MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
data processor with a contract. This is typically known as a data processing agreement, which includes the data processor’s responsibilities as well as their obli - gations in relation to the protection of personal data and notification of data breaches. Credit reporting agencies In cases where employers wish to conduct back - ground checks on a job applicant or employee through a credit reporting agency, the employers are gener - ally required to first request that the job applicant or employee sign a consent form or letter authorising the disclosure of their information to the employer. 4.4 Data Protection in M&A Apart from under the PDPA, there are no specific privacy requirements that specifically apply to M&A and asset deals. As such, when conducting any M&A transaction or asset deal, all parties to the transaction or deal are required to ensure that they have obtained the relevant consent, in line with the requirements under the PDPA. Nevertheless, certain general privacy requirements that apply to entities that act within certain industries may apply in M&A transactions and asset deals. For example, Section 133 of the FSA imposes a general prohibition on disclosure by any financial institution and its employees concerning documents or informa - tion relating to the affairs or accounts of customers of such financial institutions, unless the disclosure meets the relevant conditions set out under Section 134 of the FSA. Similarly, Section 153 of the Capital Markets and Services Act 2007 (CMSA) prohibits any member, employee or agent of the corporation from disclosing any information or document obtained in the course of their duties, except in the circumstances provided for under Section 154 of the CMSA. In both cases, employees of the financial institution or corporation will be required to maintain secrecy and ensure that any disclosures made for the purposes of any M&A transaction or asset deal that they are involved in are made in line with the relevant legis - lation. Therefore, any party to M&A transactions or asset deals is reminded to ensure that they comply
with the PDPA as well as any other personal data or privacy-related obligation that may arise from relevant legislation, regulations or guidelines.
5. International Considerations 5.1 Restrictions on International Data Transfers
The primary act regulating the cross-border transfer of personal data is the PDPA. Section 129 of the PDPA provides that personal data may not be transferred outside Malaysia, except if one of the conditions under Sections 129 (2) or (3) is met. Examples of these conditions include: • the data subject has provided their consent to the transfer; • the transfer is necessary for the performance of a contract between the data subject and data con - troller; and • the data controller has taken all reasonable pre - cautions and exercised all due diligence to ensure that the personal data will not be processed in the receiving place in any manner which would be in contravention of the PDPA. Additionally, the Commissioner recently issued the Guideline on Cross Border Data Transfer (the “CBDT Guideline”) which acts as a guide for compliance with the conditions under Section 129 (2) and (3) of the PDPA. For example, the CBDT Guideline provides that any person who wishes to rely on the consent of the data subject must first provide the data subject with a personal data protection notice containing the fol - lowing details: • the class of third parties to whom the data will be transferred; and • the purpose of the transfer. Therefore, any transfer of personal data outside Malaysia must be compliant with Section 129 of the PDPA, read in line with the CBDT Guideline. ASEAN Framework on Personal Data Protection As a member of the Association of South East Asian Nations, Malaysia is a signatory to the ASEAN Frame -
300 CHAMBERS.COM
Powered by FlippingBook