Articles

PDPA 2010: One Year On, What We Have Achieved So Far

PDPA 2010: One Year On, What We Have Achieved So Far

The Personal Data Protection Act 2010 (“PDPA”) is the very first legislation in Malaysia that seeks to comprehensively protect personal data. As we do not have a general Privacy Act in place, and our Federal Constitution does not expressly recognize the right to privacy (although our Court of Appeal in one particular case held that the right to life and liberty (Article 5) is arguably broad enough to include the right to privacy), the PDPA is certainly a very much needed piece of legislation that Malaysians have long been waiting for. So when the PDPA was passed in June 2010, it was seen as a positive move by our Government towards recognizing the importance of protecting personal data of individuals in Malaysia. It also signals an important milestone for Malaysia in bridging the gap between Malaysian laws and international trends in protecting personal data. To prevent the misuse and disclosure of personal data to unauthorized third parties, governments around the world have enacted legal regimes on personal data protection. In ASEAN, Malaysia and Singapore are the only two countries which have enacted a comprehensive data protection legislation. Three years down the road, the PDPA finally came into force on 15 November 2013. One would have thought that given the time that it took for the PDPA to come into force after it was passed by the Parliament in June 2010, most data users (i.e. companies/organisations/individuals who either alone or jointly in common with other persons process any personal data or have control over or authorize the processing of any personal data) would have put aside sufficient time and resources to make sure that they take the necessary steps to establish, review and strengthen internal policies, procedures, processes and systems that govern the management and handling of personal data in order to comply with the law. Unfortunately, that was not the case. When the Government announced that the PDPA will come into force on 15 November 2013, many companies and organisations were rushing into getting themselves PDPA compliant, as they were only given a 3-month sunrise period to ensure compliance with the law. Hence, we saw a spike in companies and organisations busy churning out privacy policies and notices. Data users who were required to register themselves with the Personal Data Protection Department (“PDP Department”) were also uncertain with the registration process. Perhaps due to inadequate publicity or low awareness, some data users were not even aware of the registration requirement, which had resulted in them being late in submitting their registration forms. Meanwhile, some companies and organisations (especially small and medium enterprises) chose to take a “wait-and-see” approach, conveniently ignored the fact that the PDPA applies to every company, organisation and individual in the country, and not just the big boys. It has been one year since the coming into force of the PDPA. Let’s examine what we have achieved so far, what could have been done, and what else we all can do. While the deadline for data user registration was already over, the PDP Department acknowledged that the 3-month sunrise period was relatively short (Singapore’s PDPA, which has also recently come into force, provided an 18-month sunrise period). As such, the PDP Department adopted an unofficial stand by stating that they will still accept late applications for registration, provided it was accompanied with a letter stating the reason(s) for the delay. As of November 2014, the PDP Department had registered more than 7,000 data users from various industries. Encik Abu Hassan bin Ismail was appointed as the first Personal Data Protection Commissioner. The current Commissioner is Encik Mazmalek bin Mohamad. Several regulations and orders have also been enacted, and the PDP Department has initiated public consultations on various guidelines to deal with specific topics such as management of CCTV images, direct marketing, employee data, consent requirements as well as general rules on compliance with the PDPA. In an effort to create and raise public awareness, officers from the PDP Department have also been busy going around the country to conduct seminars and conferences on PDPA. It is worth noting that the PDP Department always welcomes public opinions (for example through issuing public consultation papers) and constantly engages in talks and discussions with stakeholders such as industry players, NGOs, professional bodies and business associations. All the efforts that have been put forward by the PDP Department must be commended, and we hope that the PDP Department will continue to engage with and consult stakeholders on the implementation of this broad-ranging law. As for companies and organisations, some of them, especially large companies and organisations, have already put in place certain procedures and processes to ensure compliance with the law. However, the approaches have been rather diverse. Depending on the nature and size of the business, some have put in extensive procedures and complex processes (such as banks, insurance companies, telcos), while some have just put up a privacy policy on their websites, thinking that by doing so, they have complied with the law. This can be attributed partly to the different levels of understanding towards compliance with the law and interpretation of the PDPA, and partly to other reasons such as no guidelines from the authorities providing clear guidance on the interpretation of the PDPA. There are still a lot of grey areas under the PDPA which require further clarification. Under the PDPA, in order for a data user to process an individual’s personal data, he must obtain consent from the individual, and the consent must be in a recordable form and capable of being maintained properly by the data user. So… Does this mean that consent must be in writing? Must the individual sign on the privacy notice or is it sufficient that the privacy notice is attached to the form where the individual fills in his personal data? What about deemed or verbal consent? Is that not acceptable? When dealing with a company or an organisation, does a data user need to get consent from every

PDPA 2010: One Year On, What We Have Achieved So Far Read More »

Taxi Apps AKA The Ride Hailing Apps Of The Future. But What About The Resistance Against Them?

Taxi Apps AKA The Ride Hailing Apps Of The Future. But What About The Resistance Against Them?

