Half day public-seminar_on_pdpa_2010_-_250711

HALF-DAY PUBLIC SEMINAR ON
MALAYSIAN PERSONAL DATA
PROTECTION ACT (PDPA) 2010

25 July 2011, Monday, 9.30 am – 12 pm
Legal Training Room, Menara SSM @ Sentral

By Noriswadi Ismail
Quotient Consulting

7/23/2011 (c) 2011 Quotient Consulting, Information Is Invaluable

Vignette 1

Harimau Malaya, Malaysian, holds a Malaysian
ID, passport, driving license, 3 Malaysian bank
accounts, 2 mobile accounts and 5 loyalty
membership cards. His details are also
registered in 2 private clinics, 1 government
hospital and 2 insurance companies. He has 1
bank account in London and Hong Kong
respectively. He travels frequently for business
and golfing. He is a director of 3 companies in
Malaysia, London and Hong Kong. Also, an avid
golfer of 3 golf clubs (Malaysia, Indonesia and
Scotland).

Executive Summary
Q: What is PDPA 2010?
Q: Why we need to comply with PDPA 2010?
Q: What are the 7 data protection principles?
Q: Will PDPA 2010 kill my business operations?
Q: To what extend PDPA 2010 affects your business operations?
Q: We are a start-up and a semi medium sized company, how
should we strategise?
Q: When should we start?
Q: Is there any additional compliance cost for this purpose?
Q: How about formality and enforcement?
Q: What’s next and the must-to-do list?
Q: How to ensure such data protection & privacy management
sustainable?


What is PDPA 2010?
::: An Informational privacy legislation

::: 10 Parts (Preliminary, Personal Data Protection Principles,
Registration, Data user forum and Code of practice, Rights of
data subject, Exemption, Personal data Protection Fund,
Personal Data Protection Advisory Committee, Appeal Tribunal,
Inspection, Complaint and Investigation, Enforcement,
Miscellaneous, Savings and Transitional Provisions)

::: 146 Sections

::: Jurisdiction: Malaysia


What is PDPA 2010?
::: Received Royal Assent on 2 June 2010, and gazetted a week
later

::: Compliance commences: 3 months from the date of
enforcement

::: Application: To commercial transactions only, not applicable
to Federal and State Governments

::: Cross reference to: Electronic Commerce Act 2006’s definition
on commercial transactions “…any transaction of a commercial
nature, whether contractual or not, which includes any matters
relating to the supply or exchange of goods or services, agency,
investments, financing, banking, insurance, but does not include
a credit reporting business carried out by a credit reporting
agency…”

7/23/2011 (c) 2011 Quotient Consulting, Information is Invaluable.

What is PDPA 2010?
• An authorised • Oversees and
person who enforces the Laws
processes data on • Fund: Personal
behalf of the data Data Protection
user Fund

Data
Regulator*
Processor

Data
Data User
Subject

• Individual who is • A person / legal
the subject of the person who
personal data controls /
authorises the
processing of data


What is PDPA 2010?
*Regulator

Minister

Data Protection
Commissioner
Personal Data Data User Forum
Protection Advisory
Committee

Appeal Tribunal


What is PDPA 2010?

Question:
Question:
What about
What about
Government to
Government Linked
Government’s
Companies (GLCs)?
engagements?


What is PDPA 2010?

Question:
Question: What about
transactions between
What about transborder government and non-
data flow? governments?


Why We need to comply
with PDPA 2010?

Recognition of privacy
(informational) as one of the
fundamental human rights

Protection of invaluable data
that are sensitive, being
commoditised and having the
vast potentials to being
commoditised


What are the 7 data protection
principles?

P1: General Principles – Consent, Sections 6(1) – (3)
Lawful Purpose, Necessary, Adequate
and Not Excessive
P2 : Notice and Choice Principle Section 7 (1)
P3: Disclosure Principle Section 8, cross reference
to Section 39
P4: Security Principle Section 9(1) & (2)
P5: Retention Principle Section 10
P6: Data Integrity Principle Section 11
P7: Access Principle Section 12


Will PDPA 2010 kill my business operations?
::: Yes, if, your business operations are inconsistent and non
compliance with the PDPA 2010’s 7 data protection principles;

::: Yes, if, your business operations do not have the necessary
framework, control, management and monitoring of the 7 data
protection principles’ requirements;

::: No, as PDPA 2010 enhances trust, value and reputation of
your business; and

::: No, as PDPA 2010 seeks to safeguard all of your data


To what extend PDPA 2010 affects
your business operations?

