV who published that letter through Mr Chong’s blog site. The Court held that Mr Chong is therefore not the publisher of the letter. The case is later upheld by the Federal Court. (see Kho Whai Phiaw v Chong Chieng Jen [2009] 3 CLJ 201)

But Mr Chong’s case is pre-114A case. If s. 114A applies, Mr Chong is considered as the publisher of the letter as his blogsite had facilitated the publication of the letter. Mr Chong could potentially commit an election offence if 114A applies. That is the effect of 114A. It creates liability on a virtual platform provider.

This, of course, is not tested in our Courts yet. One may argue that it is the blogsite provider (e.g. Google who owns Blogger.com) but this is only provided that such blog is hosted by such blogsite provider.

Nevertheless, as an abundance of caution, GE13 candidates should close their blog comments section to avoid such actions. Interestingly, Mr Chong’s blogsite has closed its comments section.

A Facebook Page is also another concern. It may be arguable to say postings made by users on a Facebook page is not published by the Facebook page administrator as it appears on a separate page. (Illustrated below).

However, Facebook comments appearing together with the postings by the Facebook administrator (illustrated below) is different. It is arguable that such comments are published by the Facebook page owner.

With this risk of having an election declared void, I hope that the new Parliament will relook into 114A when it convenes in the future.

It’s time to #stop114A.

Bread & Kaya: Looks can be deceiving!

My 3rd issue of Bread and Kaya was published by Digital News Asia on 7 March 2013.

Bread & Kaya: Looks can be deceiving!

– Under Malaysian laws, what amounts to obscene, indecent, false, menacing or offensive in character is quite wide
– Sessions Court decisions perhaps the reasons why Section 114A of the Evidence Act 1950 was introduced

Bread & Kaya by Foong Cheng Leong

A COUPLE of weeks ago, I received a message with the title “Looks can be deceiving!” on my blog’s Facebook page, from an unknown user.

In the message, the user claimed that a certain celebrity was having an affair with another celebrity. Unknown to the user, I happen to know former and I alerted that celebrity.

A day after that, the user deleted her account! Fortunately, I saved a screenshot of the message.

Coincidentally, I found that someone had searched for the celebrity’s name on the day the message was sent and landed on my blog. My blog captured the transaction, together with the Internet Protocol (IP) address, time-stamp and other details. It was the only transaction searching for the celebrity’s name.

There was also a record to show that the user clicked on the link to my blog’s Facebook page. From this, there is a possibility that the author had found my blog using the celebrity’s name (and my blog appears on the first page of search results) and decided to send me that message.

A query on the IP address shows that the user resides in Malaysia and is thus subject to the laws of Malaysia. The celebrity may file an action in court to obtain the user account details of the IP address if she wishes to. Alternatively, she may make a police report against that person.

The lesson of the story is: If you want to do naughty things online, remember to mask your tracks (e.g. by using proxies); otherwise the law will come knocking on your door. Internet trolls have been living amongst us and many still roam the streets of cyberspace.

This brings me to the topic of this article: Section 233 of the Communications and Multimedia Act 1998.

Section 233 makes it an offence to post any content which is obscene, indecent, false, menacing or offensive in character with intent to annoy, abuse, threaten or harass another person.

Anyone who does so is liable to a fine not exceeding RM50,000 or to imprisonment for a term not exceeding one year, or both, and shall also be liable to a further fine of RM1,000 for every day during which the offence is continued after conviction. It’s a widely used tool by law enforcers to nab Internet trolls.

[RM1 = US$0.32]

What amounts to obscene, indecent, false, menacing or offensive in character is quite wide. Making prank emergency calls (PP v Sow Kuen Chun; Criminal Case No. 63- 01- 2008); and insulting the Sultan (PP v Muslim bin Ahmad; [2013] 1 AMR 436); offensive comments (Nor Hisham Bin Osman v PP; Criminal Case No: MTJ(2)44-14-2010)), and (PP v Rutinin Bin Suhaimin (Criminal Case No. K42-60-2010)) are examples where people were charged under Section 233.

[Click links above to download case files]

PP v Muslim bin Ahmad and PP v Rutinin Bin Suhaimin are both recently decided cases and they relate to the Perak constitutional crisis. Both men had allegedly posted offensive comments towards the Sultan of Perak after Barisan Nasional took over the state of Perak. Both men alleged that they did not post the comments, notwithstanding that the IP addresses point to them.

Muslim bin Ahmad was acquitted by the Sessions Court and Rutinin bin Suhaimin was discharged by the Sessions Court without his defense being called. The prosecution had apparently failed to show that the persons who posted the offensive comments were the accused.

