MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
4.3 Employment Privacy Law Notification of Employees
The Unsolicited Messages PCP provides the following definitions: • “unsolicited commercial electronic messages” – any commercial electronic message sent through any communication mode where there is no prior relationship between the sender and the recipient or no prior consent from the recipient; • “commercial electronic message” – any electronic message sent by electronic means for the purpose of promoting, offering, marketing or supplying: (a) products or services; (b) land or any interest in land; (c) business or investment opportunities; or (d) a person or entity that provides such products, services or opportunities; and • “electronic messages” – any message sent using a network service or applications service to an elec - tronic address, endpoint, or similar communication mode. Based on the Unsolicited Messages PCP, the MCMC is seeking to prohibit the following activities: • the acquisition, distribution or usage of certain tools or software designed to extract electronic addresses from online sources or mechanisms that generate addresses through automated or pattern- based guessing (commonly known as “dictionary attacks”); and • the sending of unsolicited messages to electronic addresses obtained from address harvesting (the automated collection of electronic addresses with - out consent) or dictionary attacks. Therefore, in the event that the framework proposed under the Unsolicited Messages PCP is introduced by the MCMC, advertisers will be prohibited from send - ing any personalised or targeted advertisements via electronic message (such as an email) obtained from address harvesting or dictionary attacks. Neverthe - less, the framework proposed under the Unsolicited Messages PCP is subject to change pending confir - mation from the MCMC.
Generally speaking, any processing of the personal data of job applicants and employees, whether it is for the purposes of adding them to the payroll, pro - viding them with employment-related benefits or for employee disciplinary proceedings, is regulated under the PDPA. As such, employers must first provide the job applicants and employees with their privacy notice to inform them and obtain their consent for the pro - cessing of their personal data. In cases where the employer wishes to process their personal data for new purposes not listed under the personal data protection notice, the employer will be required to obtain employees’ consent for the new purpose or amend the personal data protection notice and inform employees of the amendment. The above-mentioned obligations also apply to the processing of personal data related to the monitoring of employees, use of the employer’s IT systems, bring- your-own-device policies and background checks. As there are no specific guidelines regulating the pro - cessing of personal data for the above-mentioned purposes, the standard obligations and requirements under the PDPA apply. Regulations Relating to Third-Party Service Providers Data processors Additionally, employers often outsource many of their HR-related functions, such as the use of third-party service providers to administer payroll or to conduct background checks. As these third-party service pro - viders process personal data on behalf of the employ - er for the employer’s purposes, the third-party service providers are considered to be data processors. Under Section 9 (2) of the PDPA, data processors are required to provide the data controller (in this case, the employer) with sufficient guarantees in respect of the technical and organisational security measures governing the processing that is to be carried out on behalf of the employer, and take reasonable steps to comply with these measures. Item 14 of Paragraph 4.1 of the Personal Data Protection Standard further imposes a requirement on the employer to bind the
299 CHAMBERS.COM
Powered by FlippingBook