Malaysia data protection

The other side of tech

I was asked by The Edge Malaysia to comment on the collection of personal data by the Malaysian Government, particularly, the data submitting by individuals in compliance with pandemic control related laws. I said-

Currently, the PDPA [Personal Data Protection Act 2010] does not apply to the government. This should be addressed, adds Foong Cheng Leong, a lawyer focusing on areas such as privacy and data protection laws.

“There should be a law governing how the government can process our information. Such a law should include the right to request the government to disclose what kind of personal data it has collected or is collecting,” says Foong.

“This request is, of course, subject to certain exemptions such as national security. The law should also make the government accountable for misuse of our information or negligent handling of our information.”

Other suggestions by the interviewees include data localisation laws, mandatory data breach notifications and laws that allow the public to request information from the government.

In addition, the following questions were posed to me but my answers were not featured in the article. I think it is beneficial for readers to know of the matters set out below.

1. Governments have been introducing contact tracing applications globally after the pandemic broke out. From location tracking to CCTV monitoring, these solutions are also putting people under surveillance more than ever. Concerns about data privacy and the surveillance state have already been present before — now, the pandemic has intensified this debate. What are your observations and thoughts about this? Should people be concerned?

At this juncture, the Government has represented that the information collected will only be for specific purposes eg risk assessment, contact tracing and compliance with the movement control order and other related rules and regulations. Such purposes are specifically stated in the privacy policy of the MySejahtera App at It even expressly declared that

The Personal Data collected will not be used for any purpose other than those mentioned above, unless if required in order to comply with any legal obligation”.

However, the Government stated that they may change the terms of privacy policy and any changes will be updated on that website. This is a cause for concern as the privacy policy may be changed to include other purposes. For example, the application may be update to, among others, track your movement which can be used to collaborate certain data. The traffic department may track if you are within a certain locality

2. At the same time, smart city solutions that use facial recognition CCTVs, smart policing, digital IDs are becoming more prevalent. Should we be concerned? What are the risks?

If it is managed in a proper manner and only for the purpose it is implemented, there should be little cause for concern. For example, if the CCTV is implemented for the purpose of prevention of crime, then any personal data collected should be for that purpose. Such personal data cannot be used for, among others, sold to third parties for targeted advertising, issuance of fines by local authorities etc.  

Personal profiling is also a cause of concern. Personal profiling can happen when one merges various data from other sources into one single dataset. For example, data collected from the traffic cams, social media profile, police reports, list of properties from the land office, and income tax information are all merged into one single data set by the Government and updated whenever there is new information. Quite clearly no one wants their personal life being intruded in this manner. Further, there is a cause for concern if there is a data leakage or misuse by third parties.

3. At the same time, we want more convenient services — enabled by technology — from the government, whom we also expect to protect us. How can we strike that balance? Is it possible? 

There can be no perfect balance. However, steps can be taken to strike this balance, and this include legislating how the Government should manage our information. Currently, the PDPA does not apply to the Government. There should be a law governing how the Government can process our information. Such law should include the right to request the Government to disclose what kind of personal data they have collected or are collecting. This request is, of course, subject to certain exemptions such as national security. The law should also make the Government accountable for misuse of our information by them or negligent handling of our information.

The Government should also hold regular consultations with the relevant stakeholders to see how citizen’s information should be processed and how it could also ease the business processes. Government must take into account of the business sectors’ needs as well. For example, a prudent lawyer would always ensure that the party that they are suing is the correct party. The National Registration Department should give leeway to lawyers to obtain such information quickly and with ease. However, the current procedure implemented by them is too stringent as they require, among others, the submission of the Court documents to prove that such information is required.

4. What can be done in Malaysia to prevent the overreach of surveillance technology? For instance, tightening the PDPA, being mindful of what technology providers we use etc. 

We should be concerned with the risk of data leakage or unauthorised disclosure especially out of Malaysia. For example, a surveillance device from a foreign country may be masqueraded as a mobile phone. The user’s data including his biometric information (e.g. fingerprint), personal photographs, other persons’ personal data may be all disclosed to these third parties.

Fortunately, many electronic devices imported or released to the country must obtain Malaysian Communications And Multimedia Commission’s approval. The Government will need to do a throughout examination of these devices before they can be made available to members of the public and trade.

