- 44 minutes ago
- #thinktwice
What if your personal information ended up in the wrong hands?
From doxing and identity theft to data leaks involving public and private systems, digital vulnerabilities are raising serious concerns about how our personal information is collected, stored and protected.
As calls for stronger online safety measures grow, so do questions about privacy and mandatory government ID verification.
Watch Sinar Daily’s #ThinkTwice as we explore the risks and what’s at stake.
From doxing and identity theft to data leaks involving public and private systems, digital vulnerabilities are raising serious concerns about how our personal information is collected, stored and protected.
As calls for stronger online safety measures grow, so do questions about privacy and mandatory government ID verification.
Watch Sinar Daily’s #ThinkTwice as we explore the risks and what’s at stake.
Category
🗞
NewsTranscript
00:00Hi everyone, good morning, good morning, good afternoon, I'm Tassim Lohman and you're watching
00:05Sina Digley's feature podcast, Think Twice, and we are doing a discussion in conjunction
00:11with Global Media and Information Literacy Week, and I have with me today is Washla Naidoo,
00:18Executive Director of Center for Independent Journalism, sorry because I usually call it
00:24CIJ, thank you Washla for being here today.
00:27Tassim, pleasure.
00:28Alright, next we have Zahid Malik, thank you so much for being here, our human rights lawyer.
00:33Thank you for having me.
00:36Zahid is the former Executive for Lawyers of Liberty, but in general he does all human
00:44rights, civil liberties, if there is a, if you're right, you can transgress, I'll be there.
00:50Yes, okay, so we're, yeah, that should be really good.
00:56Okay, so why we're here today, because we will be talking about something that I think
01:01a lot of people don't realize, but it happens every day.
01:03We're talking about the digital ecosystem and data protection and safety.
01:09So, before we begin, I'd just like to highlight the fact that we are already currently living
01:15in a digital ecosystem, and every day we put stuff online, we put our personal information,
01:22we put professional information, national information, and do we actually realize what
01:27we're doing?
01:28Because we are headed into, I think we're already in a digital world now, but are we really looking
01:36at the protection and safety that we actually need to have, and the authorities we have over
01:42the information being shared?
01:44So, connectivity has become a second nature to all of us here, not just here, around the
01:50world.
01:50And it has become such a convenience that we always forget, or we always put the security
01:57aspect behind, for kesenangan semua lah, kan?
02:01So, today, we are going to be talking about the things that people, Malaysians, face on a
02:07daily basis.
02:08Doxing, cyberbullying, scams, identity theft, and also image manipulation, because that has
02:14become a huge deal, right?
02:16Like, we have even seen, like, Cairo Aming, who is such a huge figure in the digital world,
02:23having leaked information, and if it can happen to him, it can actually happen to anyone around
02:29us, right?
02:30So, before we begin, where does the public confidence stand, actually, when it comes to
02:36digital security and digital safety?
02:40I think we need to look at the current context.
02:44What we are seeing, and you're right, like, we, our lives now are on online space, no longer
02:50even as simple as, you know, an hour or two a day before we go online to do some work,
02:56right?
02:57Everything is online, and we are literally carrying our smartphones for our day-to-day
03:02interaction, day-to-day engagement, financial transactions, everything happens online.
03:07So, the data, then, becomes a systemic issue.
03:12So, because it's so normal, flash out our IC, and data is not just personal, I buy a lot,
03:21many other things, including metadata, day-to-day life, every single transaction, both commercial
03:29transaction, other engagement, going on social media platform, you know, on Lazada, Shopee,
03:35everything requires identification, right?
03:39And because it's so systemic, we have normalised it to such an extent that there is already
03:45apathy, right?
03:46People are not aware of the real harms of our personal data floating around, right?
03:53So, and this apathy means, like, hey, our data is already there, so what's more sharing,
03:59right?
03:59It's fine.
04:00And then, of course, we look at the lack of this awareness creates a situation or enables
04:09this continuing of a situation where people are profiting from this.
04:14Data is a commodity.
04:15I mean, let's not sugarcoat it in any way, right?
04:20It is a lucrative business, hence we see these many opportunities for data mining, which allows
04:30for behavioural profiling, which allows for targeted advertising.
04:34So, that's why it becomes so critical for us, the public generally, or users, to be more
04:40aware and more resilient in the need to protect our data.
04:45And Zaid, what's your think?
04:47Okay, all right.