Corporate Office
Marketing &
(HR, Legal,
Business
Finance, Audit &
Development
Administration)

Business Local &
Partners & International
Contractors engagements


To what extend PDPA 2010 affects
your business operations?

Documentation
Categorisation (Forms,
of data Agreements &
Policies)

ICT deployment Human capital
(skills &
(Data security) trainings)


We are a start-up and a semi medium sized
company, how should we strategise?
Controls &
Systems
Planning &
Execution
Partial Back-to-Back
Outsourcing Arrangement
Route & Execution

Adequacy


We are a start-up and a semi medium sized
company, how should we strategise?

Cost

Resources & Culture &
Skills Awareness

Limitations


When should we start?
Assumption 1 If the date of enforcement is
within Quarter 2 of 2012, it’s
recommended to start the
planning & execution by Quarter
4 of 2011 – Quarter 1 of 2012
Assumption 2 If the date of enforcement is
within Quarter 1 of 2012, it’s
recommended to start the
planning & execution NOW
Key Assumption The proposed Malaysian Data
Protection Commissioner will be
established in Quarter 1 of 2012


Vignette 2
Keranamu is a Government Consultant who
advises on strategic acquisition of certain
stakes in Company 76, a public listed
company, incorporated in Hong Kong. The
proposed acquisition is channeled through a
leading Government Investment arm.
Company 76 appoints an European-based
consultant to act on their behalf in the
negotiations.


Is there any additional compliance cost
for this purpose?

::: Yes, subject to the budget, resource
planning & business plans

::: No, if it has been anticipated


How about formality and enforcement?

Registration of Data
Power of
User – Certificate Report, complaint
investigation,
(Renewal, and investigation by
search & seizure
Revocation & Commissioner
with warrant
Surrender)

Notification &
Enforcement Notice Power of arrest
Access Request

Inspection of Variation or
Personal Data cancellation of Prosecution
System Enforcement Notice


How about formality and enforcement?

Offences by body Jurisdiction:
Register
corporate Sessions Court

Transfer of personal
Compounding of Protection of
data to places
offences Informers
outside Malaysia

Abetment and Protection against
Unlawful collecting
attempt punishable suit and legal
of personal data
as offences proceedings


Vignette 3

Truly Asia Travels & Tours has been appointed
by some governmental agencies and private
companies as their exclusive travel agent. The
terms of reference include managing such
flight, hotel, travel itinerary and related
bookings. The amount of data processing of
data subjects, transfers and sharing are done
globally.


What’s next and the to-do-list?

::: Strategic planning

::: Resource planning

::: Dissemination planning


::: Strategic planning

Board Leadership DPP as part and parcel of
organisation/company’s Key
Performance Indicators (KPIs)
Senior Management Driving DPP across the whole
spectrum of organisation/company
Managers & Overseeing & monitoring the
Working Team required affected portfolios that
intersect with PDPA 2010


::: Resource Planning

Portfolio & Reporting Subject to the setting of the
creation/structure Corporate Office’s structure
Skills & knowledge enhancement Training, Consultation &
Certification


::: Dissemination Planning

Data Protection & Privacy Across the organisation / company
Campaign
World’s Data Protection Day 28th January (of the year)
Event


How to ensure such data protection & privacy
management sustainable?

Trust
Monitored
compliance,
Culture controls and
execution


Vignette 4

Hospitals A1, A2 & A3 are government
hospitals. These hospitals deal with patients
who mostly consist the public and engage with
local and international consultants.


Vignette 5

Universities B1, B2 & B3 are public
universities. These universities engage with
local and international students, consultants,
international academics and universities
globally.


THANK YOU

QC TM

London. Kuala Lumpur. Jakarta

Data Diagnosis | Privacy Impact Assessment | Data Protection & Privacy Strategy
Training | Data Protection & Privacy Certification | Public & Private Consultations

<noriswadi@googlemail.com>


Half day public-seminar_on_pdpa_2010_-_250711

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Half day public-seminar_on_pdpa_2010_-_250711

Similar to Half day public-seminar_on_pdpa_2010_-_250711 (20)

Recently uploaded

Recently uploaded (20)

Half day public-seminar_on_pdpa_2010_-_250711