Technology makes our lives better, helps us to get things done faster, and thereby allows to save more time so that we can focus on the more important things in our lives. While some may disagree with this statement, many would agree that technology is omnipresent and forms an integral part of our lives. Let’s talk about the mobile transportation or ride hailing apps that are touted as the game changers, which has created a lot of hype and controversy all over the world including Malaysia. The three most popular taxi apps in Malaysia are, My Teksi, Easy Taxi and Uber. There are also other local taxi apps such as Taxi Monger, UniCabLink and EzCab. My Teksi is our home-grown ride hailing app which has made its name not just in Malaysia, but also abroad, whereas Easy Taxi is backed primarily by Rocket Internet from Germany, while Uber is an American based app originated from San Francisco. Each of them has garnered a lot of interests from investors, consumers, as well as taxi drivers and at the same, they have attracted a great deal of attention from the regulators too, particularly Uber. In terms of funding, to date, My Teksi has raised RM293 million, Easy Taxi has raised RM257 million, and Uber has raised RM5 billion. This goes to show that it is a multi-billion dollar industry and it sets to revolutionise, if not, transform the taxi booking system and the notorious practice in the taxi industry. These taxi apps leverage on mobile technology to connect passengers to drivers in a reliable, efficient and safe way. These taxi apps basically have three main features: allow the passenger to search for the nearest taxi in less than a minute; provide transparency in the sense that the information of the specific driver who accepted the booking request (such as name, plate number, personal picture, car type, license number and phone number), estimated fare as well as estimated time of arrival will be displayed on the passenger’s smartphone/tablet screen; and promote safety as the passenger can track the driver on the screen map in real time as the driver approaches passenger’s current location and share the location as the journey runs. Using these ride hailing apps, getting a taxi has never been that easier and safer before! In addition to the above features, some of these apps provide cashless payment feature (hence eliminating the need for bringing cash and getting a response from drivers like, “Bro, I have no small change la”). To ensure safety is of the top priority, some of these ride hailing app companies will do stringent criminal background checks on the drivers and require them to meet certain requirements before allowing them to join the network. Drivers who received bad ratings from their passengers will be banned from providing the services, thereby indirectly forcing drivers to improve their services. Many of you would be quite familiar with the following scenes before the days of ride hailing: 1st scenario You step out from your office, trying to flag down a taxi. You wait for 10 minutes, finally, a taxi comes. You tell him your desired destination, the driver says, RM15. You ask the driver to use the meter, but the driver says the distance is too short, so it is not worth using the meter. You either haggle for a discount or waste another 10 minutes waiting for the next taxi to come. 2nd scenario You call up the taxi booking hotline, and immediately you are put on hold for 5 minutes. Finally, someone answers, “pergi mana?”, and you tell him/her your desired destination. You are then put on hold for 5 minutes, while he/she go and check for any available taxi drivers who can pick you up. After 5 minutes, you either get a good response that says, a taxi will arrive in 10 minutes, or you get a familiar response like “no taxi” or “tak mau pergi”. Many have lauded the introduction of these godsend ride hailing apps into the market as they set to solve the taxi woes, end the frustration and ease the pain when it comes to booking a taxi. My Teksi and Easy Taxi are essentially taxi booking apps, where passengers can summon taxis through the apps. They both work with licensed taxi drivers and do not charge passengers anything extra. They make money from the fixed RM2 booking fee, which is a government regulated surcharge for any booking that is arranged through a phone. Passengers will pay the metered fare as regulated by the government. From the look of it, it appears that they work within the boundaries of the law. Unlike My Teksi and Easy Taxi, Uber is not quite like any other taxi booking apps, rather it is described as a ride-sharing app. Uber, which is available in 222 cities in 45 countries, does not work with licensed taxi drivers. Instead, private vehicle owners can apply to become a driver for Uber and make money out of it. A recent interview with Uber’s regional manager, Michael Brown, seems to suggest that for Malaysia market, Uber also partners with licensed for-hire chauffeur-driven limousine and registered rental car companies. Uber drivers do not use a taxi meter, but rather they use the ride hailing app to calculate fares based on distance travelled and time taken, which according to Uber, the fares are much cheaper than the regulated metered fare. The fare is split 20/80, with Uber taking 20% and the driver taking the rest. Uber also has a surge pricing system whereby fares will go up in busy periods and on certain special occasions such as during bad weather or public holidays. Change often brings resistance. Due to Uber’s unique and novel business model, the response to Uber has been twofold: on one hand, passengers welcome Uber because they get better services for the fare that they pay; while on the other hand, incumbent taxi drivers are up in arms, claiming that

Taxi Apps AKA The Ride Hailing Apps Of The Future. But What About The Resistance Against Them? Read More »

Fighting Phone Thefts With Phone Blocking System @ Public Cellular Blocking Service (PCBS)

Fighting Phone Thefts With Phone Blocking System @ Public Cellular Blocking Service (PCBS)

The rapid increase of mobile phone theft cases has demanded the authorities to take steps to prevent or reduce these cases and ensure that lost/stolen mobile phones are immobilised. One of the steps that the authority, in this case, the Malaysian Communications and Multimedia Commission (“MCMC”) is taking is to set up a national IMEI database and introduce a national phone blocking system using IMEI number. International Mobile Station Equipment Identity (“IMEI”) number is essentially a 15-digit unique number that is assigned to each and every mobile phone in the market, which is used for identifying a particular mobile phone and its functionality as a security feature is used extensively worldwide. Phone blocking system using IMEI number has been used for many years in many countries including the Europe, United States as well as Australia. The idea of phone blocking had first been mooted by the Government since 2008 and was finally rolled out in the 2nd quarter of 2014. Malaysia is the first country in this region that rolls out this phone blocking system. According to the Direction on Public Cellular Blocking Service for Cellular Mobile Access Devices under Required Application Services (Direction 1 of 2013) issued by the MCMC on 30 April 2013; each network service provider and application service provider is required to execute all acts necessary to prepare and/or facilitate the implementation of the Public Cellular Blocking Service (“PCBS“) within 3 months from the date of the Direction including, the installation of an Equipment Identity Register (“EIR”), ensure integration and connectivity of the EIR at all times to the Malaysian Central Equipment Identity Register (“MCEIR”) for the transmission of blocking and unblocking requests, ensure arrangements are in place to deal with the blocking requests of lost/stolen mobile phones and the unblocking requests for recovered mobile phones, ensure that all blocking/unblocking requests are updated to the MCEIR, ensure that all blocking and unblocking instructions from the MCEIR are updated to the EIR; as well as provide reports as required by the MCMC from time to time. PCBS is essentially a service that will enable mobile phone users to block a lost/stolen mobile phone from making /receiving calls, sending/receiving SMS/MMS and accessing all data networks within Malaysia. What it means is that, once the mobile phone is blocked, the mobile phone becomes unusable even if a new SIM card is inserted into the mobile phone. Users are not required to sign up for this service as it is available to all users free of charge. The MCMC said that the system was aimed at reducing street crime and mobile phone theft cases since stolen mobile phones can be sold at half the retail price in the black market. A check on the websites of the three main telecommunication companies (“telcos”) in Malaysia shows that they have already put in place some mechanisms to facilitate the PCBS. The IMEI number is usually stored automatically on the telco’s system when the users subscribe for the telco’s network service. However, users are encouraged to register their ownership details on the www.blockmyphone.my portal so that in the event their lost/stolen mobile phones are found subsequently, the users can claim back their mobile phones. The online ownership registration is free of charge. Only mobile phones that have a valid IMEI number can be blocked under the PCBS. A valid IMEI number is a unique identification number for each mobile phone that is recognized by GSMA. The IMEI number is usually found printed inside the battery compartment of the mobile phone or on the original packaging box. A user can also dial *#06# into the keypad on his mobile phone to obtain the IMEI number on the display screen. The user will need to contact his telco or walk into the participating customer service centre to make a PCBS request. If the mobile phone is found subsequently, the user can contact his telco again to request to unblock his mobile phone. Once the mobile phone is blocked, it will remain blocked until a legitimate unblock request is received by the telco. How does PCBS work? The PCBS uses the IMEI number of the mobile phone to block/unblock lost/stolen mobile phone. If your mobile phone is lost/stolen, immediately report the incident to your telco to; (i) block the SIM card (so that your mobile phone number will be blocked and you will not be charged for any calls made afterwards), and (ii) block your mobile phone under the PCBS (so that the functionality of your mobile phone will be blocked even if a new SIM card is inserted into the mobile phone). If a crime is involved, please also make a police report without delay and ensure that your mobile phone’s IMEI number is included in the police report. If you have registered your own details on the www.blockmyphone.my portal, remember to update your mobile phone’s status as lost/stolen. Upon receiving your PCBS request, your telco will blacklist your mobile phone’s IMEI number on its EIR, and then submit the blacklisted IMEI number to the MCEIR. The MCEIR will then forward the blacklisted IMEI number to all other telcos in Malaysia so that they can also blacklist the IMEI number on their EIRs. Once this is done, your mobile phone will be immobilised. Celcom says that it will take about one working day to process the blocking/unblocking request, but the actual blocking/unblocking will only take place when Celcom’s network detects the mobile phone. DiGi also states that the mobile phone will be blocked/unblocked as soon as DiGi’s network detects the mobile phone. Maxis, however, does not state how long it would take for it to block/unblock the mobile phone. If subsequently, you have recovered your lost/stolen mobile phone, you can request your telco to unblock the mobile phone. You should also update your details on the www.blockmyphone.my portal to remove your mobile phone’s lost/stolen status. If you sell or give away your mobile phone, you should also de-register your mobile phone on the www.blockmyphone.my

