MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
Additionally, the Commissioner intends to issue the DPbD Guideline which aims to encourage data con - trollers to integrate privacy considerations into all aspects of their personal data management. Based on the Public Consultation Paper on the DPbD Guideline, the DPbD Guideline intends to introduce the element of data minimisation, which encourages data control - lers to verify whether the relevant purposes for pro - cessing personal data can be achieved by using less detailed, aggregated, or non-personal data. Where the purpose ultimately does not require identification – such as in statistical analyses – the DPbD Guideline expects controllers to delete or anonymise personal data as soon as identification is no longer required. If identification must be retained for other processing activities, controllers are encouraged to apply pseu - donymisation to reduce the risk to data subjects. Sector-Specific Requirements Similarly, the Malaysian Medical Council’s Guide - lines on Confidentiality echo this principle by ensur - ing that data used for medical research or audit be anonymised wherever practicable. Where anonymisa - tion is not feasible or would undermine the validity of the research, the Guidelines on Confidentiality require that express consent be obtained before any identifi - able patient data is used or disclosed. This reflects a consistent approach in Malaysia where anonymisa - tion is preferred for research purposes, and identifi - able data may be used only where necessary and with appropriate safeguards. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Malaysia currently does not have a dedicated statute or comprehensive regulatory framework governing AI. As a result, the legal landscape is shaped primarily by non-binding policy guidelines and the application of existing laws to AI-related activities. While certain sectoral regulators have introduced guidelines or requirements to address AI risks within their respec - tive domains, such initiatives remain limited in scope and are the exception rather than the rule. In the absence of binding AI-specific legislation, ref - erence is often made to the National Guidelines on AI Governance and Ethics (“NAIGE”). While NAIGE does not carry any legal effect, it currently serves as
Malaysia’s principal policy instrument for promot - ing responsible and ethical AI development and use. NAIGE sets out seven AI principles that end users, including individuals and organisations deploying AI systems, are expected to observe. One of the key principles is “privacy and security”, which emphasises that when handling personal data such as financial or health information, proper procedures, informed con - sent, and secure storage practices are essential. In line with this, NAIGE underscores the need for robust security measures to protect against hacking, data breaches and other malicious activities. Therefore, AI developers are encouraged to obtain consent where required, ensure privacy and data protection throughout the AI system life cycle, avoid unlawful or discriminatory use of data, and incorporate privacy-by-design and security-by-design approach - es aligned with relevant international standards. Separately, the Commissioner intends to issue the ADMP Guideline to address risks arising from the use of automated systems. Based on the public consul - tation paper on the ADMP Guideline, the guideline intends to confer three rights on data subjects, collec - tively referred to as the Automated Decision-Making Restrictions: • the right to refuse to be subjected to a decision based solely on automated decision-making (including profiling) which produces legal effects concerning the data subjects or significantly affects the data subject; • a right to information on the automated decision- making being undertaken (ie, the transparency requirement); and • a right to request a human review of the automated decision-making. In addition, the public consultation paper on the ADMP Guideline highlights the Commissioner’s proposal to introduce specific safeguards for the processing of biometric data in the context of automated decision- making and profiling. However, as automated deci - sion-making and profiling are not currently recognised or defined concepts under the PDPA, it remains to be seen whether the ADMP Guideline, once issued, will carry any binding legal effect.
290 CHAMBERS.COM
Powered by FlippingBook