Transmenu powered by JoomlArt.com - Mambo Joomla Professional Templates Club

Contributed by the Human Rights Committee

Advances in technology have made it easier to collect, store and distribute data and information. This has however led to increasing risk of invasions of privacy. Data collectors today wield great control over personal data and information in their possession. They are in a position to alter, amend, sell, forward, share and publish collected personal data without the knowledge and consent of the data subjects. There is little assurance that operating procedures or policies are in place to ensure that the collected personal data in the possession of data collectors is secure and safe from theft, misappropriation or misuse.

Terms such as “identity theft” and “phishing” are no longer unfamiliar. Reports of the unauthorised use of data subjects’ financial information to obtain funds from banks and financial companies, at the expense of data subjects, or to commit fraud on third parties, are rife. Acts such as these are conducted in wanton disregard of the privacy of individuals and may cause large financial losses to the data subjects.

In Malaysia, the collection, storage and distribution of personal data is largely unregulated by legislation. There are no legal restrictions with regard to the use of personal data of individuals, while the legal rights and obligations of governmental entities, companies, businesses and individuals vis-à-vis data subjects are vague unless the same are addressed contractually between the relevant parties. The Federal Constitution does not expressly provide for the right to privacy, while Malaysian common law has not recognised this right (see Dr Bernadine Malini Martin v MPH Magazines Sdn Bhd & Ors [2006] 2 CLJ 1117 and Ultra Dimension Sdn Bhd v Kook Wei Kuan [2004] 5 CLJ 285).

However, the right to privacy is entrenched in and protected by international human rights law (see Article 12 of the Universal Declaration of Human Rights, Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and Article 17 of the International Covenant on Civil and Political Rights). Arbitrary and unlawful interference with an individual’s privacy, family, home or correspondence, or attacks upon the individual’s honour and reputation is prohibited. The Malaysian government is under an obligation to enact and implement laws against such interference or attacks, thereby protecting the privacy of individuals, especially with regard to their personal data.

Recent judicial pronouncements expounding on and broadening the scope of the right to privacy in the European Court of Human Rights, and the English and Australian courts have been encouraging (see Copeland v United Kingdom 62617/00 [2007] ECHF 253 (3 April 2007), Douglas and others v Hello! Ltd [2001] QB 967 and Grosse v Purvis [2003] QDC 151). Yet, these developments have not had an impact in Malaysia, and in any event, are inadequate to meet the pressing needs of our society. A comprehensive legislative framework to protect the privacy of individuals is necessary.

Numerous countries around the world, such as those within the European Union (EU), Canada, Hong Kong, Australia and New Zealand, have enacted data protection regimes. Insofar as the EU is concerned, entities from the EU are only allowed to export personal data of European residents to countries which are found to have data protection regimes that are “adequate” in accordance with Directive 95/46/EC of the European Parliament and of the Council of the European Union (24 October 1995). If these measures are inadequate, data importers must by contract agree with the relevant European entity that they will comply with the data protection standards required by the EU and the applicable national law.

The EU protection regime was implemented nearly ten years ago. There were sound reasons for so doing. Malaysia as part of this globalised world must catch up. A comprehensive data protection regime is required to ensure that there is no misuse and abuse of personal information held by data collectors and users of such data. Information held for one or more specified purposes should not be easily distributed to or used by third parties unless with the consent of the data subjects.

The Committee understands that the Government is in the midst of finalising a draft Data Protection Bill. We are surprised that the relevant stakeholders (such as the Bar, SUHAKAM and civil society organizations) have not been invited for consultation on the Bill. Given this, the Bar has, vide a letter dated 30 June 2008, written to the Ministry of Energy, Water and Communications to request a meeting to discuss the matter, and to be forwarded a copy of the Bill for the Bar’s comments.

The Committee is of the view that the Government should immediately move an amendment to Part II of the Federal Constitution to include the right to privacy as a fundamental liberty. Second, the Data Protection Bill should adopt a just, effective and transparent mechanism consistent with international human rights norms pertaining to the collection, maintenance, storage, administration, distribution and use of personal data. Third, as such a mechanism cannot operate without effective freedom of information legislation, we urge the Government to enact such legislation in tandem with the proposed Data Protection Act.

As always, we are prepared to offer assistance to the Government on this important matter.

Dated this 16th day of July 2008
Human Rights Committee
Bar Council

Comments (0)

Subscribe to this comment's feed