Another law that we require is the data localisation laws. This means that certain personal data should only be stored in Malaysia and not transferred to another data server outside Malaysia. This could also pave way for more data centres in Malaysia.

5. What is your advice to Malaysians?

Malaysians must be vocal about how their personal data is processed, whether by the Government or by the private sector. They should voice out their concerns if one of these bodies are collecting unnecessary personal data. They should also push for laws to protect themselves instead of relying on the Personal Data Protection Commissioner to do the prosecution and investigation. Perhaps an ombudsman like the Consumer Tribunal should be introduced by the Government to allow Malaysians to file their complaints directly to the ombudsman and have the matter heard before the ombudsman. They should have the powers to call upon any witnesses and punish those who disobey.

Microsoft’s data centre region project needs data security laws

I was asked by The Malaysian Reserve to comment on MICROSOFT Corp’s US$1 billion (RM4 billion) investment to establish its first data centre region in Malaysia, particularly on the data security laws aspect. I said-

Bar Council’s Information Technology and Cyber Laws Committee deputy chairman Foong Cheng Leong said new regulations should be introduced to protect such data centres once they are opened to the general public.

For example, he said the government could set up regulations against the seizure of equipment or surrendering of data to authorities, as well as laws to protect against intermediary liabilities.

Additionally, he said the data centre region would promote further data localisation, particularly for the government to improve data safety and protection.

“It may also be useful for the government to direct its agencies to store their data in such local data centres. Many data these days are held overseas and we do not know where they are stored.

“A data localisation requirement would be useful in helping Malaysians protect their personal data,” Foong told The Malaysian Reserve (TMR) recently.

Pay just RM150 for details of 200,000 people, RM350 for 10 million

I was interviewed by Free Malaysia Today on the issue of the unlawful sale of personal data in Malaysia which is an offence under the Personal Data Protection Act 2010 (PDPA), in particular, s. 130 of the PDPA.

A lawyer told FMT that the sale of personal data is not surprising.

Foong Cheng Leong, who chairs the Kuala Lumpur Bar’s information technology committee, said while the sale of data is common, it is no longer done as openly as before due to PDPA which came into force in 2013.

But he said enforcement has been poor.

Despite media reports on data breaches such as the leakage of millions of mobile phone numbers two years ago, no action has been taken, Foong said.

In 2017, mobile phone numbers, identification card numbers, home addresses, IMEI and SIM card data of 46.2 million customers of at least 12 Malaysian mobile phone operators were leaked online.

“We do not know why there has been no prosecution. Perhaps due to the difficulty of conducting a data leakage investigation, data may be held by numerous data processors and rogue employees may have accessed them without permission,” said Foong.

Leveraging Big Data

I was quoted in the May 2014 issue of Personal Money.

Leveraging Big Data
Personal Finance
Written by Emily Chow and Sarah Voon of The Edge Malaysia
Friday, 16 May 2014 00:00

UPLOADING photos on Facebook; making an ATM transaction; operating a machine in a factory; making a call from a handphone. On the surface, these activities do not seem to have much in common. But they all contribute to the accruement of big data.

Everything and anything that is, and has ever been, linked up to the digital realm constitute big data. Big data analysis is what many businesses are doing today to enhance their business process.

“Big data isn’t so much the content or amount of the data, but [data on] who is contributing towards it and how often,” says Queenie Wong, head of data management at SAS Institute in Malaysia. The international company is a leader in business analytics software and services, and helps organisations turn large amounts of collected data into information they can use.

“[Companies] have been capturing this information, but it’s expensive to store. Most of the time, you just store and archive it. But with the new trend of big data analytics, how do you capture it [in a meaningful way] to get ahead of the competition and differentiate yourself?”

According to Wong, big data analysis has existed for some time and is being used especially by banks and telecommunications companies. The term was coined and came under the spotlight relatively recently, and businesses are starting to use it in making decisions and maintaining customer relationships.

“When you deal with consumers in today’s business world, it’s not about high value anymore. As a business, I don’t want you to spend thousands or millions of dollars [per transaction]; I’d want you to spend multiple [transactions worth] hundreds of dollars, that add up to more than the [initial] thousand that you might have spent,” she says, emphasising customer loyalty. “It’s easy to acquire customers, but it’s difficult to keep them and make them happy.”