Fighting Phone Thefts With Phone Blocking System @ Public Cellular Blocking Service (PCBS) Read More »

The Implications of Section 114A of the Evidence Act 1950

The Implications of Section 114A of the Evidence Act 1950

This month marks the 2nd year anniversary of Section 114A of the Evidence Act 1950 (“Section 114A”), which came into force on 31 July 2012. Much has been said and written about this onerous provision under the Evidence Act 1950 since it was passed by the Malaysian Parliament in 2012. The call for repeal or review of Section 114A also fell on deaf ears as the authorities have not taken any action thus far, save for a short tweet by the Prime Minister saying that he had instructed his Cabinet to review this notorious provision of the law. The intention of Section 114A, according to the Government, is to facilitate the identification and proving of the identity of an anonymous person involved in illicit or harmful content published on the Internet. However, this controversial provision has attracted a lot of criticisms and sparked many debates, particularly from the netizens in Malaysia, who viewed this provision as a move by the Government to threaten the right to freedom of expression on the Web. Section 114A will have an impact on anyone who uses the Internet, computers, or mobile devices; those who administer, operate or provide spaces for online community forums, blogging and hosting services as well as any business premises which offer free WiFi access to their customers. The protest against Section 114A led to the occurrence of the very first Internet Blackout Day in Malaysia that took place on 14 August 2012, which was an action to create awareness about the negative impacts of Section 114A and to show protest against this draconian provision under the law. In a nutshell, Section 114A creates a legal presumption that any registered user/subscriber of a network service, or any person who has in his custody or control any computer on which any publication originates from, is presumed to be the publisher of a publication sent from a computer which is linked to that network service or that computer, unless the contrary is proved. It also provides that any person whose name, photograph or pseudonym appears on any publication depicting himself as the owner, host, administrator, editor or sub-editor, or who in any manner facilitates to publish or re-publish the publication is presumed to have published or re-published the contents of the publication unless the contrary is proved. Section 114A allows the prosecution in a criminal case or a plaintiff in a civil suit to rely on a presumption of fact to prove the identity of the person responsible for an internet publication. It shifts the burden of proof from the prosecution/plaintiff to the accused person/defendant in the sense that the accused person/defendant will be deemed as the publisher of the content unless the accused person/defendant proves otherwise. The implications of this wide and draconian provision could be very serious. For example, if a person hacks into another person’s mobile device or Facebook account, and uses that device or Facebook account to post a defamatory statement anonymously, the victim of the hacked device or Facebook account will be deemed as the publisher and could be sued for the defamatory statement that he did not post. Bloggers and forum administrators also opposed to Section 114A, simply because if a reader of their sites posts a libellous or seditious comment, the bloggers and forum administrators will be deemed as the publishers of the comment and could be charged for sedition or sued for defamation. Çafe operators that offer free WiFi facility at their cafes could also be potentially liable for the conducts of their customers who use the WiFi network to post unlawful content, simply because the operators are the “registered users/subscribers of the network service” which are linked to the content originating from a computer/mobile device using the WiFi service. In short, if an unlawful, illicit or harmful content is tracked back to your username, electronic device or network service, Section 114A presumes you as the publisher of the content. As most of the times, the authorities cannot trace the identity of the actual author who posts or makes those seditious, defamatory or libellous postings, Section 114A now enables the prosecution to hold these people as “publishers” and make them accountable for those unlawful contents, even though they are not the actual authors of the content. Do note that Section 114A is a rebuttable presumption of fact, not a direct presumption of guilt. Notwithstanding the presumption, the prosecution/plaintiff would still need to prove the other elements of the offence/claim. For example, if a person is charged under the Sedition Act 1948 for uttering a seditious statement, that person will be presumed as the publisher under Section 114A, but not necessarily guilty of sedition. The prosecution would still need to prove that those words are “seditious” before that person can be made guilty. Be that as it may, Section 114A essentially goes against the very fundamental principle of natural justice that “one is presumed to be innocent until proven guilty”. Most ordinary individuals would not have the resources to defend themselves in court, compared to the entire machinery that the authorities have, such as the police force, the Attorney General’s Chambers, the Malaysian Communication and Multimedia Commission, etc, who have the technology, manpower and resources to do the investigation. Under Section 114A, individuals will have to bear the disproportionate burden to prove their innocence when it should be the job of the prosecution to prove the commission of the offence by the individuals. Furthermore, dragging such individuals into court would cause unnecessary embarrassment, cost and inconvenience that no amount of compensation can make up for that. The Government has justified this Section 114A by saying that the cross-border nature of the Internet has made it extremely difficult for the authorities to trace the identity of the culprits, who often post those content anonymously. But this cannot be a valid justification, simply because if it is difficult for the authorities to gather the required evidence, what makes them think that it would be less difficult for