I am told that the impact of the said Sessions Court decisions was one of the reasons why Section 114A of the Evidence Act 1950 was introduced – that is, to facilitate the prosecution in proving the identity of the maker.

To recap, under Section 114A, a person is deemed to be a publisher of a content if it originates from his or her website, registered networks or data processing device of an Internet user unless he or she proves the contrary.

This new law sparked a massive online protest dubbed the Malaysia Internet Black Out Day or also the Stop114A.

However, the High Court subsequently overturned said Sessions Court decisions. Rutinin Bin Suhaimin’s defense was called. Interestingly, the learned High Court judge was of the view that calling the Sultan of Perak names has the tendency to cause annoyance or abuse to any person, thus falling within the ambit of Section 233.

Muslim Bin Ahmad was handed a fine of RM10,000 for each charge and six months’ imprisonment. He pleaded for a “binding over order” (released on probation).

However, the learned High Court Judge warned that a binding over order “would send the wrong message to would be offenders and the public at large that offensively uncontrolled and virulent comments can be indiscriminately posted on the Internet without any or serious repercussions. And that is not a message that this court would like to send out.”

Surprisingly, Section 114A of the Evidence Act 1950 was never relied on by the Courts. In fact, the High Court in PP v Rutinin Bin Suhaimin said that 114A is not applicable because the postings were made before the enforcement date of 114A (July 31, 2012).

This ruling is interesting as it may be a defense for website owners who can argue that 114A does not apply to posting made by their users prior to July 31, 2012.

Nevertheless, these laws and cases serve as a reminder that the Internet is not a ‘wild, wild west.’ Netizens need to be accountable for what they say. Further abuse by netizens attracts further legislations by Government.

Unfortunately, website owners now face the brunt of 114A due to the actions of their users. Their pleas for the repeal or amendment of 114A are still unanswered.

Bread & Kaya: Attention e-commerce businesses: Fraud, the law and you

My Bread & Kaya’s second column was published on Digital News Asia on 29 January 2013.


Attention e-commerce businesses: Fraud, the law and you
Jan 29, 2013

– A new law to protect users of online trading portals goes into effect July 1
– While it may cost them a bit, operators of such businesses will have to comply

Bread & Kaya by Foong Cheng Leong

E-COMMERCE is booming in Malaysia. Euromonitor International estimated that Internet retailing in Malaysia reached RM842 million (US$268.3 million) in 2011; Goldman Sachs forecasts that e-commerce in Malaysia is projected to hit RM3.4 billion (US$1.1 billion) this year with a 30% year-on-year growth.

Notwithstanding such growth, online fraud is rampant in Malaysia. If you scour our online auction or listing websites, you’ll find many dodgy sellers and buyers selling or offering to buy products and services.

But the long arm of the law recently caught Mohd Yunus Jan Muhammad for approaching six victims who had advertised to sell their gadgets through an Internet trading portal, by posing as a customer and setting up appointments. At these meetings, he would grab the merchandise and flee. He was sentenced to one year’s jail. The Court also fined and imposed a whipping on Mohd Yunud.

Sometime in 2011, the Ministry of Domestic Trade, Co-operatives and Consumerism proposed that the Electronic Commerce Act 2006, an act that regulates online commercial transactions, be amended to regulate the online market place industry. I am told that consultation was held with the industry and I understand that some industry players had taken steps to lobby against the amendment.

In April 2012, its minister Datuk Seri Ismail Sabri Yaakob announced that the amendment would ensure that electronic transactions could be done in a safer and secured environment.

The law came about in the form of the Consumer Protection (Electronic Trade Transactions) Regulations 2012 (“Regulation“), a regulation under the Consumer Protection Act 1999.

The Regulation will be in force on July 1, 2013. Under this Regulation, an online marketplace operator is required to, among others, provide their full details, terms of conditions of sale, rectification of errors and maintenance of records.

The new law applies to two (2) types of persons namely:

– A person who operates a business for the purpose of supply of goods or services through a website or in an online marketplace (“Online Business Owner“). “Online marketplace” means a website where goods or services are marketed by third parties for the purpose of trade. This may include your typical blog shops and sellers with accounts with eBay, Lelong and Mudah online stores.

– A person who provides an online marketplace (“>Online Marketplace Operator“). This may include group buying websites operators such as GroupOn, auction and listing websites such as eBay, Lelong and Mudah, and online shopping websites where third party products as sold such as Zalora.