Big data analysis helps in target marketing: Gone are the days of cold-calling and salesmen going door to door to sell their products. Today, a company can anticipate a customer’s need by studying his previous purchases or activities.

“For example, when a bank calls you offering loans and insurance, it isn’t a targeted offer because they don’t know if you’re an existing customer or not, or whether you own any other product in particular,” Wong explains.

“It’s just an outbound call, making it is expensive, and it’s only effective if it gets to the right person [who needs a loan]. The company also wants to make sure that within the first minute of the conversation, the customer wants to hear what it has to say.

“But with big data, we can comprehend the way customers use your service,” she continues. “If you are at a car sales online portal, the bank would want to give you relevant information on car loans [on the website itself]. Say, a customer uses an app on a mobile phone service to buy a train ticket. The information is captured when the ticket is purchased, so the next natural thing to do is to offer hotel stays, which the customer will appreciate. Big data is about anticipating the customer’s next move. It might not be of high value, but it’s very targeted.”

Examples of big data a bank would examine include customers’ ATM transactions and banking details. For a telecommunications company, it would be the way customers use their phones.

Unfortunately, this flood of information can be overwhelming, so companies need to know how to make use of it.

“Every time I make a call, send a message or access broadband, this information is being captured by the telco,” Wong says. “It’s a big dump of information, so businesses need to know what is relevant to them. Data will be used differently based on the maturity level of the companies.”
Such data can also add value to customer interactions.

“Banks have been analysing customer behaviour through credit cards [usage] and are able to detect fraud by notifying customers [of charges made] through text message,” adds Wong.

“But they can do more than this. If you’re travelling overseas and charge something to your card, data will be captured [regarding] your location. Instead of just sending customers a message verifying that they have just charged their card, banks can bring added value by telling them what promotions are [available] nearby if they use their credit cards there.”

Ballooning industry

As big data analysis grows in popularity, or even by necessity, it is predicted that businesses will direct significantly larger sums of resources towards big data analytic tools and solutions. According to the International Data Corporation (IDC) Predictions 2014 report, worldwide spending in this area is likely to increase by 30% this year, exceeding US$14 billion.

“The potential of deriving valuable insights and real-time decision-making from this data avalanche will drive massive investments and create new data-centred analytics and content services,” says the report. In Malaysia, the big data market is expected to reach US$24.2 million (RM46 million) this year.

“Malaysia is moving towards capturing more data — it is starting to recognise the people, process and technology,” observes Wong. “We see an increase in customers asking us to analyse and digest information. Big data isn’t a big bang thing; it is a journey for a business’ internal growth.”

For leading banks in the region, which may already have insight into what customers want through cross-channel banking transactional behaviour analysis, big data allows for increased targeting precision by extending their view of customer behaviour.

“This includes website activity, social engagement, contact centre voice interactions, and location data,” says Donald MacDonald, head of group customer analytics and decisioning at OCBC Bank Singapore.

“New technologies also enable us to react to this data faster than before — in some cases, in real-time — so we can directly engage customers with messages based on where they are and what they are doing right now.”

Apart from customer service and consumer sentiment, OCBC uses big data analytics in marketing analytics, fraud detection, credit quality optimisation and financial forecasting. The bank has spent over S$100 million (RM259 million) on data analytics since 2004, with investments on integrating data from multiple sources to one source, and on tools for analysis.

“Through the use of data analytics, we are able to significantly raise the quantity and targeting sophistication of our marketing activity. We can directly quantify the success of our marketing campaigns by monitoring customers’ individual behaviour to understand who responded to our offers, and then attribute a financial result to each contact,” shares MacDonald.

“Two major [big data] trends we’re focusing on now are speed to insight and contextual awareness.”

Speed to insight refers to the bank leveraging on “data-in-motion”, or data captured when direct interaction occurs with a customer. As this data is put into the bank’s system, its analytical engine updates the bank’s existing knowledge of the customer, and is able to recommend the most relevant products or services in real-time.

“Contextual awareness refers to leveraging additional information on the customers’ current circumstances to improve the relevance of our communications,” MacDonald says. For instance, OCBC could use big data to locate where a customer is, and then recommend merchants based on his preference as well as current location.

“Another example is leveraging voice logs within our contact centre to identify factors such as the increasing frustration of a customer on the line, which might be missed by a staff member,” he continues. “These factors enrich our existing view of the customer… ensuring that our sales and service offers are more targeted and relevant to each individual’s current situation.”

