Privacy & Information Security Law Blog

On November 14, 2013, the Minister of the Malaysian Communications and Multimedia Commission (the “Minister”) announced that Malaysia’s Personal Data Protection Act 2010 (the “Act”) would be going into effect as of November 15, marking the end of years of postponements. The following features of the law are of particular significance:

• The law applies only to the processing of personal data in commercial transactions (in effect, private sector transactions, though not including credit reporting agency businesses). The law does not apply to Malaysia’s federal government or to its state governments.
• The law applies to the processing of personal data by persons established in Malaysia (or by any other person employed or engaged by a person established in Malaysia), and to processing of personal data by persons who are not established in Malaysia, but who use equipment located in Malaysia to process the personal data (other than for purposes of transit through Malaysia).
• Aside from corporations and partnerships formed under Malaysian law and Malaysian branches of foreign companies, the term “persons established in Malaysia” includes individuals who are physically present in Malaysia for 180 days or more per year, and persons who maintain “a regular practice” in Malaysia. It is unclear exactly what is meant by “a regular practice” in Malaysia.
• The law does not apply to the processing of personal data outside Malaysia, unless the personal data is intended to be processed further in Malaysia.
• The law imposes a number of generally applicable principles. Of these, the most significant on a practical level appear to be a principle requiring the data user to provide the data subject with notice of the purposes for which it will process personal data (and certain other information), and a principle requiring that a data subject must give consent to the processing of personal data. In addition, the Act also establishes principles of non-disclosure (confidentiality), security safeguards, retention limitations, data integrity and access and correction rights.
• The law establishes a category of sensitive personal data that requires the explicit consent of the data subject to be processed.
• The law imposes cross-border transfer restrictions. The basic rule is that data may not be transferred to locations outside of Malaysia unless the jurisdiction is included in a whitelist published by the Minister. However, the Minister did not publish a whitelist when he announced that the law was going into effect. Accordingly, until a whitelist is published, cross-border transfers may proceed via one of a few alternative means, such as (1) with the consent of the data subject, or (2) if the data user has taken all reasonable precautions and exercises due diligence to ensure that the personal data will not be processed in a manner that would contravene the Act. The latter appears to suggest the possibility of transferring data using standard contractual clauses, but this remains to be developed more fully.
• The law imposes some restrictions on the handling of personal data that is used in direct marketing. A data subject may require a data user to cease processing (or not start processing) his or her personal data for direct marketing purposes.
• The law allows the Minister to designate classes of data users who must register their data processing activities. At present, these include data users in the communications, banking and finance, insurance, health care, tourism and hospitality, transportation, education, direct sales, services, real estate and utilities sectors. Data users in these categories will have three months from November 15 to register.
• The Act imposes criminal penalties for violations. The penalties may include fines as well as imprisonment. For example, failure to cease using personal data for direct marketing purposes after a data subject has objected could result in a fine of up to 200,000 Malaysian Ringgit (approximately U.S. $62,800) and/or imprisonment of up to two years. A violation of the cross-border transfer restriction could result in a fine of up to 300,000 Malaysian Ringgit (approximately U.S. $94,200) and/or imprisonment of up to two years. A data user that is required to register, but processes personal data without having registered, could be subject to a fine of up to 500,000 Malaysian Ringgit (approximately U.S. $156,850) and/or imprisonment of up to three years.
• If a corporation violates the Act, individual officers who were to any extent responsible for the management of the corporation may be charged severally or jointly in the same proceedings with the corporation. This may include a director, chief executive officer, chief operating officer, manager, secretary or other similar officer.
• A new regulation whose promulgation accompanied the effectiveness of the Act includes a clarification on how to obtain a data subject’s “consent.” Under this regulation, consent must be obtained in a form that “can be recorded and maintained properly by the data user.” The burden of proof is on the data user to establish that consent was obtained.

Finally, the Minister announced the appointment of a Personal Data Protection Commissioner.

Going forward, it will be interesting to observe how enforcement is carried out in a country where there is less public awareness of privacy issues than may be found in other parts of the Asia-Pacific region.