04:48I mean, I just want to add on, because I agree wholeheartedly with whatever Wachlah has said.
04:55It's just, I think, yeah, I think you strike it right on the mark that it is a, apathy
05:03is not the word that I would use, but it's just a lack of awareness.
05:05It is just, I am old enough to remember a time before the internet, but there's a majority
05:12of Malaysians are born into the age of internet, and to them, it's just part of their world.
05:18So, it is, I liken social media spaces or internet spaces as sort of that, the new public square.
05:25It is just a place where people have discourse, people have conversations online.
05:31In fact, I think some people even journal, you know, or just journal their thoughts and
05:39their feelings online without a thought or without realising that this is something that
05:44can be publicly shared around.
05:45So, in terms of public sentiment on data safety, I think because it has been integrated
05:54into their day-to-day existence, there is definitely a lack of awareness of how damaging things online
06:02can get, if it is leaked to unscrupulous individuals or companies, because identity can be used
06:13to scam other people, you know, or do any other data breaches involving, that can be quite damaging.
06:19Your banking details, your address, your actual life could be in danger if you don't really
06:26think about what you put up online, what kind of insensitive information you share, because
06:30technology has advanced, right, with the advent of AI, I mean, have you ever seen the video
06:36of GeoTag, the GeoTag videos online, where they can just pinpoint where you live, where
06:42you are, anywhere in the world, just from a picture.
06:45That is a person, there are systems that can do that now, in the blink of an eye.
06:49So, it is quite scary if you think about it, that any little information you put online
06:53can be used against you.
06:55So, yeah.
06:57Actually, it's fun that you mentioned about the age gap.
07:01The age transition, right?
07:03Like, I remember when I was going online, we were like teenagers, and we were told consistently
07:09whatever you put online will be there forever.
07:13Some might question that, because some people are asking where are all my MySpaces photos.
07:19But, it's true, right?
07:20Like, because you see when people are doxxed, regardless good or bad, there is never a reason
07:25to doxxed people.
07:25But, people become private investigators on Twitter and threads, right?
07:32When you're on whatever, they get this, what do you call that one?
07:38They go deep, they deep dive into your profile.
07:44Yes.
07:45So, when that happens, like, how do you guys, how should we manage that situation of doxxing?
07:51Because, from a digital standpoint, right?
07:54Like, how can we shift the mindset of the helpless?
07:59I mean, I don't want to say helpless.
08:01Like, those who are not so...
08:03Communities at risk.
08:04Yes.
08:04Communities at risk, yeah.
08:05Yeah.
08:06You know, this is a real-world issue, right?
08:10I think you pointed out exactly the fact that technology is so advanced, and, you know,
08:22identifying people through any kind of information is much easier compared to before, right?
08:28And it's not like the concerns and issues of data protection is new.
08:33It's just that the scale of it has escalated to the point that it's becoming more of a real-world
08:41issue, right?
08:42And you experience it on a daily basis.
08:44Just a couple of examples, right?
08:46When we talk about doxxing, people just don't realise where this information is coming from.
08:51Even today, if people can just Google your name, right, and what Gemini pulls out, or
08:57go to chat GPT, you know, and see what comes out, you'll be surprised over the fact that
09:03your phone numbers might be available, your addresses might be available.
09:06And for civil society activists, this is real fear.
09:11And we've seen this pattern happening when civil society or human rights defenders are addressing
09:19very sensitive, controversial issues.
09:21And when they come under attack and they start receiving threats, one of the things that
09:26happens is they have their images being, you know, shared online.
09:31That's the first thing, right?
09:32And then your phone numbers, their addresses.
09:34It has even gone to an extent, and I recall this case during COVID, where this human rights
09:40defenders, photos of a children, right, were put online as well.
09:44Like, you know, like, we know where they go to school.
09:47Yes.
09:47So that's why, and I think it requires a two-part way thing, because we are sharing this data,
09:54thinking that, you know, there is some level of security, this then makes you also very
09:59vulnerable, because this is in online spaces, and very often than not, it will always remain
10:06there, right?
10:08And that's why the malicious actors are able to manipulate and use this data.
10:13Okay.
10:14Sorry.
10:16We're talking about the online ecosystem overall, right?
10:19So when we're talking about all these malicious items, this is our general information being
10:25shared, right?
10:26What about data minimization?
10:29Like, where does it come through?
10:30Like, from a legal standpoint?