The Implications of Section 114A of the Evidence Act 1950 Read More »

Voting: Why It’s Important and Why The Young Should Vote!

Voting: Why It’s Important and Why The Young Should Vote!

Voting makes you feel good because you know you are involved in the democratic process, that your vote counts and your voice is heard. And it is your right and responsibility, too. We are all familiar with voting. We have been voting since we were very young, from voting for class monitor in school, president of the student council in university to voting for our favourite idols in reality TV shows such as Malaysian Idol and Akademi Fantasia. However, when it comes to voting in a general or state election, we still find people who are reluctant, or who do not even care, to cast their vote. The election is an important element in a democratic society. In the US Declaration of Independence, Thomas Jefferson (the third US president) wrote: “Governments are instituted among Men, deriving their just Powers from the Consent of the Governed.” Put in layman terms, it means governments come into power because we, the citizens, grant them the consent to run the country. This reminds me of the famous quote by Abraham Lincoln (16th US president): “Democracy is the government of the people, by the people, for the people.” In Malaysia, Article 119 of the Federal Constitution guarantees every citizen’s constitutional right to vote in an election provided (a) he or she has attained the age of 21; (b) is resident in a constituency or, if not so resident, is an absent voter; and (c) is registered in the electoral roll as an elector in the constituency in which he or she resides on the qualifying date, unless he or she is disqualified under the law. We are very fortunate because our right is guaranteed under the Federal Constitution. Unfortunately, some people do not appreciate the right to vote. It is reported that as many as 4.3 million eligible voters have not registered themselves with the Election Commission, and many of them are young people who have just reached 21 (The Star, Aug 3, 2010). This is an alarming figure in view of the total number of registered voters in Malaysia, which currently stands at 11 million (The Star, Sept 2, 2010). There has been speculation that the 13th general election may be called anytime soon, and if this turns out to be true, a huge number of people, especially young people, will be deprived of their right to vote. Why should young people vote? It is an opportunity for them to choose the candidates or parties they wish to run and lead the nation. Voting recognises the right to equality; the right to speak and the right to be heard. Many people complain that their voices are not heard, but they seem to have forgotten that they have been given the right to express their voice through the ballot paper. Voting is a means to support the democratic system and to ensure that it will continue to work as long as people uphold the principles of democracy. Not voting means giving up on our democracy, and this would upset our forefathers who have fought to preserve and protect our nation’s independence and democracy. An election is an avenue for people to vote for honest and clean candidates of calibre who are fit and competent to lead the nation and be accountable and answerable to the people. It is the only time where changes can be made in the most peaceful and civilised manner without any violence involved. Many election issues have far-reaching implications on the people, especially the younger generation. Education, healthcare, employment, crime rate, corruption, fuel prices, environmental protection are among the issues that affect and will continue to affect the younger generation. Therefore, young people should appreciate that voting is actually an opportunity for them to speak for themselves. Voting sets a good example to others who are not bothered to vote but merely talk. Malaysians love to talk about politics. However, all talk but no walk would not make any difference. Voting is the best way to walk your talk, to tell the candidates that you care about the country; that you like to see how the country is run; how public funds ought to be spent; that you want them to bring positive development to the country. There is a myth that “one vote doesn’t make any difference”. This is not true. If everyone thinks that his or her vote is not significant and chooses not to vote, the democratic system will collapse because of a lack of confidence in the system Candidates who are voted in may not be representing the majority voice. This is dangerous because we are then putting our future in the hands of candidates who do not represent us, and we are letting them make decisions that may affect us. In reality, every vote counts, and history has repeatedly shown that some candidates had in fact won by a slim majority. Voting is also the trend now, and it is cool. You can proudly post a status on Facebook and Twitter and tell the world, “I have voted” or you can blog about Election Day. Besides, voting makes you feel good because you know you are involved in the democratic process; that your vote counts, and your voice is heard. So please, do get yourself registered. If you have already registered, just sit back, relax, do some reading and look forward to marking the “X” on the ballot paper in the near future. Election Day is not another public holiday. It is one of those few events that come once in four or five years, and one of those days when you feel that you are as significant as anyone else on the street because your vote is of equal weight with theirs. So make sure you vote on Election Day. Voting is not just a right; it is a responsibility, too. ***** About the author: This article was written by Edwin Lee Yong Cieh, Partner of LPP Law – law firm in Kuala Lumpur,

Voting: Why It’s Important and Why The Young Should Vote! Read More »

