Akta Perlindungan Data Peribadi 2010

Personal Data Protection Act 2010: Our details are worth protecting

I was quoted by Rakyat Post in their article “Personal Data Protection Act 2010: Our details are worth protecting.



Personal Data Protection Act 2010: Our details are worth protecting

The Personal Data Protection Act 2010 intends to protect personal data and stop it from being distributed.

THE Personal Data Protection Act 2010 is necessary because personal data is often the cause of constant unwelcome calls from companies, and can be used by malicious people to break into networks.

Personal Data Protection Department Deputy Director-General Dr Zainal Abidin Sait said personal data used in commercial transactions had value while personal data available online may not.

“My name on Facebook would not be useful for marketing. I don’t give my real information in Facebook, but in commercial transactions, I give my real name, my real data.”

He said there were penalties for those who did not adhere to the law, but that was not the reason the law was gazetted.

“The intention of this law is not to issue summonses to people. The intention of the law is to ensure the personal data of all Malaysians, which is collected from all over the place by these agencies, is managed properly and systematically.”

Zainal Abidin also said the PDPA would not hamper doctors and banks.

This is because for doctors, processing without consent can still be carried out with conditions, while banking transactions made via contracts do not fall under the law.

Solicitor Foong Cheng Leong said laws similar to the Personal Data Protection Act (PDPA) 2010 had been implemented around the world.

“But in Southeast Asia, we are the first to come up this law. Singapore has a similar law. It came after ours, but came into force earlier than us.”

Foong is a lawyer focusing on Intellectual Property, Information Technology, Internet, Social Media and Cyber laws, Franchise, Privacy and Data Protection laws.

In the past, people had been selling personal data without repercussions, but that will all change now.

“The new law is to protect personal data and stop it from being distributed. Now under the law, it is subject to consent. If individuals want to receive all these things, then they (the companies) can send. Otherwise they can’t,” Foong said.

Websense Inc Asia Pacific Sales Engineering Director William Tam pointed out that personal information was highly valuable, not just to sell insurance or credit cards.

“When we look at what happened at many large retailers over the years, such as TJ Maxx and Target, personal data was pure gold to people with a malicious intent.”

He said cybercriminals were not just after credit card details as even simple personal contact details could be used in social engineering to create a very powerful lure that could be the way into a company’s network and lead to a highly targeted attack.

“Once individuals understand their rights under the PDPA, they can be the key driving force in encouraging businesses to comply with the same standard.”

There is no need for the Personal Data Protection Act 2010 because customer information is already treated with complete confidentiality, say stakeholders.

THE Personal Data Protection Act 2010 is unnecessary for the banking and health industry. It also hinders insurance agents and marketers in conducting their business.

Although banks will comply with the Act, Association of Banks in Malaysia (ABM) Executive Director Mei Lin Chuah said it was already common practice in banks to respect the personal data of those who bank with them.

“All this while, our members have taken the necessary steps to ensure that customer information is treated with the greatest of confidentiality as a matter of policy which, in a certain fashion, has now become a requirement of law.

“Our member banks have in place controls and systems to ensure that customer information is kept confidential at all times.

“Further to this, banks have their strict internal rules on confidentiality and information security which all bank employees must abide by. Failure to comply with the internal rules will lead to disciplinary action against the employee,” said Mei.

Malaysian Medical Association (MMA) President Datuk Dr N.K.S. Tharmaseelan said including doctors under the Act was redundant. It was unfair to slap them with a fine as no announcement on this had been made earlier, he added.

“The Commissioner of the Personal Data Protection Department did not send out any circular whatsoever to inform doctors about this registration exercise, but still expects all to know,” said Dr Tharmaseelan in a statement.

“Doctors were given till Feb 15, 2014 to register or be slapped with a fine of RM500,000.

“It appears redundant as the doctors are strictly regulated by MMC on confidentiality. Doctors now have to face this additional burden.

“Doctors have always been guided by the Hippocratic Oath since the birth of modern medicine, but now we have a law which has become a hippopotamus that will run through our practice.

