MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
In cases where the online tracking technology pro - cesses personal data, the general requirements under the PDPA for the processing of personal data will apply. As such, any person who uses online tracking technology to process personal data will be required, among other things, to obtain consent for such pro - cessing, and to prepare and provide users with a pri - vacy notice. 4.2 Personalised Advertising and Other Online Marketing Practices Use of Personalised or Targeted Advertising Personalised or targeted advertising refers to adver - tisements that are tailored to an individual’s interest. In order to achieve this, personal data of that individual, such as their age, preferences, purchase history, web search history and nationality, will be collected and processed. Therefore, any processing of personal data for the purposes of personalised or targeted advertising must be carried out in line with the PDPA. This includes the requirement to obtain the data subject’s consent as well as providing them with a privacy notice which, among other things, informs them that their personal data will be used for the purposes of personalised or targeted advertising. In the event that the personal data processed includes sensitive personal data, such as a person’s physical or mental health condition, political opinions, reli - gious beliefs, commission or alleged commission of an offence, or biometric data, the advertiser will be required to obtain the explicit consent of the data sub - ject before it may carry out the processing of such data. The above requirement to obtain consent extends to any personalised or targeted advertising directed at children. In the event that children’s personal data is processed, the advertiser must first ensure that it has the consent of the parent, guardian or such other person who has parental responsibility over the child. In addition to the general obligations under the PDPA, advertisers are also required, under Section 43 of the PDPA, to provide data subjects with the right to prevent the processing of their personal data for the
purposes of direct marketing. Therefore, any adver - tiser who uses personalised or targeted advertise - ments must ensure that they provide data subjects with options to prevent such processing. Examples of options that may be provided to data subjects include: • providing them with an email address which may be used to contact the advertiser on personal data- related matters; or • attaching a form on the website or app. Finally, the commissioner of the JPDP intends to issue the ADMP Guideline, which seeks to regulate the processing of personal data through automated decision-making as well as profiling (which involves the processing of personal data to assess personal aspects of an individual, such as their personal prefer - ences, interests and behaviour). Based on the Public Consultation Paper on the Guideline on Automated Decision Making and Profiling, the commissioner of the JPDP intends to provide data subjects with sev - eral rights, such as: • the right to object or not be subjected to a decision based solely on automated decision-making; • the right to information/transparency; and • the right to request human review of any automat - ed decision-making. Therefore, any advertiser who relies on a fully auto - mated system to profile and assess a data subject’s preferences, interests or behaviour will be required to ensure that they comply with the requirements pro - vided under the ADMP Guideline. Delivery of Personalised or Targeted Advertisements While there is currently no general prohibition against the means of delivering personalised or targeted advertisements, the Malaysian Communications and Multimedia Commission (MCMC) issued a Public Consultation Paper on Unsolicited Commercial Elec - tronic Messages (“Unsolicited Messages PCP”) in 2025 which, in line with Section 233A of the Commu - nications and Multimedia Act 1998, intends to intro - duce a framework to address the issues of unsolicited commercial electronic messages.
298 CHAMBERS.COM
Powered by FlippingBook