Know your rights on personal data

THE next time someone calls you and tries to sell you a product, offer free medical test or a cheaper loan facility, just ask one pertinent question: Where did he or she get your personal details?

Prod if you need that information. The source is key and if it is without your consent then that is intrusion of personal privacy. It is a punishable act and you have the right to take the matter up with the commissioner, who is obliged to investigate the matter.

The setback for now is that the Personal Data Protection Act 2010 (PDPA) would only be enforced next year and no commissioner has been appointed.

However, when it comes into force, we have an avenue to take the caller and the person who sold or gave out our personal data, to task.

The Ministry of Information, Communication and Culture plans to set up a new department for personal data protection and that should be effective next year.

In a fully connected world, where huge amount of information is collected, manipulated, used and shared without the knowledge of the owners, many countries including Malaysia have decided to regulate such processing.

Up to now data protection in the country has been piecemeal and generally self-regulated, says lawyer Pagee Khera.

She says personal data can be anything that can identity you and no information about you can be given up without your consent. Of course the Federal and state governments are excluded.

Personal data protection law is not new, it has been implemented by the United States 15 years ago and it is a sub-set of the general privacy law. But here it is new but more importantly, it will alter the way personal data is collected, processed, stored and transmitted between individuals and commercial organisations.

And one big area which will be covered in the Act is the sale of personal data.

Those involved can be fined or even jailed if they continue to sell personal data but the onus is on us to report the matter.

Sale of personal data is common and for a few ringgit a person can get details of your ID, address, phone number and other personal details. How this information is used is left open even though leaking of such information is a very serious offence.

Not all organisations that have people's data have enough security nets to protect the information because in this day and age, data is stored in servers unlike the old days when it was on paper, so today data can be transmitted in a matter of seconds and that is why there is a need for greater protection of data.

The new Act will give individuals certain rights over information contained in the many databases and how their data can be used by a third party.

The law clearly defines the rights to access and correct their personal data. Consent is the key word and there cannot be disclosure without consent, so companies have to be very careful with their customers' personal data.

Those that fail to abide by the law and fail to invest to protect data could find several sets of regulators beating a path to their door and customers are not going to sit by and allow piracy intrusion.

Any company that allows personal data to be exposed to the world would struggle to regain users' trust and Pagee believes the onus is really on the consumers to know their rights, so awareness is needed.

The interesting thing about the new Act is that the buck stops with the CEO of the company, though any person who processes or has control over or authorises the processing of personal data from the way it is collected, processed, stored and transmitted is also liable.

So the challenge is not just about protecting data but the customers has the right over his data and companies have to respect that. Those who sell personal data should be punished.

The Act should put Malaysia on a different plane where personal data protection is concerned but the question is will all the companies abide by the law and will the enforcement be strict enough to protect the consumer? We may have to wait.