FinTech: New and Innovative Financial Technology Solution

FinTech: New and Innovative Financial Technology Solution

FinTech (a newly coined word which stands for “Financial Technology”) is a portmanteau of financial technology, which illustrates an emerging financial services sector in the 21st century. FinTech refers to non-financial players using technology to offer new and innovative financial products and services (primarily through software) that mirror the services traditionally offered by banks and financial institutions. Some examples of FinTech solutions are such as payment (Apple, Google, PayPal, Amazon and Alibaba have payment solutions that replace physical wallets and credit cards), lending platforms (Zopa, Lending Club, Funding Circle that match lenders and borrowers on their online platforms) and investment strategies (Wealthfront that uses data analytics to dispense online personal financial advice and investment management services). FinTech is driving the financial sector to be more efficient by providing greater access to market-based financing through the application of technology solutions such as the Internet or mobile apps, reducing costs for companies, providing a stronger focus on customer service, making it more convenient, and allowing higher transparency and the exploitation of network effects. FinTech is an umbrella term for a number of alternative financing methods such as peer-to-peer (“P2P”) lending, equity crowdfunding (“ECF”) and merchant financing by electronic marketplace operators to merchants. Other digital financial products and services that are also considered part of FinTech include digital currencies which operate independently of any central authority or banks and payment and remittance systems which bypass traditional banking channels. Governments and regulators around the world (including Malaysia) have started recognising the growing importance of FinTech and the need to provide policy and regulatory framework to grow and accelerate innovation in the FinTech industry. In Malaysia, the Capital Markets and Services Act 2007 was amended by Parliament in 2015 to legally recognise and regulate ECF and P2P platforms. ECF refers to an act of raising fund from investors primarily through an online platform where business owners give away a portion of their equity in their business venture to investors, in exchange for an investment fund. P2P lending, on the other hand, provides investors with an option to earn interest by lending money to business owners based on their risk appetite. New ECF and P2P Lending Guidelines In February 2015, the Securities Commission of Malaysia (“SC”) released Guidelines to facilitate ECF platforms. Following the issuance of the ECF Guidelines, the SC announced in June 2015 the approval of 6 registered ECF platform operators (Alix Global, Ata Plus, Crowdonomic, Eureeca, pitchIN and Propellar Crowd+). It is worth noting that Malaysia is the first country in the ASEAN region to introduce a progressive ECF framework. I had discussed ECF and the mechanisms of ECF platform in my previous article published in July 2015. As part of SC’s continued effort to nurture and facilitate market-based innovation in FinTech under the aFINity@SC initiative, the SC has recently released other guidelines to facilitate P2P lending (“P2P Lending Guidelines”). P2P platform facilitates businesses or companies to raise fund from both retail and sophisticated investors through an online platform. An individual is not allowed to seek personal financing via a P2P platform. With the release of the P2P Lending Guidelines, investors may now use P2P platforms to buy securities in the form of an investment note or Islamic investment note, which are issued by businesses or companies. Once purchased, the issuer of the investment note or Islamic investment note will be obliged to pay the investors over a period of time, with interest or profit. When an issuer applies for funding on a P2P platform, the P2P operator will have to assess and assign a risk score to the investment note or Islamic investment note by evaluating the issuer’s suitability, which includes the issuer’s credit history and capacity to repay. Unlike the framework for ECF, there is no limit imposed by the SC in relation to the amount of fund an issuer may raise on a P2P platform. There is also no investment limit imposed on sophisticated and angel investors. For retail investors, P2P operators have an obligation to advise retail investors to limit their investments to a maximum of RM50,000 so as to manage the risk exposure of retail investors. Operators interested in operating a P2P platform may submit their application to the SC from 2 May 2016 to 1 July 2016. All P2P operators must be locally incorporated and have a minimum paid-up capital of RM5 million. The P2P Lending Guidelines impose certain obligations on a P2P operator. Among others, the P2P operator must; ensure that there is an efficient and transparent risk scoring system in place; it must carry out a risk assessment on prospective issuers; monitor and ensure compliance of its rules; that the issuer’s disclosure document lodged with the P2P operator is verified for accuracy and made available to investors; it must have in place processes to monitor anti-money laundering requirements, manage any default by issuers including using its best endeavours to recover amount outstanding to investors as well as carry out investor education programmes. The rate of financing must not exceed 18% per annum. The scope of due diligence to be exercised by a P2P operator would include taking reasonable steps to conduct background checks on the issuer to ensure fit and properness of the issuer, its boards of directors, senior management and controlling owners, verify the business proposition of the issuer as well as carry out assessment on the issuer’s creditworthiness. An issuer is allowed to keep the amount of fund raised provided that it must have at least raised 80% of its targeted amount. However, the issuer may not keep any amount which exceeds the targeted amount. In addition, an issuer may list on a P2P platform and ECF platform concurrently provided that such information is disclosed to the platform operators. In order to protect the investors, it is mandatory for P2P operators to ensure that the fund raised from investors are first placed into a trust account until the minimum target of 80% of the targeted amount is met. Any repayments by an

FinTech: New and Innovative Financial Technology Solution Read More »

‘Customer Is King’ Might Not Be So True. Or Is It With The New Consumer Orientated Laws?

‘Customer Is King’ Might Not Be So True. Or Is It With The New Consumer Orientated Laws?

