• 
• Home
• 
• Training
• 
• Free Trial
• 
• Subscribe
• 
• Renew/Pay
• 
• Help
• 
• Shop

Copyright © 2012
Bloomberg BNA

Malaysia's Personal Data Protection Act 2010

This article is taken from the May 2010 issue of World Data Protection Report Read the full article and every back-issue on free-trial by clicking here

For the first time, Malaysia will soon have privacy-specific legislation. On November 19, 2009, the Personal Data Protection Bill 2010 was tabled in Parliament; on April 5, 2010, the Lower House passed the Bill (see WDPR, April 2010, page 20); and the Bill was passed without changes by the Upper House on May 6, 2010. Following Royal Assent and gazetting, the Personal Data Protection Act 2010 (“PDPA”) will be enforced.

For the first time, Malaysia will soon have privacy-specific legislation. On November 19, 2009, the Personal Data Protection Bill 2010 was tabled in Parliament; on April 5, 2010, the Lower House passed the Bill (see WDPR, April 2010, page 20); and the Bill was passed without changes by the Upper House on May 6, 2010. Following Royal Assent and gazetting, the Personal Data Protection Act 2010 (“PDPA”) will be enforced.

At present, apart from certain sectoral secrecy obligations, information of a personal nature is protected only as confidential information through contractual obligations or the common law.

This article summarises the PDPA and highlights some relevant considerations.

Overview of the PDPA

The key objective of the legislation is to regulate the processing of personal data in the context of commercial transactions by data users, and to provide a safeguard for the interests of data subjects.

“Commercial transactions” are defined broadly as any transactions of a commercial nature, whether contractual or not, and encompass matters relating to the supply or exchange of goods or services, agency, investments, financing, banking and insurance. The PDPA will give rise to new legal rights and obligations in connection with the employer-employee relationship, merger and acquisition transactions involving personnel issues and the discharge of certain professional services, among others.

Organisations which process their individual customers' personal data will also need to re-evaluate their current data privacy policies, processes and personal data consents.

Individuals will have a new set of PDPA-mandated rights, including being informed about their personal data as well as the right to access, correct and also to control the processing of their personal data by other parties. There are also rights specifically relating to the processing of personal data for direct marketing purposes, and it is expected that the PDPA will cover CCTV, photographs and sound recordings.

A number of advisory, regulatory and enforcement bodies are envisaged. Apart from the Personal Data Protection Commissioner (“Commissioner”), the Personal Data Protection Fund, the Personal Data Protection Advisory Committee and the Appeal Tribunal will also be established pursuant to the PDPA.

Detailed guidelines and codes of practice, with the force of law, will be issued by the Ministry of Information, Culture and Communications. As with other jurisdictions, these guidelines and codes will be critical in clarifying more precisely the scope of application and set out practical recommendations for compliance. The private sector, through data user forums prescribed in the PDPA, is expected to play a key role in the formulation of such codes.

Exclusions from the PDPA and Transitional Period

The PDPA applies only to personal data processed in Malaysia. Federal and State governments are excluded from complying, whereas credit reporting or referencing agencies will be separately regulated by another law. Personal data processed only for the purpose of the individual's personal, household affairs and for recreational purposes are completely exempted from the PDPA. Partial exclusions from the PDPA include personal data processed for the prevention or detection of crime, for preparing statistics or research or for only journalistic, literary or artistic purposes. It is expected that the exclusion for personal data processed in the course of “discharging regulatory functions” will be an issue, given its wide meaning.

A three-month transitional period after the coming into operation of the PDPA is granted, in order for data users to comply.

Scope of Rights and Obligation

The key rights and obligations in relation to personal data involve three parties: the data user; the data processor and the data subject.

The data subject is the individual to whom the personal data relates. While not expressly stated, the PDPA is likely to apply only to living individuals. The data user is the person, including bodies corporate, who either processes the personal data or gives authorisation for the processing of the data. The data processor is a person who processes the data on behalf of the data user.

To qualify as “personal data,” the data must relate, either directly or indirectly, to a data subject who can be identified from the data. The data must also be capable of being recorded and be capable of automatic or manual processing. “Sensitive personal data”, which require explicit data subject consent, include medical history, religious beliefs, political opinions and the commission or alleged commission of any offence.

This distinction based on “explicit” consent indicates that the data subject's consent concerning personal data generally need not be in writing. Therefore, consent could be implied. A data subject may withdraw his consent to the processing of his personal data by giving the data user a notice in writing. No time limit is stipulated, and it could be possible for the data subject to withdraw consent at any time.

There are seven data protection principles that form the basis of protection:

* General Principle: The processing of personal data requires consent.

* Notice and Choice Principle: Data users are required to notify the data subjects regarding the purpose for which the data is collected and about the right to request access and correction of the personal data.