CIMB Group is another bank that leverages on big data initiatives to increase customer satisfaction, and appeal to their needs and lifestyle. The bank, for example, links customers’ Facebook data with its internal data to provide targeted offers to credit and debit cardholders.

“As a result, we discovered that there is an 80% correlation between merchants that customers ‘like’ on Facebook and our existing transaction data of merchants with whom they charge their cards,” says Iswaraan Suppiah, group chief information and operations officer, CIMB Group.

“Additionally, we have noted that banks in other countries are using big data techniques to reduce fraud incidents, or even use social network analysis to determine the creditworthiness of borrowers.”

According to CIMB, big data can also grow revenues faster by better matching its offers to customers’ needs.

“[This is] to the extent of designing better products and services that are directly relevant to various customer segments. Instead of using a traditional marketing campaign targeted at hundreds of thousands of customers and getting a 2% conversion rate, we can now target 30,000 customers and get a 50% conversion rate,” says Iswaraan.

“By using big data to really get to know and understand our customers, we can cut down on unnecessary ‘marketing’ and have real conversations about real customer challenges that will lead to benefits on both sides.”

Privacy protection and consumer rights

From a social perspective, big data could also benefit the public sector when used by the government, albeit allowing surveillance with an Orwellian touch. Authorities worldwide have been using such information in policy design and logistics planning, and to monitor crime and public security.

In Malaysia, however, data collected by companies cannot be sold or shared with a third party without the subject’s consent, as stated in the Personal Data Protection Act 2010 (PDPA).

Other laws such as the Communications and Multimedia Act 1998, the Computer Crimes Act 1997, and the Penal Code also ensure that collected data must only be used for the original purpose it was lawfully obtained for. This means customers should have willingly imparted their data to companies, with their knowledge.

“It’s fine for a person to use big data for business marketing research purposes, provided the data was acquired lawfully,” says Foong Cheng Leong, a lawyer at Foong Cheong Leong & Co, who specialises in cyberdata cases.

“There are many cases where data is purchased without the knowledge of the subjects within the data,” says Foong. In this case, the subject may exercise his right and file a complaint against the company or person that has been selling the information. Complaints can be made with the Personal Data Protection Commissioner.

“The information includes personal data, such as your name, identity card number, email address, images, your address, and so on, [used] in a commercial transaction,” he says, adding that this is all covered under the PDPA.

However, before a subject exercises his right, he should always read the privacy notices or policies provided by businesses explaining how they will use his data, Foong advises. A company is obliged to disclose how it uses personal data in a privacy notice or policy. This is also to enable the consumer to make informed decisions when sharing information requested by the company.

“With PDPA in force, consumers have a say in how their data is to be treated. They can even control the amount of data being flown out of a company.”

According to Foong, however, there are some cases of companies disclosing certain information necessary to deliver their services to the subject. For example, a telecommunications company may pass its customer’s data to a subcontractor. “[This is in the event] that the subcontractor needs to perform certain services. However, before a company [shares the data, it will make sure that the customer’s] personal data will be kept securely.”

This should also be disclosed to subjects during the time of data collection. Anything beyond what is stipulated in the initial privacy policy that is shared to subcontractors or other third-party services is considered illegal.

Foong says the only way to secure one’s personal data is to only use trusted service providers. Apart from that, he also advises that one should maintain a separate email to sign up for goods or services.

“Make sure you have strong passwords, and do not reuse passwords for different platforms. Phishing is common nowadays. Any email that goes into your junk or spam folders should be read with caution. It is unlikely to be true. Fake calls from unknown parties are also common. Many such callers ask for personal details on the pretext that someone is misusing your data.”

Otherwise, Foong believes that there should not be much to worry about. If users continue to take precautionary measures to protect their data privacy, they should not fear sharing their information online.

However, as an urban population moves towards a technologically driven lifestyle, rapidly expanding digital footprints are inevitable. From SAS Institute’s perspective, a company that chooses to use big data and its analytics has to make it relevant to its customers.

“If you want to use big data and big data analytics, whatever you give back to your customer must be relevant,” Wong says.

