Bar wants oversight, reforms in mobile data policy

Summary 

• The Malaysian Bar raises concerns over public trust in the government’s data handling, citing past leaks and a lack of accountability.

• Bar president urges disclosure of anonymisation standards, third-party oversight, and constitutional protection of privacy rights.

• Ezri also calls for legal reforms to include government and statutory bodies under data protection law while ensuring meaningful public consultation.

The Malaysian Bar has outlined several suggestions for the government’s consideration amid its use of anonymised mobile phone data for policymaking.

In a statement yesterday, Bar president Ezri Abdul Wahab said there is a pressing need for the government to address a lack of public confidence in the authorities’ ability to safeguard personal data.

The trust deficit amongst the public regarding the management of personal data by the government machinery, he added, can be attributed to a pattern of repeated leaks, perceived opaque investigations, and the possible absence of meaningful accountability. 

As such, the Bar requested that Putrajaya address the trust deficit through mandating MCMC and participating mobile network operators to publicly disclose the specific standards, methodologies, and safeguards applied to ensure effective anonymisation and aggregation of mobile phone data.

This, Ezri said, may include the relevant technical documentation, data governance protocols, and risk assessments, which are published on MCMC’s portal or other accessible public platforms.

“Independent audits and/or oversight by trusted third-party bodies, such as the Public Accounts Committee in Parliament, would further reinforce public confidence,” he added.

Make govt accountable for leaks

Highlighting that Section 3(1) of the Personal Data Protection Act 2010 excludes the federal and state governments, the Bar called for amendments to the legislation to expand its jurisdiction. 

It also advocated for the law to be applied to all statutory and regulatory bodies, noting that such agencies collect and process large volumes of personal data.

Ezri pointed out that the right to personal liberty under Article 5(1) of the Federal Constitution also includes the right to privacy.

“In today’s data-driven environment, it is imperative that this right be enshrined in the Federal Constitution as a basic fundamental liberty.” 

He stressed that a robust, transparent, and independent enforcement regime must be established, including fast-track complaint and redress mechanisms, proactive investigations, and meaningful sanctions for mishandling or misuse of data.

He also said that public consultation and engagement should not be an afterthought. 

“All future phases of the mobile phone data programme and similar national-level data initiatives ought to be preceded by transparent, inclusive and genuine consultations, and dialogue with stakeholders, including civil society organisations, professional bodies, and academia,” he added.

MCMC, minister assure data safety

Previously, Communications Minister Fahmi Fadzil had assured that telecommunications companies would not be handing over information containing personal data to MCMC, following concerns raised over personal data security.

The minister explained that MCMC’s move to collect mobile phone data is to obtain detailed information regarding service quality, service levels, and the number of users within specific districts or sub-districts. 

MCMC also clarified that telecommunication companies can process the data within their secure environment and submit the required anonymised and aggregated output to the commission, or submit anonymised data to them for processing.

It added that there is no option for mobile users to opt out of the ongoing pilot project involving the collection of anonymised mobile phone data for official statistical purposes.

'Drop probe against MCA Youth leader over mobile data collection'

MCMC: No opt-out for mobile data collection pilot project

Fahmi: MCMC's call data collection for stats, no personal info to be shared

Bersatu to MCMC: How would you process anonymised data from telcos?

Only anonymised data for mobile phone data collection - MCMC

Telcos ordered to submit users' call, internet logs - report