Online business owners

Under the Regulation, Online Business Owners shall disclose on the website where the business is conducted and the following information, failing which the operator commits an offence.

  • The name of the person who operates a business for the purpose of supply of goods or services through a website or in an online marketplace, or the name of the business, or the name of the company.
  1. The registration number of the business or company, if applicable.
  2. The e-mail address and telephone number, or address of the person who operates a business for the purpose of supply of goods or services through a website or in an online marketplace.
  3. A description of the main characteristics of the goods or services.
  4. The full price of the goods or services including transportation costs, taxes and any other costs.
  5. The method of payment.
  6. The terms and conditions.
  7. The estimated time of delivery of the goods or services to the buyer.

Any person who discloses or provides the above information that he knows or has reason to believe is false or misleading, commits an offence.

Online Business Owners shall also:

  • – provide the appropriate means to enable the buyer to rectify any errors prior to the confirmation of the order made by the buyer; and
  • – shall acknowledge receipt of the order to the buyer without undue delay.

The order and the acknowledgement of receipt shall be deemed to have been received by the person who operates a business for the purpose of supply of goods or services through a website or in an online marketplace and the buyer, respectively, when the person and the buyer are able to access to such order and the acknowledgement of receipt.

The Online Marketplace Operator shall take reasonable steps to keep and maintain a record of the names, telephone numbers and the address of the person who supplies goods or services in the online marketplace, for a period of two years, failing which an offence is committed.

In addition to the terms and conditions, Online Business Owners and Online Marketplace Operators must comply with the Notice and Choice Principal provided by Personal Data Protection Act 2010 by inserting a privacy notice, in the National and English languages, on their website before the collection of any personal data.

Extra costs for businesses

Although this law seeks to protect consumers from unscrupulous traders, the introduction of this new law increases the startup costs and cost of operation of an e-commerce business.

Engaging lawyers to draft terms and conditions for e-commerce businesses can be expensive. But it is something any e-commerce business should invest in to protect themselves and their users.

The new law doesn’t specify in detail how the terms and conditions should be. Therefore, one can have a very simple set of terms and conditions.

Alternatively, one may opt to adopt the terms and conditions of other e-commerce businesses provided that one is well versed in drafting and amending agreements. But one should take note that every set of terms and conditions is customized for specific businesses.

It would be ideal if we have affordable online services to draft terms and conditions and privacy policies for SMEs (small and medium enterprises) like SnapTerms, which allows start-up companies the opportunity to customize their website’s terms and conditions without having to pay the fees typically associated with having the documents drafted by a lawyer.

But one must bear in mind that SnapTerms is a service provided by people who are well versed in the laws of their country and perhaps not Malaysia.

To digress a little, e-commerce businesses should also protect their intellectual property such as their trademarks, copyright and patents. These rights are registerable and one can protect these rights in Malaysia by filing them with the Intellectual Property Corporation of Malaysia or MyIPO.

Other than that, it is pertinent to protect your brand from being taken in well-known social media websites like Facebook and Twitter. You can use Knowem to check for the use of your brand, product, personal name or username instantly on over 550 popular and emerging social media websites.

Closing

The introduction of laws to track and record Internet transactions is nothing new. Last year, Section 114A of the Evidence Act 1950 and Cyber Centre and Cyber Cafe (Federal Territory of Kuala Lumpur) Rules 2012 were introduced to track and record such transactions.

These laws will not be the last. I foresee that many more such laws will be introduced in the near future.

Download:
Consumer Protection (Electronic Trade Transactions) Regulations 2012

Docudeer – Your source of sample legal agreements and documents!
1. General Terms of Services
2. Comprehensive e-Commerce Terms & Conditions
3. Simple e-Commerce Terms & Conditions (Free!)
4. General Privacy Policy

PDPA: Businesses have responsibilities and burdens

I was invited to contribute to a monthly column in Digital News Asia which I named it as Bread & Kaya. The column will have legal news relating to intellectual property, cyberlaws, franchise, data privacy and the like.

My first article “PDPA: Businesses have responsibilities and burdens” was published on 31 December 2012.



Dec 31, 2012

  • PDPA comes into force Jan 1, 2013, and companies have three months to comply
  • Many have waited, and now may not have enough time to processes in place
  • Bread & Kaya by Foong Cheng Leong

    WELCOME to the inaugural Bread & Kaya column! The term is a Malaysianized version for bread-and-butter. This column aims to be your bread-and-kaya serving of legal news relating to intellectual property, cyberlaws, franchise, data privacy and the like.

    You may have read some of my articles in The Star’s Putik Lada column or in LoyarBurok. If this is the first time you’re reading my articles, “Hello.”

