MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
The above requirements are further supplemented by various guidelines issued by the regulator, BNM. For example, the MCIPD lays out the specific condi - tions for permitted disclosures as well as the financial institution’s obligations in relation to the protection of customer information, and notification requirements in the event of a breach. Note that when processing personal data, financial institutions need to comply with the requirements under both the PDPA and FSA. On the other hand, the disclosure of data under certain sectors is regulated under different acts. For example, the disclosure of credit information by credit reporting agencies is regulated by the Credit Reporting Agen - cies Act 2010 (CRAA). Any information subject to regulation by the CRAA is expressly excluded from the PDPA’s scope. As such, when processing and disclosing credit information for the purpose of the credit reporting agency’s business, the credit report - ing agency is not required to comply with the PDPA and will instead be subject to the relevant require - ments under the CRAA. National Cloud Computing Policy The National Cloud Computing Policy (NCCP) serves as a framework for cloud adoption across Malaysia’s public, private and citizen sectors. In particular, it serves as a mandate for cloud adoption within gov - ernment agencies. While the NCCP merely sets out a framework for the adoption of cloud policy, it provides important insight into the likely direction the government wishes to take in relation to data sharing using cloud technol - ogy. Examples of this include Pillar One of the NCCP, which aims to prepare a cloud-based data integration platform for government agencies, allowing them to share data across agencies efficiently. Nevertheless, the NCCP does not set out unique rules for sharing data across the cloud – rather, it refer - ences existing laws in Malaysia such as the PDPA and requires all stakeholders to adhere to the standards set under the PDPA. In cases where there is cross- border data transfer, the NCCP reminds all stakehold - ers that they may also be subject to the other nation’s
personal data protection laws, such as the EU General Data Protection Regulation. 3.2 Interaction of Data Regulation and Data Protection Public Sector Agencies With regards to IP protection, Section 4 (2) of the DSA provides that any data shared under the DSA is deemed to be compiled pursuant to the relevant provisions of the statutes listed under the schedule of the DSA. This list includes Section 52 of the Copy - right Act 1987 (the “Copyright Act”) which regulates the disclosure of information obtained pursuant to the Copyright Act. Therefore, any data that is considered to be the intel - lectual property of another person may only be shared in compliance with Section 52 of the Copyright Act. Sector-Specific Requirements In cases where the PDPA applies to the processing and disclosure of data, data controllers within these industries (such as the financial industry) are expected to comply with both the requirements under the PDPA as well as the relevant requirements under the appli - cable act, regulation or guideline. As such, financial institutions are required to comply with both the PDPA and secrecy obligations under the FSA and applicable guidelines. In cases where there are differing stand - ards, the financial institution will be expected to com - ply with the stricter standard. On the other hand, credit information subject to the requirements under the CRAA are expressly excluded under the PDPA. As such, credit reporting agencies are not required to comply with the PDPA when dis - closing credit information. However, credit reporting agencies are still required to comply with the PDPA when dealing with non-credit information, such as the personal data of their employees. In the case of IP protection of non-personal data, the Copyright Act will apply in all sectors, unless there is an act that expressly limits its application. National Cloud Computing Policy Part 4 of the NCCP (governance and oversight) sets down the applicable regulatory framework to ensure
296 CHAMBERS.COM
Powered by FlippingBook