Business premises must abide by procedures in handling personal data

KKMM in a statement yesterday said the standard procedures had been approved in a special ministerial committee meeting on the implementation of the Movement Control Order (MCO) on May 21.

According to the statement, only the customer’s or visitor’s name, contact number, date and time of visit, should be recorded and it was up to the owners of the premises to implement either manual or electronic recording.

In addition, a notice must be displayed and easily seen to inform visitors or customers on the purpose of the personal data and that the data is used only for the purpose of contact tracing in accordance with the Prevention and Control of Infectious Diseases Act 1988 (Act 342).

The business premises must also ensure that the data obtained are accurate, complete and not misleading and the information could only be kept up to six months after the Conditional MCO ends, after which all data must be destroyed and deleted.

Non-compliance of the procedures is an offence, and if convicted, premises owners could be fined up to RM300,000 or jailed for two years or both, under the Personal Data Protection Act 2010 (Act 7090.

However, the procedures are subject to changes, as and when new rulings are introduced by the government, the statement said.

"As such the public need not worry about sharing their personal data at any business premises for the purpose of COVID-19 contact tracing as KKMM would conduct continuous monitoring," it added.

Any complaints regarding the implementation of this advisory may be filed through the Personal Data Protection System (SPDP) at https://registered.pdp.gov.my.