    Without a doubt, 2013 will be an interesting year for businesses. Many new laws and regulations will be introduced, and the Personal Data Protection Act 2010 (PDPA) is one of them.

    It was reported that the PDPA would come into force on Jan 1, 2013. Businesses have three months from the date of enforcement to comply with the Act. Similarly, Singapore will have its own Personal Data Protection Act 2012 coming into force on Jan 2, 2013.

    Notwithstanding the reported enforcement date of Jan 1, 2013, there is no official government gazette confirming this as I write this column. Thus, the PDPA would still not be in force until such a government gazette is published.

    What is the PDPA?

    The PDPA provides that any information that directly or indirectly relates to a data subject (i.e. individual) who is identified or identifiable from that information, is personal data. This information may take various forms, such as your name, passport number, telephone number and email address.

    A person who processes personal data is called a data user. Companies processing individual customers or employees’ personal data must comply with the PDPA.

    Under the PDPA, a data user, in processing personal data, must comply with the following principles:

    (1) General Principle;
    (2) Notice and Choice Principle;
    (3) Disclosure Principle;
    (4) Security Principle;
    (5) Retention Principle;
    (6) Data Integrity Principle; and
    (7) Access Principle.

    Failure to abide by any of the above principles amounts to an offence. Upon conviction, the data user is liable to a fine not exceeding RM300, 000 or to imprisonment for a term not exceeding two (2) years or to both (S. 5(2) PDPA).

    [RM1 = US$0.33]

    Under these principles, the collection and use of personal data must be consented to by the data subject and steps must be taken to ensure that the data is stored securely. The processing of personal data cannot be excessive in relation to the purpose or related purpose of which the personal data is collected.

    Adequate notice must be given to data subjects that their personal data will be processed, used, and the purpose of the same. Such notice must be in writing and in the Malay and English languages. Personal data no longer in use has to be destroyed.

    Further, personal data cannot be transferred outside Malaysia unless such a place is specified by the Government, consented to by the data subject, or is necessary for the performance of a contract between the data user and the data subject.

    The PDPA only applies to personal data processed in relation to “commercial transactions.”

    What do you need to do?

    If you are processing employees or individuals customers’ personal data, you are advised to, among others:-

  • Access how the PDPA affects your organization;
  • Prepare a privacy notice, in Malay and English, to be issued to potential and current employees or customers;
  • Prepare a Personal Data Policy to govern the processing and handling of personal data by employees;
  • Prepare a Retention Policy for employees or customers’ personal data and audit the personal data of previous employees or customers in order to dispose personal data that are no longer in use;
  • Establish a data access procedure for employees or customers to access their personal data;
  • Ensure that the storage of the employees and customers’ personal data is secure;
  • Ensure that personal data is only disclosed for the purpose in which the personal data is collected and not disclosed to unrelated parties;
  • Ensure that the relevant personnel such as Human Resource or customer relationship staff are adequately trained in data protection laws and practice;
  • Review data collection forms so that personal data is not collected excessively; and
  • Ensure that personal data are transferred overseas lawfully.
  • Consent

    The word consent is not defined in the PDPA. However, in early December 2012, Deputy Minister of Information, Communications and Culture Datuk Joseph Salang announced that “whenever consent is required for data processing, it’ll have to be given expressly rather than impliedly or be assumed.”

    This would mean that there must be some sort of active communication between the parties. For example, if a company wishes to obtain more information about an individual, the former would need to get the individuals’ express consent by contacting the individual.

    In this regard, all companies will need to ensure that all possible purposes for processing the personal data are set out before the collection of the data. Additional procedures may need to be established to ensure consent is captured.

    Express consent can be gained in a variety of ways — for example by filling in a form, ticking a box on a website, over the phone and face-to-face.

    Although express consent seems to give individuals added protection, this is not necessarily true. Malaysia’s restricted view on the definition of consent will have an impact on businesses and individuals. Additional cost will be incurred in establishing new procedures and practices such as new forms, storage, impact analysis and compliance exercises. Individuals may also be swamped with requests for consent from time to time, although the individual would ultimately consent.

    Companies will need to wait for individuals’ express consent before they can roll out new projects.

    To give an example on how the PDPA will affect business:

    Company X wishes to roll out a new security system to enter the office. The system utilizes the employees’ personal data as unique identifiers. In view of the express consent requirement, Company X will need to get the employees’ express consent to use employees’ personal data. If certain employees refuse to do so, such system cannot be fully utilized.