“Companies are very cautious with the kind of information they have and I think now with guidelines from Bank Negara Malaysia and the Malaysian Communications and Multimedia Commission, there are clear lines on what you can and cannot do. [Sometimes] there is a grey area, because that has to do with the company’s obligation to the customer and the public. The company then has to decide how they want to address that.”

This article was first published in the May 2014 issue of Personal Money — a personal finance magazine published by The Edge Communications.

Proposal Papers – Guideline on Compliance for Personal Data Protection Act and Guide on the Management of Employee Data Under Personal Data Protection Act (PDPA) 2010

The Malaysia Personal Data Protection Commissioner (Commissioner) has published two (2) proposal papers namely:-

(1) Guideline on Compliance for Personal Data Protection Act [No 2/2013]; and

(2) Guide on the Management of Employee Data Under Personal Data Protection Act (PDPA) 2010 [No 3/2013].

The Proposal Paper No 2/2014 sets out the proposed steps to be taken to comply with the Personal Data Protection Act 2010 (PDPA) whereas the Proposal Paper No 3/2014 confirms that employer-employee relationship is governed by the PDPA. Any comments on the Proposal Paper may be submitted to the Commissioner before the prescribed deadline. Copies of the proposal papers are enclosed.

Further, the Commissioner has also uploaded a complaint form on the Commissioner’s website. Data subjects may now file complaints to the Commissioner directly.

Malaysia gazettes data protection act, effective immediately

I was quoted by ZDNet in their article “Malaysia gazettes data protection act, effective immediately“.

Malaysia gazettes data protection act, effective immediately

Summary: After almost a year delay, Malaysia finally gazettes its Personal Data Protection Act 2010 on Thursday and makes it effective Friday. Businesses have three months to comply and violation can result in fine and/or imprisonment.

By  |

Malaysia has quietly gazetted its Personal Data Protection Act 2010 (PDPA), effective immediately, and given businesses three months to ensure compliance.

The move comes almost one year after the act was scheduled to take effect on January 1, 2013, but delayed due to legal formalities. The bill was first drafted in 2001 and was originally expected to be implemented early-2010. An earlier note by the American Malaysian Chamber of Commerce indicated that the Act was scheduled to be passed August 16 this year, with businesses using personal user data required to register themselves with the Personal Data Protection Department of Malaysia (PDPD) by November 15, 2013. This, however, apparently was also rescheduled.

According to Kuala Lumpur-based lawyer Foong Cheng Leong, the act has been gazetted and comes into force today, with Tuan Abu Hassan bin Ismail appointed the Personal Data Protection Commissioner. Foong noted that the Act outlined four new subsidiary legislation, including the class of data users and registration of data users. Businesses that fall under these categories include banking and financial institutions, communications service providers, insurance companies, transportation, and utilities.

Data users now have three months from November 15 to ensure compliance, he added.

The PDPA also provided some guidelines on the definition of consent, which must be in a form that can be recorded and maintained by the data user. Burden of proof for consent lies on the data user, Foong said.

Singapore-based tech lawyer and ZDNet blogger, Bryan Tan, said the sudden turn of events meant Malaysia has “stolen a march” on Singapore which passed its Personal Data Protection Act in October 2012, but its main regulations will come into effect only on July 2, 2014, when allorganizations must ensure complianceThe Act, however, includes a Do-Not-Call Registry which will be in force January 2, 2014.

Tan said: “The two countries’ PDPAs are different, but what it generally means for businesses is that a lot of time and effort will need to be spent on compliance. Perhaps it is a blessing in disguise that both come into force almost at the same time, so companies operating in Singapore and Malaysia can coordinate their compliance in one single project.”

Data protection act gazetted, effective today

I was quoted by the Malay Mail in their report “Data protection act gazetted, effective today” on 15 November 2013.

KUALA LUMPUR, Nov 15 — The much awaited Personal Data Protection Act (PDPA) 2010 has finally been gazetted and will take effect today, with businesses given three months to comply with the new law and violation will result in fine, or imprisonment, or both.

KL Bar Information Technology Committee chairman Foong Cheng Leong confirmed that the law will be effective today, with Abu Hassan Ismail appointed the Personal Data Protection commissioner.

“The law introduced seven principles, in these seven principles, you would need to, for example get consent if you possess any personal data, name, IC, address, pictures, email and phone numbers.

“Once you get the personal data, you need to give a written notification in BM and English and make sure it’s safe and give it to the relevant parties,” he told The Malay Mail Online when contacted.