“This was another law passed without consulting stakeholders, in this case doctors. But we hope common sense will prevail and an exemption is granted,” said Dr Tharmaseelan.

Insurance agents, direct sellers and telemarketers rely on gathering personal information to find customers.
“Basically, information about people can’t be passed around any more without their permission,” said an insurance agent who did not want to be named.

The Act made it more difficult to initiate contact with a person through the telephone, which is known as “cold calling”, and is often done using bank databases sold by middlemen.

“When you apply for a loan or credit card, whatever information you give them is what these databases will contain,” said the agent, adding that direct sellers and telemarketers relied heavily on such databases to make sales.

各界需時間落實‧資料保護令或再延遲

I was quoted by Sin Chew in the article below regarding the impending Personal Data Protection Act 2010.


雪蘭莪‧八打靈再也14日訊)為保護國人個人隱私的《2010年個人資料保護法令》一再展延生效,在寬限期於本月16日屆滿後,若該法令指南再有更動,生效日期將再展延。

個人資料保護局公關諾韓妮占對星洲日報說,現階段總檢察署正探討該法令的相關指南,若有任何更動,則該法令將不會於後日生效。
她受詢及《2010年個人資料保護法令》寬限期於16日屆滿一事指出,若總檢察署電子憲報(e-Federal Gazette)明日仍沒有公佈法令的實施日期,則法令有可能再展延生效。

諾韓妮占:瞭解公司需時執行
詢及該法令一再展延的原因,諾韓妮占透露,該局在諮詢公眾意見後,瞭解到各商家及公司需要時間執行該法令,因此才會展延。
“這個法令隨時可以實行,但牽涉其中的公司等需要時間擬定對策及整理資料,如確保所有客戶的資料是最新的等等,否則他們就是違反了該法令。”

“若該法令確定在16日開始生效,通訊及多媒體部長拿督斯里阿末沙比里當天在吉打出席活動時就會做出公佈。”
個人資料保護局(JPDP)是通訊及多媒體部旗下的機構,主要協助保護人民的個人資料,並在所有用戶進行商業交易時,肩負監管個人資料的責任,確保遵守既定的條規。

她說,在該法令下,其中一項原則就是確保所有用戶資料是正確、最新及不具誤導性的。

已會見逾200電訊公司

個人資料保護局從2012年開始已陸續會見了約200家電訊公司及企業,而大部份公司也已瞭解有關法令。

她指出,根據該局進行的公眾諮詢調查,各公司及企業表示需要時間去適應該法令的7大原則。

“大部份大型公司已經通知了他們的客戶,並做出資料更新,但仍有一些小型企業還沒適應新法令。”

涉商業交易才有效

諾韓妮占強調,該法令在涉及商業交易的前提下才有效;而在法令生效後,用戶若要進行投訴,可投報至aduanpdp@kkmm.gov.my。
她解釋,由於必須遵從“通知原則”,因此若用戶收到行銷電話或行銷訊息,首先得通知對方本身沒有興趣,並要求對方刪除其個人資料(電話)。

“若對方再發出第二封訊息,你仍需通知對方,直到收到第三封相同的行銷訊息,你才可以進行投報。”

《個人資料保護法令》的7大原則
1.不可在未經當事人允許下,處理其私人資料(如宗教信仰、政治或性取向、身份證號碼、電話號碼、薪水單、評估報告等)。
2.“通知及選擇”原則:在處理資料前,必須通知並告知當事人採用其資料的目的及取得管道;
3.除非獲得當事人同意,否則不能透露其個人資料給第三者;
4.安全原則:資料使用者在處理他人個人資料時,必須確保資料沒被破壞、被更改、濫用、遺失或把資料傳給不相關人士;
5.存檔原則:不能長期持有他人的個人資料,因此在完成相關程序後,必須刪除或銷毀;
6.資料完整性:資料使用者必須確保他人個人資料是最新、正確、完整及不會令人混淆的;
7.允許原則:當事人有權更改及更新其個人資料。

