MALAYSIA Trends and Developments Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
Guideline have been met. In addition to the threshold for conducting a DPIA, the DPIA Guideline will set out the methods to conduct a DPIA, the requirements as to notification to the Commissioner, as well as any further obligations upon the conclusion of the DPIA. Therefore, data controllers may wish to factor in the time and resources required to conduct a DPIA when planning any large-scale data processing projects, as the requirement to conduct a DPIA may result in delays in the commencement of the project. Data con - trollers may also wish to identify the personnel in the organisation with the capabilities to conduct a DPIA or (where permitted) identify external sources to assist with conducting any DPIA. Introduction of the Guideline on Data Protection by Design (the “DPbD Guideline”) The Commissioner intends to encourage data control - lers in Malaysia to adopt the concept of Data Protec - tion by Design (“DPbD”) in order to move from reactive to proactive data protection. As such, the Commis - sioner intends to introduce the DPbD Guideline, which aims to provide guidance on how to adopt and imple - ment DPbD when complying with the personal data protection principles under the PDPA. Based on the public consultation paper for the DPbD Guideline, the DPbD Guideline will set out the foun - dational principles of DPbD and guide organisations on the implementation of DPbD when complying with each of the PDP principles, including further guidance in relation to children’s privacy. While the DPbD Guideline and the introduction of DPbD may improve the protection of personal data, data controllers will need to take a proactive stance in adopting DPbD, which may involve a significant revision of their respective internal data protection frameworks. Introduction of the Guideline on Automated Decision Making and Profiling (the “ADMP Guideline”) Owing to the rapid increase in the use of AI and machine-learning techniques to carry out automated
decision-making and profiling, the Commissioner intends to introduce the ADMP Guideline to provide guidance on the implementation requirements for the use of automated decision-making and profiling. Based on the PCP for the ADMP Guideline, the Com - missioner has proposed that the ADMP Guideline will only cover decisions which: • are made by technological means without human involvement; and • may legally or significantly affect an individual. The above decisions will include the use of AI and Generative AI. As such, any data controller which carries out any automated decision-making that achieves the above- mentioned threshold will be required to comply with the ADMP Guideline. This will include additional data subject rights and exceptions to those rights, and additional measures for the use of AI and Generative AI, and the processing of biometric data as well as the use of CCTVs. Conclusion The Amendment Act and issued guidelines represent a significant step forward in modernising Malaysia’s personal data protection framework and bringing it in line with international standards. Nevertheless, as the amended PDPA still retains distinct local nuances in both its scope and implementation, organisations that comply with alternative personal data protection frameworks (eg, the EU GDPR) are reminded not to assume automatic compliance, and to conduct a care - ful review of their respective personal data protection frameworks to determine compliance with the PDPA. With the expected amendments to the PDP Regula - tions and PDP Standard, and the issuance of further guidelines on the horizon, Malaysia’s personal data protection framework is expected to evolve further. Organisations need to remain proactive in monitor - ing these PDPA-related developments and regularly update their internal data protection frameworks in order to ensure continued compliance with the PDPA.
308 CHAMBERS.COM
Powered by FlippingBook