MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
been breached and direct the data controller to take specified steps to remedy the contravention within a prescribed period. The notice may also require the data controller to cease processing personal data pending the rectification of the breach. Data controllers who are not satisfied or disagree with the enforcement notice may initiate appeal proceed - ings with the Appeal Tribunal. Failure to comply with an enforcement notice constitutes an offence, punish - able by a fine of up to MYR200,000, imprisonment for Data controllers are also reminded that various pro - visions of the PDPA carry fines and jail terms, with any contravention of the PDP Principles carrying a maximum fine of MYR1 million and/or imprisonment for up to three years. Sector-Specific Requirements Apart from the PDPA, data controllers in certain sec - tors may also be at risk of breaching certain sectoral requirements, such as Section 133 of the FSA. Any person who contravenes Section 133 of the FSA shall on conviction be liable to a fine not exceeding MYR10 million, five years’ imprisonment or both. Similarly, Section 234 of the FSA provides BNM with the power to take action against any person who has committed a breach under the FSA, or if the person has failed to comply with or give effect to any stand - ards, such as the RMiT or MCIPD. This includes the power to prescribe monetary penalties as well as the power to provide the person with a notice in writing ordering them to comply or give effect to the standard. Data Sharing Between Public Sector Agencies Section 18 of the DSA provides that any officer or servant of a data recipient shall not use or disclose the data shared under the DSA other than for the purpose up to two years, or both. Penalties for Breaches
ment activities against unregistered data controllers. The Commissioner also released a list of compound cases issued under the PDPA from 2017 to 2025, which recorded that a total of 33 data controllers were required to pay a compounded fee for breaches to one or more sections under the PDPA. Additionally, a total of eight cases were taken to court. To date, the highest publicly reported compound issued under the PDPA is MYR108,000 for breaches of the General, Disclosure and Retention Principles. Based on the above trends, data controllers should place higher importance on ensuring their compliance with the PDPA including the seven PDP Principles, and ensure adherence to the PDP Standards, the PDP Regulations, and any subsidiary legislation or guide - lines issued pursuant to the PDPA. Sector-Specific Requirements BNM has over the past years carried out various enforcement activities against financial institutions. The trend relating to enforcement activities for dis - closing customer information is discussed under 3.4 Regulators and Enforcement . Over the past 24 months, a small number of cases involving civil claims for non-compliance with the PDPA have been brought to court. However, these cases were dismissed, with the courts either making a finding that there was no breach, or that the PDPA did not provide data subjects with the ability to pursue civil claims on the basis of non-compliance with the PDPA. On the other hand, the PDPA has been used in court to contend that certain documents should not be pro - duced in court as this would violate the disclosure principle under the PDPA. These typically involved cases focused on disputes of a different nature, such as disputes over employment or banking which required the production of certain documents or per - sonal data. 2. Privacy Litigation 2.1 Privacy Litigation Overview
for which the data is shared. 1.9 Enforcement Trends
According to the list of inspection activities pub - lished on the JPDP’s website, the JPDP carried out four inspection visits to four different data control - lers’ personal data systems, as well as two enforce -
293 CHAMBERS.COM
Powered by FlippingBook