What safeguards exist for MySejahtera data usage by private firms?

Question

Accepted Answer

Safeguards for MySejahtera Data Usage by Private Firms

The Personal Data Protection Act (PDPA) is intended to govern the actions of private companies that may handle MySejahtera data, particularly in the context of a proposed procurement exercise. While the Act exempts federal and state governments from its direct application under Section 3(1), it mandates that any private entity processing personal data in commercial transactions must adhere to data protection principles, which include obtaining consent from data subjects. The usage of the MySejahtera app itself may be considered as implied consent for data processing, provided it aligns with the purposes outlined within the app's policy.
PDPA Application to Private Entities

The PDPA applies to any entity that processes, controls, or authorises the processing of personal data within commercial transactions. This means that if MySejahtera is acquired or managed by a private company, that company must comply with the PDPA's requirements. Lawyers suggest that the government's assurances regarding data protection, despite the Section 3(1) exemption for public bodies, are based on the expectation that the PDPA will sufficiently regulate the private company's handling of the data. This regulatory framework aims to provide data subjects with recourse should their data be processed beyond the initially intended scope.
Implied Consent Through App Usage

Under the PDPA, the processing of personal data generally requires the consent of the data subject, which can be express, implied, or through conduct. In the case of the MySejahtera app, the act of using the application for its stated purposes, such as check-ins or accessing vaccination status, can be interpreted as implied consent for the processing of personal data. The MySejahtera Privacy Policy is understood to outline the specific purposes for which data is collected and processed, and usage of the app signifies agreement to these terms.
Ownership and Licensing Agreements

The development and ownership of the MySejahtera app's proprietary software are attributed to Entomo Malaysia Sdn Bhd (formerly KPISoft Malaysia Sdn Bhd). A perpetual license was granted to MYSJ Sdn Bhd to use this software exclusively for the MySejahtera application. This licensing agreement specifies that MYSJ acquires only the right to use the software for the app and does not obtain broader ownership interests or other rights. Entomo Malaysia retains all rights, title, and interest in the underlying software, unless explicitly provided otherwise within the agreement.
Government Oversight and Data Ownership

Despite the licensing arrangements and the involvement of private companies, the Malaysian government, through the Ministry of Health, has maintained that the MySejahtera app and its associated data remain under government ownership. Health Minister Khairy Jamaluddin has reiterated that the app itself has not been sold to any private entity. This assertion suggests that while private firms may be involved in the operational aspects or software licensing, the ultimate control and ownership of the data collected via MySejahtera reside with the government, underscoring a layer of governmental oversight.

Reading history

Hide →

This history is cleared when the page is closed.

What safeguards exist for MySejahtera data usage by private firms?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends