MALAYSIA Trends and Developments Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
Introduction of the Data Portability Guidelines As noted above, the Commissioner intends to intro - duce the Data Portability Guidelines to act as a guide - line on the operation of the new right to data portability, and aims to provide data controllers with information such as the timeline to comply with requests, and the fees and methods for transmission of personal data pursuant to a data portability request. Additionally, based on the Public Consultation Paper on the Data Portability Guideline, the Commissioner does not intend to require all data controllers to adopt or maintain new systems or processes for the purpose of complying with a data portability request. As such, data controllers will only be required to comply with the request if it is technically feasible to transfer a data subject’s personal data between the respective systems of the data controller and the receiving data controller. Finally, the types of personal data subject to the right to data portability will likely be limited. Based on the current proposal, only personal data that is directly provided by the data subject and was provided based on consent or a contract to which the data subject is a party will be subject to this new right. Data controllers will not be required to transmit personal data classi - fied as “inferred data” or “derived data”. That said, data controllers will need to wait for the issuance of the Data Portability Guidelines to deter - mine the extent of the changes to existing policies and systems required for compliance with the new right to data portability. Introduction of the Guideline on Data Protection Impact Assessment (the “DPIA Guideline”) The Commissioner intends to issue the DPIA Guide - line which will in certain cases require data controllers to conduct mandatory data protection impact assess - ments (DPIAs) to determine whether the processing of personal data is likely to result in a high risk to the privacy of the personal data of data subjects. Based on the public consultation paper for the DPIA Guideline, the Commissioner has proposed that data controllers conduct a DPIA if the quantitative threshold or qualitative thresholds as prescribed under the DPIA
the event that the amended PDP Regulations include stricter procedures and requirements for consent, data controllers may need to amend their internal data protection frameworks to update the way they obtain consent and (where necessary) obtain fresh consent from data subjects whose consent was collected prior to the introduction of the new procedures and require - ments. Amendment to the PDP Standard The PDP Standard was issued in December 2015 to set out the minimum compliance standards and requirements in relation to the security, retention and data integrity principles under the PDPA (collectively, “Standards”). In order to ensure that each Standard is brought up to date and in line with international best practices, the Commissioner intends to issue a revised PDP Stand - ard. Based on the public consultation paper on the amendments to the PDP Standard, each Standard will be amended to introduce expanded measures to ensure that current operational risks are addressed (such as further measures related to the use of cloud computing services). Additionally, in order to deal with the ever-evolving nature of data protection, the Commissioner has also proposed to shift the prescriptive approach of the PDP Standard to an outcome-based approach. By doing so, data controllers may employ various meas - ures to ensure that the outcomes listed in the PDP Standard are met. Due to the substantial number of amendments that have been proposed, data controllers (and data pro - cessors in relation to the Security Standard) will likely need to update their internal data protection frame - work to ensure that it is in line with the revised PDP Standard. Additionally, the outcome-based nature of the proposed revisions will mean that data controllers must regularly review and revise their internal policies and processes to ensure that the measures that have been implemented to meet each outcome are still rel - evant, up to date and sufficient, based on technologi - cal advances and their own personal data processing capabilities.
307 CHAMBERS.COM
Powered by FlippingBook