MALAYSIA Trends and Developments Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
are also expected to implement heightened security measures to protect sensitive personal data, as Sec - tion 9 of the PDPA provides that the security measures implemented must be commensurate with the nature of the personal data and the risk of harm involved. While the Commissioner has not released any guid - ance or clarification as to what is considered to be biometric data, it is generally understood that biomet - ric data will include the processing of fingerprint data, facial recognition, iris scans, signature identification, as well as behavioural data such as keystroke dynam - ics. As a result of this amendment, data controllers that process biometric data will be subject to the addi - tional requirements relevant for any processing of sensitive personal data and will be required to amend their internal data protection framework to ensure that these requirements are met. Extension of the requirement to comply with the Security Principle to data processors Prior to the Amendment Act, Section 9 of the PDPA (the “Security Principle”) only applied to data control - lers. As a result of this, the obligations imposed on data processors, along with the legal ramifications for breaching these obligations arose purely from con - tractual arrangements with data controllers. The amendment to Section 9 of the PDPA aims to bridge that gap by imposing a direct obligation on data processors to comply with the Security Principle. As a result of this, data processors are now indepen - dently responsible for implementing the appropriate security measures to protect personal data, including but not limited to implementing the minimum secu - rity standards (the “Security Standard”) as prescribed under the Personal Data Protection Standard 2015 (the “PDP Standard”). Therefore, data processors will now be held directly liable for any breach of the Security Principle and will need to conduct assessments to ensure that their internal data protection frameworks are compliant with the Security Principle and Security Standard. Data controllers may also wish to review their data processing agreements and consider including new
clauses to reflect this new obligation on data proces - sors. Introduction of the requirement to appoint a data protection officer (DPO) The Amendment Act introduced a new mandatory data protection officer (DPO) appointment obligation for data controllers and processors. This obligation is not a blanket requirement across organisations, as only data controllers and processors that meet the threshold provided under the Guideline on the Appointment of Data Protection Officer (the “DPO Guideline”) will be required to appoint a DPO, namely where the processing of personal data by the data controller or data processor involves: • personal data of more than 20,000 data subjects; • sensitive personal data (including financial informa - tion data) of more than 10,000 data subjects; or • activities that require regular and systematic moni - toring of personal data. For the purposes of clarity, the DPO Guideline has provided several examples of what is considered to be “regular and systematic monitoring” of personal data, including: • any activity where data subjects are tracked and profiled for purposes of behavioural advertising; • the use of algorithms to monitor the searches and purchases of customers to offer recommendations based on these algorithms; and • monitoring the wellness, fitness and health data of data subjects through wearable devices. The DPO Guideline also sets out other requirements, such as the method of appointing the DPO, notifica - tion to the Commissioner of the appointment as well as the responsibilities of the DPO. In addition to the DPO Guideline, the Commissioner has also issued further guidelines to address matters relating to the competencies, training and certification of DPOs, including the: • DPO Competency Guideline; • Management of DPO Training Service Providers Guideline; and
304 CHAMBERS.COM
Powered by FlippingBook