Malaysia: Public Consultation Paper on the Review of the Personal Data Protection Act 2010

1. to impose direct obligations on data processors, including the obligation to register with the Commissioner;
2. to introduce the right to data portability, i.e. to grant rights to data subjects to obtain his data in a structured, machine-readable format which can be transferred from one data user to another;
3. to require data users to appoint a data protection officer (DPO) and to issue a guideline on the mechanism of having a DPO;
4. to impose mandatory data breach notification obligations on data users, and to issue guidelines on the mechanism of data breach incident reporting;
5. to provide clarity on the subject matter of consent and to restructure section 6 of the PDPA (which provides for the General Principle);
6. to amend section 129 of the PDPA (transfer of personal data outside of Malaysia) to remove the whitelist of places as to date, the Minister of Communications and Multimedia has not published any whitelist;
7. to require data users to implement privacy by design, i.e. data user should include privacy into its system life cycle, and to issue a guideline on the mechanism;
8. to require data users to establish a Do Not Call Registry, which allows data subjects to opt-out from receiving unsolicited direct marketing materials;
9. to introduce the right of data subjects to know the third party which his personal data has been or will be disclosed to;
10. to introduce the right to bring civil actions against data users;
11. to issue clear policy on endpoint security, for example using technology like encryption to reduce the risk of data breaches, in view of the techniques such as facial recognition and smart trackers which are widely used by data users as data collection endpoints;
12. to extend the PDPA to the Federal and State Governments;
13. to issue a guideline on the mechanism and implementation of cross border data transfers with regard to the exchange of personal data for data user with an entity located outside of Malaysia;
14. to exempt business contact information (contact details that are obtained in a business-to-business relationship) from the PDPA, and to issue a guideline to clarify the status on business contact information;
15. to issue a guideline to clarify the level of disclosure of personal data by data user to government regulatory agencies that is permitted under the PDPA;
16. to classify data users based on business activities (this is different from the classes of data users that requires registration with the Commissioner);
17. to introduce voluntary registration by data users that are not required to register pursuant to the PDPA;
18. to extend the PDPA to non-commercial transactions;
19. to extend the PDPA to data users outside of Malaysia that monitor and profile Malaysian data subjects;
20. to require data users to provide clear mechanism for data subjects to unsubscribe from online services, and to issue a guideline on the mechanism of digital and electronic marketing;
21. to allow data users to make first direct marketing calls to the data subject and to issue a guideline on direct marketing; and
22. to issue a guideline on the processing of personal data in cloud computing.

The PCP may be accessed here. Data users and data processors may provide their feedback in Microsoft Word format citing the relevant paragraphs and page numbers as appropriate, complete Part II of the PCP, and send the completed PCP to pcpdp@pdp.gov.my by 28 February 2020.