10:32You see, the thing is, again, I think everyone knows this already.
10:38Every little thing you do now has to go through an app, has to go through some sort of a
10:43digital
10:43software.
10:44So that's, and the requisite that you need to do when you use any of this app is to put
10:52sensitive personal information.
10:54It can range from just your name or your phone number up to the most sensitive information from
10:59Malaysians, which is your IC number.
11:03So in terms of the minimization of the data you share with these actors, with these companies
11:11who are collecting your data, I think this is where the government steps in, right?
11:18Because as an individual, you can't really, you can't afford, at least in this day and age,
11:23perhaps 30 years ago, if you don't want to go, if you don't want to have MySpace, you just
11:28don't create an account.
11:29But that's not an option available to anyone now.
11:33Even the very simple act of going to a restaurant and ordering food, you need to have to share
11:40your phone details.
11:41So there's not a lot of bargaining that can be done between an individual and the company
11:46who's trying to get your data.
11:47That's which is why it is crucial for the government to step in.
11:50Again, going back to my analogy that this is a sort of a public square.
11:54Who should govern public square?
11:56It is the government.
11:57Because the government should bargain on your behalf.
11:59The government should erect barriers to ensure that only the bare minimum of data is shared
12:05with the company, as is necessary, one.
12:07And secondly, is in terms of how the data is used.
12:11That's also a thing that the government is well-equipped and in a position to bargain with
12:16these companies.
12:17And also in terms of how it's shared, how long it's retained.
12:23So when we talk about data minimization, yes, if you can.
12:27I don't think, I would caution everyone.
12:29It is not worth it to just simply go to a random store and they're just keying your information
12:37to get a 5% discount every month on your birthday.
12:43Because that data is shared with multiple companies.
12:46And the scary thing about leaks, because you mentioned leaks, is just that who leaked that
12:52information?
12:53Because a lot of parties already have it on hand.
12:55And there are multiple databases that have already happened throughout the years.
12:58And of course, government should step in.
13:03But the thing with personal information being leaked, it's just once, it's like a Pandora
13:12box.
13:12Once it's out, it's out.
13:13You can't really close the box back.
13:15And the information is out there.
13:17And even if you close this one gap, there'll be other holes where the information can be
13:24siphoned to other malicious actors.
13:27So, minimization of data at an individual level, of course, you must look at who it is
13:33that you're giving it to and whether or not it's worthwhile doing it, understanding that
13:38it can be shared around.
13:39But in certain situations where you are dealing with certain companies, your place of employment
13:47or banks or any other things that you need to use the app to access, when the option is
13:53not available for you to say no, then that's where the government must come in.
13:57And erect this sort of barriers for your protection.
14:01I think I mentioned data as a commodity now.
14:06All right.
14:07So, but the commodity is, it goes beyond your one commercial transaction.
14:15All right.
14:15So, it crosses borders.
14:17Yeah.
14:17It crosses parties.
14:19Different actors have access to it.
14:21It's another form of, I would say, colonization.
14:24It's data colonization happening now because the real big players are the ones who are able
14:30to also then profit from that data.
14:33Okay.
14:34So, when we look at data minimization, we need to really go beyond the current concept of
14:42what's in the Personal Data Protection Act in Malaysia because it really does focus a lot
14:47on the issue of retention.
14:49You know, how long, who's retaining it, how you save, what are the safeguards when you're
14:54retaining it and all.
14:55But we need to start thinking about minimization in the context of why do we need all this data?
15:03All right.
15:04How do you minimize the kind of data that is going to be useful for any kind of, you know,
15:12transaction, commercial or whatever, you know, social transaction or anything, right?
15:16And that's what we really need to put into practice.
15:19And we need to move away from constantly asking for a national ID.
15:24Uh-huh.
15:24Yeah?
15:25At the end of the day, a national ID is so private.
15:28It's so personal.
15:29And I'm still aghast over the fact, and I'm so sorry to say this live, is touch and go
15:35is tied into your national ID, all right?
15:37Like, so that means people are not only going to be able to track your movement, right, but
15:43it's linked to all your personal data already.
15:47So my personal ID, of course, has very little.
15:49It's not tied into anything except for the most fundamental, right?
15:53But the, so minimization requires thought in terms of what data we need to stop collecting.
16:00Okay.
16:00Not just about retention.
16:01Stop collecting this data.
