ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Malaysia report)

ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Malaysia report)

Author: Dominic Paulger, Policy Manager (APAC), Future of Privacy Forum

Asian Business Law Institute and Future of Privacy Forum

July 2022

This report provides a detailed overview of relevant laws and regulations in Malaysia on

• notice and consent requirements for processing personal data;
• alternative legal bases for processing personal data which permit processing of personal data without consent if the data controller undertakes a risk impact assessment (e.g., legitimate interests); and
• statutory bases for processing personal data without consent and exceptions or derogations from consent requirements in laws and regulations.

Table of Contents

1. INTRODUCTION 

2. CONSENT AND PRIVACY SELF-MANAGEMENT IN EXISTING LAWS AND REGULATIONS

    2.1. PDPA amendments 

3. SECTORAL LAWS AND REGULATIONS

    3.1. Banking and financial services sectors

    3.2. Healthcare sector

4. PERSONAL DATA PROTECTION CODES OF PRACTICE (“PDP CODE OF PRACTICE”)

5. CONDITIONS FOR CONSENT 

    5.1. Definition and forms of consent

    5.2. Withdrawal of consent

    5.3. Bundled consent

6. CONSENT FOR SPECIAL CATEGORIES OR USES OF DATA

    6.1. Children

    6.2. Cookie, Internet of Things, online tracking

    6.3. Direct marketing

    6.4. Biometric and genetic data

    6.5. Financial information

    6.6. Statistics and research

    6.7. Pseudonymized data.

    6.8. Location data

7. CONSENT FOR CROSS-BORDER DATA TRANSFERS

8. TRANSPARENCY AND NOTICE

9. SANCTIONS AND ENFORCEMENT

10. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT SUBJECT TO A RISK IMPACT ASSESSMENT

11. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT IN OTHER CIRCUMSTANCES DEFINED BY LAW

      11.1. Collecting, using, and disclosing non-sensitive personal data 

               a. “Vital interests”

      11.2. Collecting, using, and disclosing sensitive personal data 

      11.3. Transferring personal data across borders without consent

      11.4. Exemptions from the General Principle

      11.5. Sectoral regulations

      11.6. Rule of interpretation

      11.7. COVID-19