MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
• Access Principle (Section 12) – this is the require - ment to allow data subjects to access and correct their personal data. In addition to the seven principles, the PDPA also pro - hibits the transfer of personal data outside Malaysia, unless one of the conditions listed under Sections 129 (2) or (3) of the PDPA is met. With respect to data subject rights, the PDPA confers data subjects with several rights in respect of their personal data: • right of access to personal data – data subjects are entitled to be informed by a data controller as to whether their personal data is being processed by, or on behalf of the controller; • right to correct personal data – data subjects are entitled to correct their personal data if it is inaccu - rate, incomplete, misleading or out of date; • right to withdraw consent – data subjects are enti - tled to withdraw their consent to the processing of their personal data; • right to prevent processing of personal data that is likely to cause damage or distress – data sub - jects are entitled to request that the data controller cease or not commence the processing of their personal data based on the reasons that the pro - cessing is causing or is likely to cause substantial damage or substantial distress to the data subject or another person, and such damage or distress is or would be unwarranted; • right to prevent processing for purposes of direct marketing – data subjects are entitled to request that the data controller cease or not commence the processing of their personal data for direct market - ing purposes; and • right to data portability – data subjects are entitled to request that the data controller transmit their personal data directly to another data controller, subject to technical feasibility and compatibility of format. 1.3 Special Categories of Personal Data Under the PDPA, any personal data relating to the physical or mental health of a data subject, their politi - cal opinions, religious beliefs or other similar beliefs, biometric data, or the commission or alleged com -
mission of an offence, is considered to be “sensitive personal data”. As a general rule, explicit consent is required for the processing of sensitive personal data. While the PDPA does not provide any definition or guide as to what constitutes explicit consent, it is generally understood that explicit consent requires the data subject to have carried out an affirmative action to signify their con - sent. This includes: • writing the words “I consent”; Both data controllers and data processors (ie, any per - son who processes personal data for and on behalf of a data controller, and not for its own purposes) are required to implement enhanced security safeguards to protect sensitive personal data. This is because under the PDPA’s Security Principle, the level of secu - rity should correspond to the nature of the personal data and the harm that may result from its loss, mis- use, modification, unauthorised or accidental access or disclosure, alteration or destruction. Processing of Personal Data of Children The PDPA does not impose children-specific data pro - tection obligations. Nevertheless, as individuals below the age of 18 are not legally able to provide consent, Regulation 3 (3) of the PDP Regulations provides that consent for the processing of a child’s personal data must be obtained from a parent, guardian, or any such person with parental responsibility over that child. 1.4 Processing of Personal Data for Research and Development Purposes When personal data is processed for the purpose of preparing statistics or carrying out research, the pro - cessing is exempted from the General, Notice and Choice, Disclosure and Access Principles, as well as other related provisions of the PDPA. This exemp - tion applies only where the personal data is not used for any other purpose and the resulting statistics or research findings are anonymised, such that no data subject is identifiable. • ticking a check box; or • providing their signature.
289 CHAMBERS.COM
Powered by FlippingBook