Foong, who is also the member of the Malaysian Bar Intellectual Property Committee, also said that although businesses are given three months to comply, it would be a challenge to those which have not begun putting their houses in order.

“I think [businesses] are hit quite hard especially those not doing anything since 2009 because the law was introduced since 2009, but I know quite a bit of companies which have started to comply with the law since 2009.

“Most companies would need six months to complete the exercise, so those who have not done anything, need to move very quickly.

“For consumers, expect less phone calls, less SMSes and basically receiving any tele-marketing materials,” he said.

Foong noted however, that the Malaysian government is exempted from this law.

The PDPA also introduced four new subsidiary legislations, including the registration of data user and class of data users.

Businesses that are considered data users including banking and financial institutions, communications service providers, insurance companies, transportation, and utilities, will now have to register with the commissioner.

He also said that data subject, meaning individuals, would be able to request access to the type of personal data being processed.

“The law provides that there will be no transfer of data outside Malaysia, unless you get consent, or the country or jurisdiction you want to transfer data to is included in the list by the commissioner [which has yet to be released],” he said.

The law stipulates that consent for personal data processing should be required explicitly it has to be expressed, rather than implied or assumed. The organiser will also need to justify the reason they need the information they are asking for.

Under the law, consumers have the right to access, correct data, prevent damage or distress, withdraw from data processing, prevent direct marketing and bring complaint on data abuses to PDP commissioners.

Data users meanwhile, are obligated to provide the necessary mechanisms that will facilitate data subjects to exercise these rights.

The provisions also allows consumers to withdraw consent to personal data. If the data user continue to process the personal data, it will be liable to a fine of up to RM100,000 or a maximum of one-year jail, or both.

The move comes almost one year after the act was scheduled to take effect on January 1, 2013, but delayed due to legal formalities. The bill was first drafted in 2001 and was originally expected to be implemented early-2010.

The law was initially scheduled to be passed August 16 this year, with businesses using personal user data required to register themselves with the Personal Data Protection Department of Malaysia by November 15, 2013.

Enforcement of the Personal Data Protection Act 2010

It is official. The Malaysian Personal Data Protection Act 2010 (“PDPA”) will be in force on 15 November 2013. As expected, Tuan Abu Hassan bin Ismail is appointed as the Personal Data Protection Commissioner with effect from 15 November 2013.

Data users now have 3 months to comply with the PDPA in respect of personal data processed before 15 November 2013 and immediate compliance with the PDPA for personal data collected from 15 November 2013.

The enforcement of the PDPA also introduced four (4) new subsidiary legislations namely:-

1.Personal Data Protection (Fees) Regulations 2013;
2. Personal Data Protection (Registration of Data User) Regulations 2013;
3. Personal Data Protection (Class of Data Users) Order 2013; and
4. Personal Data Protection Regulations 2013.

For your easy reading, I have summarised the new regulations below.

Registration of Class of Data Users

The new regulations require certain class of data users to register with the Personal Data Protection Commissioner. They are:-

1. Communications
(a) A licensee under the Communications and Multimedia Act 1998 [Act 588].
(b) A licensee under the Postal Services Act 2012 [Act 741].

2. Banking and financial institution
(a) A licensed bank and licensed investment bank under the Financial Services Act 2013 [Act 758].
(b) A licensed islamic bank and licensed international islamic bank under the Islamic Financial Services Act 2013 [Act 759].
(c) A development financial institution under the Development Financial Institution Act 2002 [Act 618].

3. Insurance
(a) A licensed insurer under the Financial Services Act 2013.
(b) A licensed takaful operator under the Islamic Financial Services Act 2013.
(c) A licensed international takaful operator under the Islamic Financial Services Act 2013.

4. Health
(a) A licensee under the Private Healthcare Facilities and Services Act 1998 [Act 586].
(b) A holder of the certificate of registration of a private medical clinic or a private dental clinic under the Private Healthcare Facilities and Services Act 1998.
(c) A body corporate registered under the Registration of Pharmacists Act 1951 [Act 371].

5. Tourism and hospitalities
(a) A licensed person who carries on or operates a tourism training institution, licensed tour operator, licensed travel agent or licensed tourist guide under the Tourism Industry Act 1992 [Act 482].
(b) A person who carries on or operates a registered tourist accommodation premises under the Tourism Industry Act 1992.

