PDPA 2010: One Year On, What We Have Achieved So Far
The Personal Data Protection Act 2010 (“PDPA”) is the very first legislation in Malaysia that seeks to comprehensively protect personal data. As we do not have a general Privacy Act in place, and our Federal Constitution does not expressly recognize the right to privacy (although our Court of Appeal in one particular case held that the right to life and liberty (Article 5) is arguably broad enough to include the right to privacy), the PDPA is certainly a very much needed piece of legislation that Malaysians have long been waiting for. So when the PDPA was passed in June 2010, it was seen as a positive move by our Government towards recognizing the importance of protecting personal data of individuals in Malaysia. It also signals an important milestone for Malaysia in bridging the gap between Malaysian laws and international trends in protecting personal data. To prevent the misuse and disclosure of personal data to unauthorized third parties, governments around the world have enacted legal regimes on personal data protection. In ASEAN, Malaysia and Singapore are the only two countries which have enacted a comprehensive data protection legislation. Three years down the road, the PDPA finally came into force on 15 November 2013. One would have thought that given the time that it took for the PDPA to come into force after it was passed by the Parliament in June 2010, most data users (i.e. companies/organisations/individuals who either alone or jointly in common with other persons process any personal data or have control over or authorize the processing of any personal data) would have put aside sufficient time and resources to make sure that they take the necessary steps to establish, review and strengthen internal policies, procedures, processes and systems that govern the management and handling of personal data in order to comply with the law. Unfortunately, that was not the case. When the Government announced that the PDPA will come into force on 15 November 2013, many companies and organisations were rushing into getting themselves PDPA compliant, as they were only given a 3-month sunrise period to ensure compliance with the law. Hence, we saw a spike in companies and organisations busy churning out privacy policies and notices. Data users who were required to register themselves with the Personal Data Protection Department (“PDP Department”) were also uncertain with the registration process. Perhaps due to inadequate publicity or low awareness, some data users were not even aware of the registration requirement, which had resulted in them being late in submitting their registration forms. Meanwhile, some companies and organisations (especially small and medium enterprises) chose to take a “wait-and-see” approach, conveniently ignored the fact that the PDPA applies to every company, organisation and individual in the country, and not just the big boys. It has been one year since the coming into force of the PDPA. Let’s examine what we have achieved so far, what could have been done, and what else we all can do. While the deadline for data user registration was already over, the PDP Department acknowledged that the 3-month sunrise period was relatively short (Singapore’s PDPA, which has also recently come into force, provided an 18-month sunrise period). As such, the PDP Department adopted an unofficial stand by stating that they will still accept late applications for registration, provided it was accompanied with a letter stating the reason(s) for the delay. As of November 2014, the PDP Department had registered more than 7,000 data users from various industries. Encik Abu Hassan bin Ismail was appointed as the first Personal Data Protection Commissioner. The current Commissioner is Encik Mazmalek bin Mohamad. Several regulations and orders have also been enacted, and the PDP Department has initiated public consultations on various guidelines to deal with specific topics such as management of CCTV images, direct marketing, employee data, consent requirements as well as general rules on compliance with the PDPA. In an effort to create and raise public awareness, officers from the PDP Department have also been busy going around the country to conduct seminars and conferences on PDPA. It is worth noting that the PDP Department always welcomes public opinions (for example through issuing public consultation papers) and constantly engages in talks and discussions with stakeholders such as industry players, NGOs, professional bodies and business associations. All the efforts that have been put forward by the PDP Department must be commended, and we hope that the PDP Department will continue to engage with and consult stakeholders on the implementation of this broad-ranging law. As for companies and organisations, some of them, especially large companies and organisations, have already put in place certain procedures and processes to ensure compliance with the law. However, the approaches have been rather diverse. Depending on the nature and size of the business, some have put in extensive procedures and complex processes (such as banks, insurance companies, telcos), while some have just put up a privacy policy on their websites, thinking that by doing so, they have complied with the law. This can be attributed partly to the different levels of understanding towards compliance with the law and interpretation of the PDPA, and partly to other reasons such as no guidelines from the authorities providing clear guidance on the interpretation of the PDPA. There are still a lot of grey areas under the PDPA which require further clarification. Under the PDPA, in order for a data user to process an individual’s personal data, he must obtain consent from the individual, and the consent must be in a recordable form and capable of being maintained properly by the data user. So… Does this mean that consent must be in writing? Must the individual sign on the privacy notice or is it sufficient that the privacy notice is attached to the form where the individual fills in his personal data? What about deemed or verbal consent? Is that not acceptable? When dealing with a company or an organisation, does a data user need to get consent from every
PDPA 2010: One Year On, What We Have Achieved So Far Read More »