    In the event that a data subject disputes that express consent had been given, the data user will need to show that express consent had been given. Assuming that we adopt the implied consent regime, it is arguable that a data subject had implied consent to processing of personal data if the data subject uses the data user’s services.

    However, with express consent, evidence must be provided and this may be difficult, especially in electronic transactions.

    In such a case, Section 114A of the Evidence Act 1950 may be helpful to data users as it puts a presumption of publication by a person if his or her name appears on a particular content. The affected individual will need to prove that he did give express consent. This may be costly, highly bureaucratic and time consuming.

    Closing

    The PDPA is supposed to bring an end to unsolicited communication, but it will cause drastic changes to Malaysian businesses.

    Much valuable commercial data will be lost due to the PDPA. It is noted that many Malaysian industries had taken the wait-and-see approach. This is alarming considering that three months to comply with the PDPA will probably be not enough.

    The Personal Data Protection Department recently issued Malaysian Personal Data Protection Department’s Public Consultation No. 2/2012 entitled “Class Of Data User Under The Personal Data Protection Act 2010 And Proposed Fees” which sets out the class of data users that is required to register with the Commission. [Click here to download].

    The release of such consultation paper is commendable. I hope that the Commission or the Personal Data Protection Department will issue more of these consultation papers and guidelines on the interpretation of the PDPA.

    Internet: Guilty until proven innocent

    Following from the forum “Section 114A Evidence Act: Crime-busting or Online Control?” organised by Centre for Independent Journalism (CIJ), Selangor Times reported the following:-

    Writer: Basil Foo
    Published: Fri, 15 Jun 2012

    KUALA LUMPUR: Internet users whose accounts are hacked into will be presumed guilty for unlawful online posts by the actual perpetrators under recent amendments to the Evidence Act, something that is being criticised as absurd.

    The Evidence (Amendment) (No 2) Act 2012 will reportedly hold Internet users liable for any content posted through their registered networks or data processing devices.

    “For example, if someone parks outside your house and uses your Wifi to post (illegal content online),” said KL Bar Council IT committee co-chairman Foong Cheng Leong.


    Participants are all ears at the forum.

    He was speaking during the “Section 114A Evidence Act: Crime-busting or Online Control?” forum at the KL-Selangor Chinese Assembly Hall recently.

    Foong said laws presuming guilt have always been around, including for individuals who were deemed to be traffickers if they were arrested with a certain amount of drugs.

    “The Dangerous Drugs Act (discourages) people from carrying drugs. Will this Act (discourage) people from using the Internet?” he asked.

    Center for Independent Journalism (CIJ) director Jac SM Kee said the Act was illogical as victims who sought help after their accounts had been hacked or report the crime to police may find themselves behind bars.

    Even if someone else posts an offensive comment on a person’s Facebook wall, the latter could be found guilty.

    “Business will be affected. If they provide Wifi (and offensive items are posted through their connection), they are responsible,” said BFM Media Sdn Bhd producer Jeff Sandhu.

    He said if restaurants in the city are required by law to provide free Wifi and their Internet connections are open to abuse by irresponsible users, business owners will find themselves caught between a rock and a hard place.

    Digital News Asia executive editor A Asohan said the Act put average Internet users at the mercy of tech-savvy users who could abuse the former’s unsecure Internet connections.

    He said an analyst from investment firm Mackenzie traced 4.1 per cent of the nation’s Gross Domestic Product (GDP) coming from online activities.

    “You want to create a high income nation, this is going to put damper on it. You can’t have an Internet community when people fear to go on the Internet,” he added.

    Lawyers: Act will result in more cautious Net users

    I was quoted in The Star’s recent article on the amendments of the Evidence Act 1950.

    PETALING JAYA: The newly-amended Evidence Act will potentially result in a wave of more cautious Internet users, say lawyers, as the onus is now on the person to prove they did not post or create offending material.

    If one is hauled up, however, maintaining innocence might prove to be tricky unless Internet users are more thorough with safety measures, they said.

    “Witnesses or documents would suffice, depending on circumstan­ces.

    “However, if you’re a website owner and someone posts such comments, there’s no way out,” said KL Bar IT Committee co-chairman Foong Cheng Leong.

    Foong advised Internet users to secure their WiFi connection, frequently update their anti-virus software, use strong passwords and refrain from retweeting or republishing anything dubious or unverified.

    “Or, you could stop using the Internet and start sending snail mail,” he commented, tongue-in-cheek.

    Lawyer and activist Edmund Bon said that in the case of anonymous comments, there was al­ways the option of tracking IP addresses.

    1 2  Scroll to top