Myth Buster

Scenario

XYZ is a licensed housing developer in Malaysia. As of to-date, XYZ holds all the personal data of its clients. Mr Albert, one of its clients has given his consent to allow XYZ to use his personal data as in the registration form when buying a condominium from XYZ. However, Mr Albert now wants to withdraw his consent of allowing XYZ to process his personal data. XYZ rejected Mr Albert’s request. Is XYZ entitled to do so?

Mythbusted.

No. Under section 38(1) of Personal Data Protection Act 2010 (“the Act”), a data subject, who is an individual (Mr Albert) may withdraw his consent to the processing of his personal data by a written notice to the data user (XYZ Company).

Upon receipt of such written notice, the data user shall cease processing Mr Albert’s personal data, failing which, the data user shall commit an offense, and on conviction, liable to a fine up to RM100,000.00 and imprisonment for a term not exceeding 1 year or both.

However, it is advisable for Mr Albert to consider the consequences of withdrawing his consent, ie: affecting the performance of both XYZ and Mr Albert under the sale and purchase agreement.

Please note that the Act comes into effect on 15.11.2013. All class of data users under its regulation shall register with the Department of Personal Data Protection before 15.2.2014.

So, how much did you know about this Legal Myth?

Share with us your thoughts and feedback to us. Ask us a question on AskCA@Thursday or suggest a Myth Buster for us.

Thanks!