MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
Following the High Court’s decision, the appellants decided to take the matter to the Court of Appeal. However, the appeal was subsequently dismissed. In reaching its decision, the Court of Appeal emphasised that, given the penal consequences arising from non- compliance with the PDPA, allegations of offences under the PDPA must be pursued strictly through the complaints mechanism provided by the JPDP. The Court of Appeal emphasised that, pursuant to Sec - tion 104 of the PDPA, complainants are required to submit a written complaint to the Commissioner, who is empowered to investigate and take appropriate action. Additionally, the Court of Appeal clarified that non-compliance with the PDPA cannot be used as a cause of action in a civil suit. It is clear from this case that the primary mechanism available to any party aggrieved by another party’s non-compliance with the PDPA lies with the complaint mechanism provided by the JPDP. Any party that attempts to pursue a civil claim for non-compliance with the PDPA will fail in their claim due to the fact that the PDPA does not provide for any means to make civil claims, unless and until a further decision of an appellate court in Malaysia determines otherwise. 2.3 Collective Redress Mechanisms The PDPA does not provide aggrieved parties with the ability to pursue civil claims in the court, therefore collective redress is unlikely to succeed in Malaysia at this juncture (based on case law). Any complaints relating to a breach of the PDPA may only be chan - nelled to the JPDP who may then carry out an inves - tigation. As such, there is currently no available collective redress mechanism available to the public to take action against any party in breach of the PDPA. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Public Sector Agencies The largest legislation pertaining to the sharing of data (both personal data and non-personal) between public sector agencies is the DSA, which has been approved
by the parliament of Malaysia but has yet to come into force. The DSA will establish the National Data Sharing Committee (NDSC) and sets down the general rules pertaining to the sharing of data between public sector agencies. This includes the methods to request data sharing, the purposes for which data may be shared, as well as the circumstances in which a pub - lic sector agency may deny a data-sharing request. Additionally, the DSA imposes duties and obligations in relation to the protection of data that has been shared, such as the requirement to take necessary measures to ensure the security and privacy of data, including the protection of data from any loss, mis - use, unauthorised or accidental modification, access or disclosure, alteration or destruction. This obligation is similar to that provided under the PDPA in relation to the protection of personal data. Additionally, the obligation to protect data shared under the DSA extends to the recipient of the data as well as third parties who have been engaged by the data provider or recipient to conduct any data migra - tion, data integration or data analytics work using the data shared under the DSA. Finally, Section 23 of the DSA provides a general obligation of secrecy, imposing a requirement on any officer or servant of public sector agencies not to dis - close any information obtained by them during the course of their duties. Sector-Specific Requirements Certain sectors in Malaysia impose additional require - ments on the sharing of data through their regulations and guidelines. For example, in the financial sector, Section 133 of the FSA prohibits the disclosure of any document or information relating to the affairs or account of any customer of the financial institutions, unless one of the conditions provided under Section 134 of the FSA is met. This applies to all documents or informa - tion relating to the affairs or account of the customer regardless of whether it is personal data or non-per - sonal data.
295 CHAMBERS.COM
Powered by FlippingBook