16:03And then it goes into two things that's unfortunately not in our PDPA, which is right to be forgotten, right?
16:13And that, and it comes into right to choose.
16:17These are fundamental principles under the European Union's GDPR, general data protection regulation, right?
16:24You must have a right to choose how people can use your data.
16:28It's not by default, everything is there, and then you have to go to the setting to change
16:32it, right?
16:33By default, it should be already minimization, you know, in terms of the kind of data that's
16:38being used.
16:39You know, I love the fact that you guys are highlighting the fact that, it just sounds
16:42like you said that the government should step in on what should and shouldn't be, and now
16:46you're saying that everything is by default.
16:49Most often than not, not all.
16:50I'm going to make a general statement.
16:52Exactly, exactly.
16:52Almost everything, not everything.
16:54But like, as we go on, we see the fact that there's a lot of EKYC.
17:00EKYC is when we have to take picture of our IC when we register.
17:04Most easiest example would be verification for accounts, like banking, or even social media.
17:13But for generally anything that requires you to verify, they want the photo of your IC, right?
17:20Where does that come in?
17:23Because we're trying to avoid that?
17:25Exactly.
17:26I mean, it's, it's, these are, they are fundamentalized.
17:30I'm not saying that PDPA doesn't talk about them at all.
17:33That is, they are regulating how the information is being shared, how, and the retention of the
17:39offset data.
17:41But yeah, again, but there are clear gaps in terms of the control that you have over the
17:46data, right?
17:46The right to choose, meaning that, you know, if you opt out, can you opt out to begin with?
17:51So the things that you mentioned, access to these services, right?
17:57They require this data.
17:59And if you don't give it, you are, then not, you don't get the service.
18:02However, but that, but that's not something you can afford.
18:05Like say you need an e-hailing service, you're stranded somewhere.
18:08Yeah.
18:08You know, you can't get a taxi.
18:09I mean, I don't know if like, depending on where you are, then, then, then you are forced
18:12to, in certain situations, just participate.
18:14You have to, you have to give the data.
18:16That's why I go back to, there's only so much an individual could do.
18:22At the base of it, right?
18:24I think from a constitutional perspective, I would say there is something called the
18:29right to privacy.
18:30Okay.
18:30Okay.
18:31It's not, unfortunately, right to privacy in Malaysia has not been explicitly recognized.
18:37It's not, it's not said in those terms in the Friday Constitution.
18:40It doesn't exist.
18:41If you just look at the Friday Constitution itself, it has been alluded to in some case
18:45laws, right?
18:46Certain cases, they do look to, oh, yes, when you talk about, when we talk about right
18:50to life, it would include a right to privacy.
18:52But because of the fact that it doesn't exist in the Friday Constitution, I think that is
18:58the, the, the, the, the policymakers don't put it as, as a central focus or sort of the,
19:03or the core of any policies regarding data collection or data preservation or data safety
19:09because, and because it's not there, right to privacy is not, is not made central to all
19:16this.
19:17There is no actual political will, not political will, I suppose, but there's, there's no direction
19:21when they, when they make a loss because ultimately the, the right to choose must be,
19:27must be also tied with the right to get redress.
19:30Meaning, in a sense that if that is leaked, what do you do, right?
19:34Of course, you can complain, but, okay, let's say you complain at the PDPA structure.
19:38You complain, then the PDPA, then the commission will issue a fine to whichever company that
19:44has mishandled your data.
19:45But, but your data is still out there.
19:48And, you don't have any effective redress as to how to stop that data from being misused.
19:53And, also, the compensation for it being misused, right?
19:56And, and this is, I'll be talking about commercial transactions.
19:59But, again, so, so, so, so, I, I'm going a bit further a bit than the original question.
20:04It's just, the, the core point that I'm trying to say is that the right or the, the, the,
20:09the powers that an individual, in that individual have to control data is limited.
20:14Of course, you have to be mindful.
20:15In your, in your, in your, in interactions online between a person and another person,
20:18of course, you have to, like, be careful not to accidentally talk to someone.
20:22Put up insensitive information about yourself or the other person.
20:27And, also, if you are unified, I mean, there are laws regulating in-person, person-to-person
20:32interactions.
20:33And, that's, that's the thing that you have, you can't have, you, you, individuals have
20:37control over.
20:38But, you know, an individual with companies, access to services, critical services that
20:42you need to, to, to, to, to, to, for your daily lives.
