MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
Finally, in a recent significant case, namely Genting Malaysia Bhd v Pesuruhjaya Perlindungan Data Perib- adi & Ors [2025] 4 CLJ 710, the claimant commenced judicial review proceedings against a statutory body relating to disputes over the disclosure of personal data. That said, the number of cases involving the PDPA since 2010 have been limited in number, often due to the fact that aggrieved parties are prevented from pursuing civil claims against the non-complying party. This is unlikely to change in the near future as the Commissioner of the JPDP has not signalled any intention to introduce civil claims and remedies under the PDPA. Therefore, future cases are likely to primar - ily involve the disclosure of documents or information as well as judicial review proceedings. 2.2 Recent Case Law Genting Malaysia Bhd v Pesuruhjaya Perlindungan Data Peribadi & Ors The case of Genting Malaysia Bhd v Pesuruhjaya Per- lindungan Data Peribadi & Ors [2025] 4 CLJ 710 gar - nered a great deal of public attention as it was the first time that the director general of Inland Revenue was taken to court over a personal data-related dispute. As such, the case was touted to lay the groundwork for the extent to which a statutory body may request and obtain access to personal data. Under the Income Tax Act 1967 (ITA), the Inland Rev - enue Broad of Malaysia (IRB) is provided with broad powers to ensure effective collection of tax revenue. This includes Section 81 of the ITA, which empowers the director general of the IRB (DGIR) to demand the disclosure of information or particulars that are in the possession or control of a person, for the purposes of the ITA. The dispute arose when the DGIR exercised his pow - ers under Section 81 of the ITA to demand that Gent - ing Malaysia Berhad (“Genting”) disclose the personal data of all of its customers who were members under the Genting Rewards Loyalty Programme (“Loyalty Programme”) for the purposes of enlarging the IRB’s tax base.
Genting refused to agree to the demand, stating that complying with the DGIR’s demands would result in Genting breaching its obligations to customers under the PDPA. In response, the DGIR stated that the dis - closure was permitted under the PDPA as it met the exemptions listed under Sections 39 and 45 of the PDPA. As a result of this, Genting subsequently filed a judicial review application with the High Court, which then ruled that the PDPA does not allow the DGIR to make blanket demands for personal data (in this case, the demand for the data of all customers who were members of the Loyalty Programme). That said, the High Court’s ruling was overturned by the Court of Appeal, which ruled that the judicial review application brought forward by Genting was time barred as it was filed after the three-month win - dow prescribed by Order 53 Rule 3 (6) of the Rules of Court 2012 had passed. Genting’s motion for leave to appeal to the Federal Court was also dismissed. Nevertheless, while the ruling by the High Court was overturned, this case has made it clear that the courts will not be shy in limiting the powers of statutory bod - ies in cases where the collection and processing of personal data is found to be excessive. In the event that another similar application for judicial review sur - faces, the decisions of the High Court, while not bind - ing, may serve as an indication of how the courts may decide such cases in the future. Ranjan Paramalingam & Anor v Persatuan Penduduk Taman Bangsar Kuala Lumpur In the case of Ranjan Paramalingam & Anor v Persat - uan Penduduk Taman Bangsar Kuala Lumpur [2023] 1 MLJ 459, the appellants alleged that, among other things, the residents’ association unlawfully obtained and misused the personal data of Bangsar Park resi - dents under the guise of implementing a guarded neighbourhood security scheme. They claimed this amounted to a breach of the PDPA and sought an inquiry into the acquisition and use of their data, along with damages. In its decision, the High Court found that personal information was collected solely for security purposes with no evidence of misuse. As such, the High Court ruled that there was no breach of the PDPA.
294 CHAMBERS.COM
Powered by FlippingBook