陳嘉斌:指南不明確
商家多不瞭解新法令

另一方面,馬來西亞中華工商聯合會法律組副主任陳嘉斌律師透露,由於該法令的指南不明確,因此許多商家及企業仍不瞭解該法令。

他受詢時說,該商會針對這項法令已舉辦了多項講座,向商家及企業講解這項法令,惟遺憾的是會員反應不活躍。

“所以現在只有待法令實行後,扮演後續行動的角色,包括與政府溝通。”

他呼吁,若任何商家及企業面對問題,可瀏覽馬來西亞中華工商聯合會或隆雪總商會官網進行查詢。

他認為,這項法令的實施對各造都有好處,因為在不能濫用及購買用戶個人資料的情況下可保障個人隱私。

他說,該法令對商家肯定是有所影響,而商家必須在個人隱私及商業利益下做出平衡。

歐美早已落實

“這項法令一早已在歐美等國家實行,部份商家在無可避免下已開始瞭解這項法令,而我國的中小型企業也必須做好準備適應新法令。”

他強調,這項法令主要管制涉及商業交易的行動,如某公司售賣客戶的個人資料給另一家公司,而與員工提供個人資料給雇主的行為無關。

個人資料保護令一旦落實
不明電話推銷可投訴

一旦2010年個人資料保護法令生效後,如果你接到不明公司致電要求你購買產品,你可以直接向個人資料保護局投訴,而這是2010年個人資料保護法令生效後,對消費者的一大福音。

國會於2010年4月三讀通過上述法令,並於同年6月在憲報上公佈,輾轉逾2年後終要全面落實,但吉隆坡律師公會資訊工藝及出版委員會主席馮正良認為,當局尚未擬出清楚的指南,許多問題有待釐清。

或影響電訊銀行業

他今日受詢時,指新法令正式開跑,對消費者是一大福音,但會對所有公司包括電訊業、銀行業者甚至是中小型企業,帶來問題和深遠影響。

他舉例,過去掌握許多消費者資料的公司,日後是否還可以繼續致電或傳簡訊給消費者,而消費者需要主動致電相關公司,指不願再接到任何資訊,都還是疑問。

同一集團子公司不能分享顧客資料

“新法令最重要的精神,是要使用任何個人資料,都要獲得當事人同意,如日後一間公司不能隨意將其顧客的個人資料(被視為私密),公開給其他人知道,同一家集團的2家子公司,也不能分享顧客的資料。”

個人資料被洩漏可投訴
罪成可罰款或監禁

任何消費者如果覺得個人資料被泄漏,可向個人資料保護局投訴,該局會展開調查,一旦確認違法,涉及公司包括管理層都有可能被罰款,甚至控上法庭。

共有146條文的個人資料保護法令,針對不同違法行為有各種處罰,其中未獲同意出售他人個人資料,罪成可被罰款不超過50萬令吉,或監禁不超過三年或兩者兼施。

雖然消費者不能對涉及公司採取民事訴訟,但公司若違法,會構成刑事罪,當局可採取行動包括罰款等對付。

2010年個人資料保護法令刑罰
● 抵觸法令129條文,即即未經允許轉移個人資料至海外刑罰:罰款不超過30萬令吉,或監禁不超過2年,或兩者兼施
● 抵觸法令130條文,即非法收集或轉售他人個人資料刑罰:罰款不超過50萬令吉,或監禁不超過3年,或兩者兼施

獲法令保障的個人資料包括:
1 名字;
2 護照或身份證號碼;
3 電話號碼;
4 照片;
5 指紋;或
6 脫氧核糖核酸(DNA)樣本。
(星洲日報‧獨家報道:盧慧菁、李佩霜、戴孜芮)

Director General of the Malaysia Personal Data Protection Department

According to the Facebook page of the Personal Data Protection Department (PDPA), the former Director General of the PDPD, Encik Abu Hassan bin Ismail has been reappointed as the Director General of the PDPD.

I would like to congratulate Encik Abu Hassan bin Ismail for his reappointment.

 Scroll to top