More often than not, merchants and service providers, through exclusion clauses, force consumers to accept the terms in toto to enjoy goods or services, but things are definitely changing with more awareness on consumer protection. This year has been a wonderful year for consumers. In the last few months, Parliament passed a series of new laws that grant greater protection to consumers. For instance, the Personal Data Protection Act 2010 provides protection to an individual’s personal data, and the Competition Act 2010 prohibits anti-competitive conduct and abuse of dominant position, thereby protecting the interests of consumers. There is also the Price Control and Anti-Profiteering Bill 2010 in the pipeline, which will serve to control prices of goods and charges for services as well as to prohibit unreasonable profiteering. One of the most remarkable developments in terms of consumer protection is the enactment of the Consumer Protection (Amendment) Act 2010 (“the Act”) which addresses the issues of unfair contract terms. In Malaysia, exclusion clauses are widely used and commonly seen in many places. Car park operators often place a notice at the entrance or on the parking ticket that says to “park at your own risk”. Many traders also prefer to use standard forms of contract which provide a uniform set of terms for general use. More often than not, consumers are left with no choice but to accept the terms in toto in order to enjoy the goods or services. In some cases, one party may seek to exclude or disclaim his liabilities under the law, thereby depriving the other party of exercising his rights. It makes matter worse when the consumer does not read the terms or even if he does read them, there is no way for him to vary the terms. Unfortunately, the court has no general power to strike down a contract merely because it is unreasonable, unconscionable or unfair. Such inequality of bargaining power or unconscionable conduct by the contracting parties in entering into a contract was recognised for the first time in the Court of Appeal decision of Saad Marwi v Chan Hwan Hua & Anor [2001] 3 CLJ 98. In this case, Gopal Sri Ram JCA was of the view that the time has arrived for our courts to recognise this wider doctrine of inequality of bargaining power in order to do justice. Instead of enacting a new piece of legislation to deal with the unfair contract terms, like what has been done in the UK, Malaysia decided to insert a new Part IIIA into the Consumer Protection Act 1999. This new Part IIIA is substantially modelled upon the recommendations of the Law Commission of India’s 199th Report on Unfair (Procedural & Substantive) Terms in Contract (August 2006). An “unfair term” is defined as a term in a consumer contract which, with regard to all the circumstances, causes a significant imbalance in the rights and obligations of the parties arising under the contract to the detriment of the consumer. Part IIIA of the Act introduces the concept of “procedural unfairness” and “substantive unfairness”. Procedural unfairness relates to the process of making the contract and arises when there is an element of oppression or wrongdoing in that process, whereas substantive unfairness is concerned with the contents of the contract and arises when the terms of the contract themselves lead to injustice. A contract is said to be procedurally unfair if it has resulted in an unjust advantage to the supplier or unjust disadvantage to the consumer on account of the conduct of the supplier or the manner in which or circumstances under which the contract has been entered into. A contract is said to be substantially unfair if it is harsh, oppressive, unconscionable, or excludes or restricts liability for negligence or for breach of express or implied terms of the contract without adequate justification. The enactment of the new Part IIIA is indeed an excellent move made by Parliament. It places the burden of proof on the supplier to prove that the exclusion or restriction is not without adequate justification. A court or the Tribunal has the power to raise an issue of the unfairness of contract even if none of the parties has raised such issue in its pleadings. In the event a court or the Tribunal finds the contract or any of the terms of the contract procedurally or substantively unfair, it can declare the contract or the terms as unenforceable or void and it may grant judgment or make an award. Contravention of any of the provisions of this new Part IIIA will attract a heavy fine or term of imprisonment or both. One criticism is that the Consumer Protection Act 1999 applies only to consumer contracts (for e.g. goods or services bought by the individual consumer for private use) and not commercial contracts. The new Section 24B of the Act states that the provisions of this Part IIIA shall apply to all contracts. It is not sure how broadly this provision is to be interpreted i.e. whether it may extend to include commercial contracts such as hire purchase contracts, sale and purchase agreements, insurance contracts, the supply of goods contracts, commercial charter parties, etc. Having said that, it is submitted that if the intention of Parliament is to extend the principles in Part IIIA of the Act beyond consumer contracts, it should have enacted a separate legislation on unfair contract terms (like the case in the UK) or should have incorporated those provisions into the Contracts Act 1950 rather than merely inserting a new part into an existing legislation on consumer protection. By inserting the new part into the Consumer Protection Act 1999, it is submitted that the new part only applies to consumer contracts that fall within the ambit of the Consumer Protection Act 1999. Lord Evershed MR once made an interesting remark where he said: “this contract is so one-sided that I am astonished to find it written on both sides of the paper”. Can we now

‘Customer Is King’ Might Not Be So True. Or Is It With The New Consumer Orientated Laws? Read More »

Equity Crowdfunding Platform . A New Way of Raising Capital and Investing?

Equity Crowdfunding Platform . A New Way of Raising Capital and Investing?

Imagine this: You have got a brilliant business idea and you want to roll it out to the market, but you lack the required capital to kick-start the project or your financial adviser tells you not to “put all your eggs in one basket” as that is a recipe for failure. So you look for other ways to invest your hard-earned money, or you are a successful entrepreneur and you want to develop a platform to help other ambitious entrepreneurs who have dreams but lack of funding. The good news is finally here! The Securities Commission of Malaysia (“SC”) released a new Guidelines on 10 February 2015 to facilitate equity crowdfunding, ECF (“Guidelines”). The Guidelines seek to strike a good balance between the benefits of crowdfunding and its risk to the public. The SC describes equity crowdfunding (“ECF”) as “a new form of fundraising platform that allows startups or other small-and-medium-sized enterprises (“SMEs”) to obtain funding through small equity investments from a relatively large number of investors, using online portals to publicise and facilitate such offers to investors.” The investors receive shares or stocks in return for their investments and can expect a return in the form of dividends if the company performs well. The Platform Operator A person who wishes to operate, provide or maintain an electronic ECF platform (“operator”) must register the platform with the SC. The operator must be a locally incorporated company or a limited liability partnership formed in Malaysia. In order to register an ECF platform; the operator must exhibit to the SC that it will be able to operate an orderly, fair and transparent market; its board of directors, CEO, COO, CFO, etc must satisfy the fit and proper test; it will be able to manage any risk associated with its business and operation; it will appoint at least one responsible person in compliance with the Guidelines; it will be able to take appropriate action against a person in breach; the rules of the ECF platform comply with the requirements of the Guidelines and that it has sufficient financial, human and other resources for the running of the ECF platform at all times. The SC places great emphasis on the security and integrity of the ECF platform’s IT system as it requires the operator to put in place adequate security measures and hire sufficient and capable IT and technical personnel to maintain the system. An ECF platform essentially works like a stock market or a derivatives market that connects entrepreneurs with investors. As such, the SC sees it fit to require the operator to carry out a due diligence exercise on prospective issuers; monitor conduct of issuers, investment limits of investors and any money laundering activities; carry our investor education programmes as well as protect personal data of individuals in accordance with the Personal Data Protection Act 2010. The Issuer A person who wishes to list his project on an ECF platform (“issuer”) must first incorporate a local private company. In terms of the limit to fundraised on the ECF platform, the Guidelines say that an issuer can raise up to RM3 million within a 12-month period, irrespective of the number of projects an issuer may seek funding for and a total of RM5 million through the ECF platform. Raising money from complete strangers is never easy. The issuer will need to come up with a strategic business plan to effectively market and promote itself and its project. First of all, the issuer must choose the right ECF platform to do its listing as it is not allowed to list on multiple ECF platforms concurrently. It should also target a specific pool of investors if the project is a very niche one. For example, if the project is about healthcare related product, it should first target people from the healthcare industry as they would be more inclined to invest in products or services that will improve or add value to their field. Most of the crowdfunding platforms adopt the “all-or-nothing” model i.e. if the issuer fails to raise the targeted investment amount by the deadline, the fund raised will be returned to the investors and the issuer will get nothing. That is why it is so important to have a strong, well-executed plan, as projects listed on an ECF platform can go by really quickly, especially when there are dozens of other projects listed on the platform at the same time, all vying for attention. The issuer should develop an attractive name, a convincing description and an eye-catching image as part of the project to help the project stands up from the pool of projects. The pitching message must be creative and concise enough to grab people’s attention. Getting listed on an ECF platform is just the beginning. The issuer will need to treat fundraising activity very much like how politicians run their political campaigns, and it has to continually drive traffic to its project page through social media, email marketing and other communication tools to engage with its potential investors. In this Internet age, great ideas spread virally very easily and broadly. Make good use of the Internet to reach out to large audiences. Highlight the potential ROI from the project. Show the investors how the fund will be utilized. Practice transparency as that is the key to gain confidence from the investors The Investor in ECF Anyone can become an investor subject to certain restrictions. If you are a sophisticated investor (i.e. accredited investor, high-net-worth entity or high-net-worth individual), there is no limit to the investment amount; if you are an angel investor (i.e. an investor accredited by the Malaysian Business Angels Network), you can invest up to RM500,000 within a 12-month period; and if you are a retail investor, you can invest up to RM5,000 per issuer with a total amount not exceeding RM50,000 within a 12-month period. The Guidelines also put in investor protection mechanisms whereby the operator is required to ensure that any fund raised in relation to

