Getting down and personal: the personal data protection act
The Personal Data Protection Act (PDPA) that was passed by the Malaysian parliament in June 2010 is expected to come into force within the year. Previously, information of a personal nature was protected as confidential information through contractual obligations or the common law, save for certain sectors. With the coming enforcement of the PDPA, there will now be a regulatory framework as to how personal data is allowed to be used.
The key objective of the PDPA is to control the processing of personal data by data users in the context of commercial transactions, with the intention of safeguarding the data subject’s interests.
"THE ADOPTION OF A WORLDWIDE NOVELTY STANDARD BRINGS MALAYSIA IN LINE WITH THE PRACTICES OF MOST OTHER JURISDICTIONS, INCLUDING OUR NEIGHBOURS INDONESIA, THE PHILIPPINES, THAILAND AND SINGAPORE."
‘Processing’ has been defined in the PDPA as collecting, recording, holding or storing personal data or carrying out any operation or set of operations on the personal data which can include, among others, the disclosure and alteration of personal data. Personal data processed by an individual for the purpose of personal, family or household affairs, including for recreational purposes, are excluded from the provisions of this act. Interestingly, the federal and state governments are also exempted from the PDPA provisions.
The PDPA has introduced the seven principles of data protection. In addition, the scope of the PDPA will encompass the registration of data users, the creation of a consumer data forum, the establishment of a PDP Commission and the appointment of a PDP Commissioner. A Provident Fund will also be created together with the PDP advisory committee, and appeal tribunal. Procedures on inspection, complaints, investigation and enforcement are also in the pipeline.
The seven PDPA principles
- The general principle—personal data cannot be processed without consent.
- The principle of notice and choice—the data user must give information about the purpose of data used and the data subject has the right to request access.
- The principle of disclosure—the data user must disclose the purpose for which the data is collected and use it for that purpose only.
- The principle of security—there must be adequate protection and precautionary measures to ensure the collected data is safe from any loss, misuse, modification, unauthorised access or disclosure, alteration or destruction.
- The principle of storing—any personal data must not be kept in a processing system longer than needed.
- The principle of data integrity—all personal data must be accurate, complete, non-confusing and up to date, in line with the purpose of its storing and processing.
- The principle of access—a user must be given access to his/her own personal data if kept by another user and allowed to update said data.
To date, the Ministry of Information, Communications and Culture (MICC) in Malaysia has set up a data protection department to oversee the implementation of the PDPA. Detailed guidelines and codes of practice are expected to be issued by MICC. This would be considered vital in clarifying more precisely the extent of application and practical recommendations for compliance. A breach of any of the data protection principles is tantamount to a criminal offence and can attract significant penalties.
The PDPA will have a strong impact on a broad spectrum of business and companies as well as regulating cross-border commercial transactions. Its efficacy will only be realised in time and it is hoped that the law will achieve its objectives once enforced.
The Industrial Designs (Amendment) Act 2013
The Industrial Designs Bill was passed by the Malaysian parliament on 20 December 2012 and subsequently gazetted on January 22, 2013 as the Industrial Designs (Amendment) Act 2013, which will come into force on July 1, 2013.
In conjunction with the amended act, the Malaysian IP Office (MyIPO) is also expected to introduce amendments to the Industrial Design Regulations which are required for consistency with the amended act. The primary changes are as follows:
