By Brandon Teoh
The Sun reported on Oct 23 2012 in the article ‘End to data abuse’ by Pauline Wong that Information, Communications and Culture Minister Datuk Seri Rais Yatim has confirmed via sms reply that the Personal Data Department has been setup up finally and will be enforced by Jan 2013.
What is Personal Data Protection Act (PDPA) all about ?
In a nutshell, the act was passed by parliament in May 2012.
It enforces that ‘personal data’ manipulation is subjected to legal consequences when it comes to commercial activities, only.
For instance, when someone calls you up to sell you something, you have the right to request for the referral (of your contact) because having failed to disclose that means that the sales call is illegal.
And if that is true, that sales person and the business entity that he or she is representing can be punished for ‘personal data’ intrusion.
Nonetheless, it does not apply to the following 5 scenarios:
- Federal & states governments
- Credit reference agencies
- Data processed outside Malaysia
- Personal and family
- Non-commercial transactions
This means that if your cousin calls you up to talk about family business, you cannot go about suing him or her as a result of a fall-out – that is personal, period.
About two years ago, I accused an insurance company of practicing bad social responsibility for a courtesy call made to me to buy a product. My reason was overlapping products. I was already having products from the company and I didn’t want to pay more for buying the same thing. In short, the courtesy call was unexpected and unappreciated.
I had accused the marketing department for failure to exercise proper customer relationship management and the company of betraying the vision of good personal financial planning.
Some people defended that insurance companies must make a profit, but who doesn’t?
In terms of PDPA, the question is whether the courtesy call was legal or illegal ?
The answer to this question is data policy. Basically, PDPA gives rise to data privacy policies which are meant to protect users of products.
Therefore, if there is no data policy in place, it becomes a breach of ‘personal data’.
To make the courtesy call legal, telesales departments must first create respective data policies for its potential customers to agree upon.
Firstly, the data policy must seek permission from ‘personal data’ owners to approve usage of ‘personal data’ which will include how the data will can be utilized for and to what extend ?
Secondly, the data policy must cater a channel for ‘personal data’ owners to disprove usage of ‘personal data’ at own will.
Case Study
One good example is to look at Facebook’s data use policy.
Facebooks knows your name, email address, birthday, and gender. It also has information about your status update, photos and comments. It knows what you ‘like’ and didn’t ‘like’. It will also record your activities and geographical locations. In short, it knows about people, date and time, activities and relationships.
The policy states that your ‘personal data’ are being used in the events of
- Exercising security purposes
- Protecting rights
- Providing value-added services
- To sell ads
- Technical operations such as troubleshooting and etc
Hence, Facebook’s data use policy states clearly about two business related activities which are value-added services and selling of ads.
This means that if you disagree to receiving these two offers, you should not use Facebook at all.
Judgement call
Learning from Facebook’s data use policy, the courtesy call can be considered as part of value-added services.
The insurance company must create a data policy which states that it will make use of ‘personal data’ to solicit sales and it must cater a channel for ‘personal data’ owners to unsubscribe to such courtesy calls or to define the level of information which courtesy calls can leverage on.
For instance, you may want to allow courtesy call, but the telesales must not know what kind of job you do or that they can only contact you through email and not phone call or etc.
So was the courtesy call illegal ? – yes until I am aware of the any kind of data policy.
Was it ethical ? – up to your own discretion.
