Personal Data Processing by Business Premises during Movement Control Order
During the Conditional Movement Control Order (CMCO), businesses which are allowed to operate are required to observe certain standard operating procedures (SOPs) imposed by the Malaysian federal and state governments accordingly. In addition to temperature checks, contact tracing becomes an important part of these SOPs as it enables the authorities to trace individuals in the event of a new outbreak.
In this alert, we focus on the minimum requirements that businesses must comply with in their implementation of these contact tracing measures.
Contact Tracing Measures – Collection of Personal Data
These contact tracing measures require business premises to collect and record the following information of visitors and guests:
- name
- phone number
- date of visit
- time of visit
The Department of Personal Data Protection has clarified that business premises should implement these measures based on the minimum and necessary. In this case, business premises are allowed to collect only the abovementioned information from visitors or customers.
Permitted Methods of Personal Data Collection – Digital or Manual
Businesses are allowed to collect the personal data (as mentioned above) of visitors or guests by either digital or manual means at their discretion.
However, business operators must ensure that such personal data collected shall only be used for Covid-19 related contact tracing purposes, and shall not be used for any other purposes such as marketing. They must also ensure that the personal data so recorded are accurate and not misleading, and shall be safely secured at all times.
Additional Requirements for the Manual Collection Method
- The staff at the business premises must record the personal information of visitors or customers in a physical document in order to avoid unauthorised or inadvertent disclosure of such personal data to third parties.
- The physical document that is used to record these personal information must be a document dedicated only for such personal data collection for contact tracing purposes.
Written Notice Must Be Displayed at Business Premises
The business operator must display a written notice (in English & Bahasa Malaysia) at a clearly visible space at the business premise, to inform visitors or customers of the purpose of the collection of their personal information.
Storage of Personal Data
Business operators are required to keep and maintain the records of the personal data collected from visitors or guests up to 6 months after the end of CMCO.
After this 6-month period, these records must be destroyed and erased permanently via suitable means.
The Department of Personal Data Protection has made it clear that its enforcement officers will carry out enforcement checks at business premises from time to time to assess the level of compliance with these requirements, and will take enforcement actions should there be non-compliance.
Business operators who fail to comply with these requirements are exposed to the liability of penalty of up to RM300,000 or imprisonment of up to 2 years or both.
Should you have any question in relation to the above, please do not hesitate to contact us.
A corporate, transactional & commercial law firm.
Contact us
hello@joclawyers.com
+603 9226 9702
VO2-02-01, Level 2, V Office 2
Lingkaran SV (off Jalan Peel), Sunway Velocity
55100 Kuala Lumpur, Malaysia.