Immediate amendment needed for Personal Data Protection Act in line with Padu, says Lawyers for Liberty

PETALING JAYA: An immediate amendment to the Personal Data Protection Act 2010 (PDPA) is needed to place responsibility and liability on the government as well as the agencies responsible for the protection and security of the data collected, says Lawyers for Liberty (LFL).

In response to the launch of the Central Database Hub (Padu) system that comes with significant flaws involving sensitive public data, its director Zaid Malek said the government must suspend the implementation of Padu until necessary amendments are made to the PDPA.

“The government must hold itself responsible in law before it can launch any data collection platform to ensure that the data collected is protected and secured.

“Any exemption from liability is unacceptable and shows the lack of confidence by the government of its own platform and its ability to protect the collected public data from misuse or theft,” he said.

Zaid added that there have been cases of misuse of data by the government before where personal data were used to disseminate propaganda by way of SMS to the public.

“Whilst there are valid reasons advanced why this Padu initiative is necessary, there are legitimate and serious concerns regarding the protection and security of the data collected.

“As it stands, section 3(1) of the PDPA exempts the government from its application, meaning that the data collected by Padu can be disseminated or used by the government beyond its declared purpose of targeted subsidies.

“It would be a massive betrayal of trust should data collected from the public be used by the government for any political purposes,” he said in a statement on Thursday (Jan 4).

As Padu uses a centralised on a single platform to collect data, Zaid said the security of the data must be made a priority.

“The government, unfortunately, has a bad track record of data protection. There are numerous reports of data being stolen from multiple agencies, exposing users to scams and data fraud with no legal recourse as the government is exempt from liability under the PDPA.

“This puts the public in a terrible disadvantage and danger of loss and damage,” he said.

In June last year, Economy Minister Rafizi Ramli had announced an Omnibus Bill which was supposed to address the authorisation of data sharing between its ministries and agencies.

“But details of this Bill are lacking. And surely it is obvious that the so-called Omnibus Bill should have come in before implementing the Padu scheme?

“It is thus not enough for the government to make verbal assurances that the data collected under Padu are not misused or will be protected,” Zaid pointed out.

As such, Zaid said there also must be a system in place for a public inquiry should any data breaches occur so that users that are affected can be informed of the breach and take necessary action against anyone responsible.

“Without the amendments being made before the launch of Padu, the public cannot be assured that their data will be protected from misuse by the government or scammers and unscrupulous individuals who will undoubtedly target the massive database,”he said.