Equity Crowdfunding Platform . A New Way of Raising Capital and Investing? Read More »

MSC Malaysia Status for Technology Startups!

MSC Malaysia Status for Technology Startups!

I was invited to speak at Tech In Asia Conference in Singapore in May 2015. Tech In Asia Conference is one of Asia’s largest conferences organised for entrepreneurs, investors, media and friends in the technology and startup community across the Asia region. The topic of my talk was “Startups and the Laws in Malaysia”. The other 2 speakers speaking on the same panel were Warren Leow (Executive Director at MaGIC) and Ng Wan Peng (Chief Operating Officer at MDeC). In line with the theme of the conference “Connecting Asia’s Tech World”, the conference brought more than 2,500 participants, 200 tech startups and 100 investors (mostly venture capital companies and angel investors) from all over the world to gather at one place. It was certainly an eye-opener event for me and I was thrilled to see so many innovative and promising tech startups coming up from all over Asia. MaGIC (Malaysian Global Innovation and Creativity Centre) and MDeC (Multimedia Development Corporation of Malaysia) shared about the work that these 2 government agencies have been doing in creating and promoting a vibrant and sustainable ecosystem for tech startups and ICT companies in Malaysia. MDeC manages the Multimedia Super Corridor (MSC) project, which aims to boost the ICT sector in Malaysia while MaGIC is entrusted to develop Malaysia’s tech startup ecosystem, with the vision of making Malaysia the tech startup capital of Asia. It was during the talk that MDeC announced that it was collaborating with MaGIC to launch a new programme called “MSC Malaysia for Technology Startups”. MDeC also receives support from some other major startups ecosystem players such as StartupMalaysia.org, the New Entrepreneurship Foundation (MyNEF), Cradle, Cyberview, National Incubator Network Association (NINA), 500 Startups, Technopreneur Association of Malaysia (TeAM) and Founder Institute (FI). As we all know, MSC Malaysia was an initiative conceptualised and launched by the Malaysian government in 1996 to drive the growth and development of the ICT industry in Malaysia. MSC Malaysia status offers multi-tiered incentives to ICT companies that develop or use multimedia and digital technologies to produce and enhance their products and services. It serves as a recognition of world-class service and achievement, while opens access to a host of privileges granted by the Malaysian government to qualified business entities. So what is MSC Malaysia for Technology Startups programme (“Programme”) all about? The Programme provides an alternative for tech startups to attain MSC Malaysia status without being tied to any location requirements (i.e. the tech startup does not have to be located in any of the MSC Malaysia Cybercities and Cybercentres). Prior to the Programme, MSC Malaysia status companies must be located in designated premises within MSC Malaysia Cybercities/Cybercentres (Tier-1 Companies) or commercial premises within MSC Malaysia Cybercities/Cybercentres (Tier-2 Companies) for them to enjoy the various incentives offered under the MSC Malaysia status. The Programme now creates a third category for MSC Malaysia status companies that are located outside of MSC Malaysia Cybercities/Cybercentres (Tier-3 Companies). The Tier-3 Company status is the one that is designed for tech startups. One primary concern before the Programme was launched was that tech startup that wanted to enjoy MSC Malaysia status but cannot afford to move to designated premises or a commercial premises within MSC Malaysia Cybercities/Cybercentres missed out from the MSC Malaysia status incentives. MDeC recognises that tech startups at different growth cycles have different needs and affordability. Bearing that in mind, MDeC therefore decided to launch the Programme for tech startups and it hopes that “the Programme will position Malaysia as the Entrepreneur Hub for Southeast Asia,” said MDeC’s CEO, Dato’ Yasmin Mahmood. For a tech startup to enjoy the incentives under the Programme, it must first apply for an MSC Malaysia status from MDeC. The Programme was launched on 12 May 2015 and it is only applicable to MSC Malaysia status companies approved from 1 January 2015 onwards. MSC Malaysia status companies approved after 1 January 2015 and have not activated their pioneer status incentive are eligible to apply for Tier-3 Company status. A Tier-3 Company can apply to move up to Tier-1 or Tier-2 Company status after 5 years of pioneer status incentive or it can choose to remain as a Tier-3 Company as long as the company is still active. However, such company will be liable to the applicable taxation laws after 5 years of pioneer status incentive. In other words, the company will have to upgrade to Tier-1 or Tier-2 Company status in order for it to enjoy another 5 years of pioneer status incentive. MSC Malaysia status companies approved prior to 1 January 2015 (i.e. Tier-1 or Tier-2 Companies) will still need to adhere to the location requirements as stated in their Conditions of Grant. If they move outside the designated location, it will be considered a breach of the Conditions of Grant. These companies are not eligible to migrate to Tier-3 Companies status and participate in the Programme but will continue to enjoy the full suite of incentives offered under MSC Malaysia status. Some of the main incentives offered to Tier-3 Companies under the Programme are as follows: flexibility in choosing the location of operation; ease of hiring foreign talents (they can hire up to 20 foreign knowledge workers in key positions); competitive financial incentives i.e. 70% tax exemption of statutory income for 5 years and no duties on the import of multimedia equipment; benefits such as networking opportunities, capability building programs and market access programs; and other MSC Malaysia Bill of Guarantees. For a comparison of the different incentives offered to Tier 1-3 Companies, please refer to MDeC’s website here. There are currently 3,600 MSC Malaysia status companies comprising global and local companies across multiple sectors. MDeC expects a further expansion of 8,000 potential ICT companies to participate in MSC Malaysia in the years to come. “Technology is making the world borderless and advancing rapidly; if Malaysian entrepreneurs do not leverage it to grow and scale their ventures quickly, global competitors will take our market share away. We have the

