Technology & Data Privacy

Follow Our Latest COVID-19 Updates

MALAYSIA: Personal Data Protection Commissioner Issues Advisory on the Collection, Processing and Storage of Personal Data During the Conditional Movement Control Order

Following the shift from the previous Movement Control Order to the Conditional Movement Control Order (“CMCO”) in Malaysia (which is currently scheduled to end on 9 June 2020), most industries and businesses have been allowed to resume operations, subject to compliance with standard operating procedures issued by the Malaysian Government. On 29 May 2020, the Personal Data Protection Commissioner issued an Advisory on the Procedure for the Handling of Activities relating to the Collection, Processing and Storage of Personal Data by Business Premises during the Conditional Movement Control Order (“Advisory”), which outlines the minimum requirements to be complied with by business premises operating during the CMCO period in order to comply with the seven Personal Data Protection Principles (“PDP Principles”) of the Personal Data Protection Act 2010.

In this Update, we analyse some of the minimum requirements against each of the PDP Principles as identified in the Advisory to be observed by businesses when collecting personal data for contact tracing purposes during the CMCO period.

MALAYSIA: Processing Personal Data in the Context of COVID-19 and the Movement Control Order

In light of the COVID-19 outbreak in Malaysia, organisations will likely face questions in respect of their right to share and disclose personal data of employees, customers and visitors to their premises (in particular, after the end of the Movement Control Order when business resumes as usual) for the purpose of contact tracing or to take other response measures.

In this client update, we explore the possible legal grounds for the collection, disclosure and retention of personal data under the Personal Data Protection Act 2010 in the context of the COVID-19 outbreak.