MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
1.7 Regulators The Commissioner, assisted by officers in the JPDP, acts as the primary regulator overseeing enforcement of the PDPA and its regulations. Section 48 of the PDPA lays out the functions of the Commissioner, which include: • implementing and enforcing the PDPA; • monitoring and supervising compliance with the PDPA; and • promoting awareness and disseminating informa - tion to the public about the operation of the PDPA. In addition to the general functions and powers, the Commissioner is provided with a wide range of inves - tigative and enforcement powers, which include the power to: • inspect any personal data system used by a data controller for the purpose of obtaining informa - tion that would assist the Commissioner in making recommendations to promote the data controller’s compliance with the PDPA; • carry out investigations where complaints have been lodged by data subjects or where the Com - missioner has reasonable grounds to believe that a data controller may be in contravention of the PDPA; • issue enforcement notices to direct a data control - ler to take steps to remedy any contravention of the PDPA, or to cease processing personal data until the contravention has been remedied; • carry out search and seizure with or without a war - rant on the data controller’s premises; • request access to computerised data when con - ducting a search on the data controller’s premises; • require production of any computer, book, account, computerised data or other document kept by the data controller; • require attendance of persons acquainted with the case and examine such persons to obtain their statement when carrying out its investigation under the PDPA; • arrest without warrant any person reasonably believed to have committed, or to be attempting to commit, an offence under the PDPA; and • issue compounds for offences under the PDPA.
Note that the digital minister has proposed elevat - ing the Commissioner’s office, which currently oper - ates as a government department, into a full-fledged independent data commission. This proposed reform aims to enhance the Commissioner’s enforcement and oversight powers, and to strengthen overall data protection and governance in Malaysia. Sector-Specific Requirements In addition to the JPDP, regulators who oversee spe - cific sectors are provided with the power to ensure compliance with specific sectorial requirements. For example, BNM acts as the regulator of the financial sector. It is provided with vast powers to oversee compliance with the FSA and set standards relating to the conduct of financial institutions, including conduct relating to the processing of customer information. Data Sharing Between Public Sector Agencies The DSA sets up the National Data Sharing Commit - tee (NDSC), which oversees the implementation of the DSA. They are assisted by the DGNDD. Their roles are further discussed in 3.4 Regulators and Enforcement . 1.8 Enforcement Proceedings and Fines Investigations and Enforcement Notices The PDPA does not grant data subjects a private right of action or a right to claim compensation from data controllers or data processors for non-compliance with the PDPA. Instead, aggrieved individuals may lodge written complaints with the Commissioner in respect of any act, practice or request relating to their personal data. Upon receiving such a complaint, the Commissioner may conduct an investigation unless one of the circumstances under Section 106 of the PDPA applies, which permits the Commissioner to refuse to proceed with the complaint (eg, the com - plaint is frivolous, vexatious or is not made in good faith). Following an investigation, the Commissioner may issue an enforcement notice to a data controller if he is of the opinion that the data controller is contraven - ing any provision of the PDPA or has previously con - travened it in circumstances that make it likely that the contravention may continue or be repeated. The enforcement notice will state the Commissioner’s find - ings, identify the relevant statutory provision that has
292 CHAMBERS.COM
Powered by FlippingBook