MSC Malaysia Status for Technology Startups! Read More »

Protecting Personal Data In Malaysia

Protecting Personal Data In Malaysia

The PDP is still a step in the right direction and a good beginning, although it lacks the right to claim for compensation in the case of breaches that cause damage or distress. After a decade of delay, the Personal Data Protection Bill 2009 (PDP) has finally been tabled and passed by Parliament. This is a very important piece of legislation as it would affect almost everyone in the country. Generally, the enactment of the PDP is laudable. Prior to this, Malay­sia adopted the sectoral approach in protecting personal data but this approach proved inadequate It is time to have a comprehensive legislation to cover all aspects of personal data protection. The PDP will apply to anyone who processes or who has control over or authorises the processing of any personal data in respect of commercial transactions. The person who processes any personal data is called “data user” and the person whose personal data is being processed is known as “data subject”. The PDP imposes many obligations on the data user. It requires that the data user comply with the seven PDP principles, failing which he can be fined not exceeding RM300,000 or be jailed for a term not exceeding two years, or both. Buying and selling of personal data is a criminal offence. Besides, any individual who feels annoyed with direct marketing will be able to prevent this from happening. The PDP principles require that a data user not process personal data unless with consent from the data subject, and it must be processed for a lawful purpose directly related to an activity of the data user. However, it is not stated whether the consent must be express or can be implied. It also states that a data user has the duty to inform a data subject about the processing of his personal data by way of written notice, and such notice must be given as soon as practicable by the data user. In the absence of consent from the data subject, personal data shall not be disclosed to any party other than the purpose for which the personal data was to be disclosed at the time of collection or for a purpose directly related to that purpose. The data user must also take practical steps to implement security measures to protect and safeguard the personal data. In addition, personal data shall not be kept longer than is necessary and the data must be destroyed or permanently deleted if it is no longer required for the purpose for which it was to be processed. There is, however, no time frame given and the PDP leaves it to the discretion of the data user, who must also take reasonable steps to ensure that the personal data is accurate, complete, not misleading and up-to-date. The PDP also provides the data subject with the right to have access to his personal data held by a data user. If the personal data is inaccurate, incomplete, misleading or not up-to-date, the data subject can request that the data be corrected. Although the PDP confers many rights on individuals and imposes liabilities on those who breach the law, the Act is far from perfect due to its unique features and its narrow application. Here are a few of its shortcomings. The PDP does not apply to the Federal and state governments (an earlier draft of the Bill read: this Act shall bind the Government), although massive amounts of personal data are stored with government departments. For example, the National Registration Department processes most of our personal data; the Inland Revenue Board processes our income tax returns which contain our financial records and sources of income; the DNA Identification Act 2009 allows the Government to keep DNA profiles of individuals in the DNA databank. As such, to exclude the Government from the application of the PDP would be contrary to the objective underlying the PDP in protecting the personal data of its citizens. It is not clear whether local authorities established under the Local Government Act 1976 and those agencies and statutory bodies established under their respective Acts of Parliament to perform specific public functions are also considered as part of the Government. The PDP only applies to the processing of personal data in respect of commercial transactions. The Oxford English Dictionary defines the term “commercial” to mean “engaged in, or connected with, commerce and having profit as a primary aim rather than artistic etc. value”. The Government has repeatedly emphasised that the PDP is critical in this age of e-commerce and it will solve such problems as credit card fraud, identity theft and selling of personal data without customers’ consent. However, personal data protection is not just about safeguarding personal data in the commercial world. It is equally important to protect personal data such as medical and health records, employee records, financial records, and even criminal records. These personal data may be used for employment, educational, professional, taxation, social security and welfare etc. For example, someone may have submitted his personal data in a contest or enquiry form. The use of personal data in these situations may not necessarily involve a “profit-making” element and it is hardly to be considered as “use in respect of commercial transactions”. The effect of this restrictive limitation is that the PDP applies to, and within, the private sector, and then further narrows down to organisations which process personal data in commercial transactions. It is unclear whether civil remedies are available under the PDP. In many other jurisdictions such as Britain and Hong Kong, breaches of data protection law are punishable under both criminal and civil law. Any individual who suffers any damage (which include injury to feelings) or distress by reason of a contravention of the provision of the PDP shall be entitled to file a civil suit and claim compensation for such damage or distress. A similar provision was found in an earlier draft but omitted in the PDP. This is ironic because while the PDP provides

Protecting Personal Data In Malaysia Read More »

Responsibilities of Executor:

  • Apply for and extract the grant of probate.
  • Make arrangements for the funeral of the deceased.
  • Collect and make an accurate inventory of the deceased’s assets.
  • Settling the debts and obligations of the deceased.
  • Distributing the assets.

Note for Digital Executor:
If you wish to leave your digital assets to certain people in your Will, there are important steps that need to be taken to ensure that your wishes can be carried out:

  • Keep a note of specific instructions on how to access your username and password of your digital asset.
  • You are advised to store these private and confidential information in a USB stick, password management tool or write them down.
  • Please inform your executor or a trusted person of the whereabouts of the tools so that they will have access to your digital asset.