NST Leader: Of private data and public use

New Straits Times

13 hours ago

WHENEVER the government says it is collecting personal data, Malaysians get the jitters. Can't blame them. One thought that crosses the mind of some people is: is Big Brother keeping watch on us?
The other and more common concern is about leakages, of which there have been far too many without any serious consequences to those who were responsible.
Understandably, the recent announcement by Communications Minister Datuk Fahmi Fadzil that Putrajaya is collecting phone call data from telecommunication companies for policymaking brought back the old anxiety, especially when they learnt that discussions between the government and the telcos have been going on since 2023.
Phone call data is itself a fear-generating phrase. Does it mean data on all calls one makes are collected? Early communication would have helped allay the people's fears, but transparency isn't Malaysia's strong point. Putrajaya has to work hard on it.
The government must understand people's fears. Every day, people are bombarded with numerous anonymous calls and text messages. Neither the telcos nor our regulators seem to be able to put a stop to such an invasion into our private world.
Some even know the names of the phone owners. How did they get access to the names and phone numbers? Can't blame the people for suspecting it to be an inside job. People do recognise the government's need to work with personal data to deliver their services efficiently and effectively in this highly digitalised world.
But their concern is how the personal information is collected, stored and shared. Not just telcos collect personal data, but all manner of companies do that. The important thing is robust oversight by regulators. Making the non-compliant accountable is critical.
Since 2017, only about 20 companies have been compounded or fined for personal data breaches under the Personal Data Protection Act 2010 (PDPA), some even for processing personal information without consent or permits.
Thankfully, the amended PDPA that came into effect in January comes with a bigger bite. Data controllers and data processors face a fine of up to RM1 million or imprisonment of up to three years or both for non-compliance.
As under the unamended act, gathering evidence remains a huge challenge as the lawbreakers delete the data once non-compliance is detected. Some have described the hunt for evidence as a cat-and-mouse game, only more vicious.
So where does this leave the people whose personal data has been made public by unlawful means? The tort of invasion of privacy, which is a well-developed civil remedy in several common law countries, isn't recognised in Malaysian jurisprudence.
A court or two appeared to have thought it was a recognised tort, but higher courts have overruled such judicial activism. Perhaps the answer lies in the statutory introduction of the tort.
Some will argue that there is no need for one because the PDPA is there, but they forget that it doesn't address civil remedies.
Until such time when invasion of privacy does become a recognised tort in Malaysia, either through the courts or statutory introduction, people must seek recourse through other torts such as breach of confidence or negligence.