6. Transportation
(a) Malaysian Airlines System (MAS).
(b) Air Asia.
(c) MAS Wings.
(d) Air Asia X.
(e) Firefly.
(f) Berjaya Air.
(g) Malindo Air.

7. Education
(a) A private higher educational institution registered under the Private Higher Educational Institutions Act 1996 [Act 555].
(b) A private school or private educational institution registered under the Education Act 1996 [Act 550].

8. Direct selling
A licensee under the Direct Sales and Anti-Pyramid Scheme Act 1993 [Act 500].

9. Services
(a) A company registered under the Companies Act 1965 [Act 125] or a person who entered into partnership under the Partnership Act 1961 [Act 135] carrying on business as follows:
(i) legal;
(ii) audit;
(iii) accountancy;
(iv) engineering; or
(v) architecture.

(b) A company registered under the Companies Act 1965 or a person who entered into partnership under the Partnership Act 1961, who conducts retail dealing and wholesale dealing as defined under the Control Supplies Act 1961 [Act 122].
(c) A company registered under the Companies Act 1965 or a person who entered into partnership under the Partnership Act 1961, who carries on the business of a private employment agency under the Private Employment Agencies Act 1981 [Act 246].

10. Real estate
(a) A licensed housing developer under the Housing Development (Control and Licensing) Act 1966 [Act 118].
(b) A licensed housing developer under the Housing Development (Control and Licensing) Enactment 1978, Sabah.
(c) A licensed housing developer under the Housing Developers (Control and Licensing) Ordinance 1993, Sarawak.

11. Utilities
(a) Tenaga Nasional Berhad.
(b) Sabah Electricity Sdn. Bhd.
(c) Sarawak Electricity Supply Corporation.
(d) SAJ Holding Sdn. Bhd.
(e) Air Kelantan Sdn. Bhd.
(f) LAKU Management Sdn. Bhd.
(g) Perbadanan Bekalan Air Pulau Pinang Sdn. Bhd.
(h) Syarikat Bekalan Air Selangor Sdn. Bhd.
(i) Syarikat Air Terengganu Sdn. Bhd.
(j) Syarikat Air Melaka Sdn. Bhd.
(k) Syarikat Air Negeri Sembilan Sdn. Bhd.
(l) Syarikat Air Darul Aman Sdn. Bhd.
(m) Pengurusan Air Pahang Berhad.
(n) Lembaga Air Perak.
(o) Lembaga Air Kuching.
(p) Lembaga Air Sibu.

Personal Data Protection Regulations 2013

Personal Data Protection Regulations 2013 provided some guidelines on the definition of consent of a data subject in the PDPA. In this regard, consent must be in a form that can be recorded and maintained properly by the data user. Burden of proof for consent lie on the data user.

Any privacy policy must also provide the designation of the contact person, phone number, fax number (if any), e-mail address (if any) and such other related information.

Data user shall develop and implement a security policy to comply with Security Principal.

The Personal Data Protection Regulations 2013 also stated that the Personal Data Protection Commissioner may notify a data user of his intention to carry out an inspection on a personal data system used by a data user.

Enforcement of the Personal Data Protection Act 2010

Notwithstanding of my earlier posting that the Personal Data Protection Act 2010 (PDPA) may be in force on 16 August 2013, there is still no notification on the Government Gazette officiating the date of enforcement.

Sin Chew has also reported that the PDPA may be deferred.


I was quoted by Sin Chew in the article below regarding the impending Personal Data Protection Act 2010.


她受詢及《2010年個人資料保護法令》寬限期於16日屆滿一事指出,若總檢察署電子憲報(e-Federal Gazette)明日仍沒有公佈法令的實施日期,則法令有可能再展延生效。


































● 抵觸法令129條文,即即未經允許轉移個人資料至海外刑罰:罰款不超過30萬令吉,或監禁不超過2年,或兩者兼施
● 抵觸法令130條文,即非法收集或轉售他人個人資料刑罰:罰款不超過50萬令吉,或監禁不超過3年,或兩者兼施

1 名字;
2 護照或身份證號碼;
3 電話號碼;
4 照片;
5 指紋;或
6 脫氧核糖核酸(DNA)樣本。

1 2 3  Scroll to top