Rafizi’s claim that govt data must not be subjected to the PDPA is baseless, reckless and goes against the global trend
5 January 2024
We refer to the statements made 4 Jan 2024 by Economics Minister Rafizi Ramli in relation to the PADU scheme, that there is no need to subject data collected by government to the PDPA and that there is a “difference between PDPA 2010 and public data” and that “each govt agency have their own regulations on data”. He said this in response to LFL’s call for the controversial PADU scheme to be suspended pending amendments to PDPA.
This response by Rafizi is ignorant and irresponsible and is completely oblivious of the role and necessity of PDPA legislation in governing personal data.
Firstly, protection of personal data cannot be left to ad-hoc and superficial regulations of individual government agencies or departments as suggested by Rafizi. This is a reckless suggestion. Such regulations, even where they exist, do not provide the effective and comprehensive protection afforded by the PDPA Act itself. The PDPA protects data according to carefully laid out principles including the disclosure principle, the security principle, the retention principle and the data integrity principle.
Rafizi must understand that govt agencies’ regulations have no such safeguards, thus exposing the public’s personal data to potential abuse and misuse. In fact, the Economics Minister failed to even give one example of any such regulation. Is he speaking of the OSA, which is totally unsuited for this purpose?
Throughout the world, government data has been subjected to PDPA type regulations; and yet the Minister claims the Malaysian public’s personal data does not require such protection. His claim that it is impossible or impractical for government data to be subjected to PDPA is nonsensical as globally countries have subjected govt data to PDPA legislation.
The fact is, Malaysia and Singapore are the only countries that have exempted govt data from a PDPA legislative regime. This is not just an embarrassment to our country, but also affects trade and business with entities from countries which have stricter personal data protection regimes. Surely the economics minister should be concerned with this. The minister’s refusal to subject government data to PDPA governance is incomprehensible and goes against the global trend.
Further, Rafizi’s claim that there’s a difference between PDPA and govt data reflects a serious lack of understanding and logic. The nature and value of personal data is the same, irrespective of whether it is used by private businesses or by the government, and must be equally protected whether in the hands of government or private sector.
Finally, data protection has become a global concern which cannot simply be brushed aside. There have been a slew of serious criticisms against PADU, apart from the lack of PDPA protection. In the public interest, we strongly reiterate and urge the government to suspend immediately PADU pending amendment of the PDPA 2010.
Lawyers for Liberty