MALAYSIA Trends and Developments Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
Amendment to the cross-border data transfer mechanism The transfer of personal data outside Malaysia is gen - erally prohibited, unless any of the conditions provid - ed under Section 129 are met. The Amendment Act has removed two conditions for the transfer of personal data, namely: • The whitelisting/adequacy mechanism – under Sections 129 (1) and (2), data controllers were permitted to transfer personal data to countries on the “whitelist” of countries as determined by the Minister. The Amendment Act has removed this mechanism by deleting Section 129 (1) and amending Section 129 (2). • Where the transfer is necessary as being in the public interest in circumstances as determined by the Minister (Section 129 (3)(h)). The Amendment Act has removed this by deleting Section 129 (3)(h). Nevertheless, data controllers are not materially impacted by this as neither of the conditions was uti - lised, since no countries were placed on the “whitelist” and no circumstances were determined by the minis - ter as being in the public interest. Additionally, the Amendment Act amended Section 129 (2) to introduce two new conditions, namely if: • the receiving country has laws in force that are substantially similar to those in Malaysia; and • the receiving country ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection afforded by the PDPA. While the above two additions appear similar to the EU GDPR’s adequacy mechanism, they differ from the EU GDPR in that, while adequacy decisions in the EU are made by the regulators/authorities (ie, the European Commission), individual data controllers are given the power to make such assessments and deci - sions under the PDPA. Additionally, the Commissioner has also issued the Guideline on Cross Border Data Transfer (the “CBDT Guideline”) which lays out the requirements for com -
pliance with each condition. For example, data con - trollers that wish to make use of the new conditions under Section 129 (2) will be required to carry out a transfer impact assessment. The CBDT Guideline also imposes certain requirements in general application, including the requirement to keep records of any cross-border data transfer. The introduction of the CBDT Guideline therefore means that data controllers will be required to review their internal data protection framework to ensure that they meet the relevant requirements as provided under the CBDT Guideline. Upcoming Changes to the Personal Data Protection Framework As noted above, there are several upcoming amend - ments to existing regulations as well as new guide - lines that are set to be issued. This section provides a brief overview of each amendment/guideline based on the public consultation papers that have been made publicly available. That said, any information provided here may still be subject to change by the Commis - sioner. Amendment to the PDP Regulations The Commissioner intends to amend the PDP Regula - tions to bring them in line with international standards and has previously issued a public consultation paper on the amendments to the PDP Regulations. Based on this public consultation paper, several key definitions will be amended in or introduced to the PDP Regulations, including: • the amendment of several key definitions for greater clarity (ie, “standard” will be amended to emphasise that any standards issued by the Com - missioner constitute binding rules); • clarification on the definition of consent; • a new requirement to display the business contact information of the appointed DPO; and • streamlining and strengthening the inspection pow - ers of the Commissioner. The amendments to the PDP Regulations are likely to be substantial and will require amendments to existing internal data protection frameworks. For example, in
306 CHAMBERS.COM
Powered by FlippingBook