20:47That's, that, that's, that's not something that an individual can do.
20:50No matter how much you want, it's either you opt out, you, you go off the grid.
20:54Meaning, you know, you, you, you, you live in a cave somewhere, I'm not sure.
20:58There is an, there is a legitimate option, I suppose, if you want to go off the grid.
21:01But, you, you can't have extreme choices.
21:05That's, the government must be there to buttress the, the, the, the, the, the, the, the, the,
21:10the need for data collection and the right to privacy.
21:13That should be central to, in all this conversation.
21:15Yeah.
21:15Sorry.
21:16I think what is critical is, you can't pick and choose.
21:20Okay.
21:20And, you shouldn't pick and choose, right?
21:22On one hand, the government want to protect our personal data.
21:26And, in fact, one of the reason legislation, the Data Sharing Act, actually has a provision
21:33on protection of privacy.
21:35First time ever I've seen it.
21:36I know, Zayed, I don't know if any other legislations have it, but this one has, you
21:40know, a reference to privacy.
21:41So, they're conscious.
21:42They know that this is a priority and this needs to be protected.
21:46On the other hand, we have many other legislation which allows for access to data, all right?
21:53And this is highly problematic, all right?
21:55Just to name two, which will be the Communications and Multimedia Act, especially the Reason
21:59Amendments in 2024, and the Online Safety Act, right?
22:04It talks about being able to enter into premises, all right?
22:09Being able to install surveillance devices, being able to access data, including back-end data.
22:14And then, on the other hand, it even goes beyond due process and talks about how even faulty
22:21warrants can be admissible.
22:24These are powers being given without safeguards, and you're removing what existing safeguards
22:29are in place, right?
22:31Okay.
22:31So, if the powers be are not putting in place this protection mechanism for us general users,
22:39what more the big companies out there, the multinationals, the big techs, who are definitely
22:46benefiting from access to our data, right?
22:49So, why would they even – I mean, I'm sure they care, but what would be the threshold
22:56of protection that they need to adhere to?
22:59Yeah, I mean, and just also, because I didn't mention it before, but it just came into my
23:04mind, the fact that companies, the company structure, especially big companies, like
23:08conglomerate, right?
23:09There are multiple companies under it.
23:10So, even if the protection, the adequacy of the protection in terms of sharing, if you
23:14lead the user agreement, it's always certain where they can share it with others, with the
23:20subsidiaries, but what if they have dozens of subsidies across diverse industries, right?
23:28So, again, that's not something that I am able to negotiate out of, if I need to use
23:34the services.
23:35That's where the government has come in.
23:38Okay.
23:38With all the laws that are in place, you mentioned some may have caused other problems.
23:46What actually can we do?
23:48Like, what are the recommendations to policymakers that we have to look into?
23:53Because it's kind of like an unfair ground, because we don't have the ability to...
23:59I mean, do people really read the TNC?
24:03Yeah, yeah.
24:04I mean, see, the problem is, reading TNC is a different thing together from whether
24:07or not you can make powers to amend certain parts of the TNC.
24:10Yeah.
24:11That's why it goes back to bargaining power.
24:14You know, if I go into, again, a simple analogy, you go to a shop, you don't want to buy
24:17it, you want to buy the thing, and then there are some terms or situations you don't want
24:21to, you just leave the store.
24:22Yes.
24:22In situations where that is not an option.
24:25If I go to a hospital, right?
24:27Yeah.
24:27Right?
24:27You know?
24:28If I have to share data, and then let's say I share my personal information, like my health
24:34details to the hospital, and then what they do with it is an issue.
24:38Of course, there are protections.
24:39I mean, I think for private hospitals, definitely there are regulations and laws and regulations
24:44that prohibit the share of sensitive information.
24:47But, you know, the same cannot be said for government hospitals, because PDPA does not
24:52cover government entities, or it explicitly excludes state and federal government.
25:00So, and where does that, where does GRCs, where do GRCs stand in there, you know?
25:07Especially with the number of GRCs that we have in Malaysia.
25:09So, I think, yeah, there's a lot of issues that are in play.
25:18And if we're talking about individual-to-individual interaction, that's one thing.
25:24Again, but in terms of policymaking, the guidelines must be clear.
25:29Or, not guidelines, but rather the pathway must be clear of what the information is for
25:34must be spelled out, how it can be used must be spelled out, and then how long they can
25:39keep it, and the pathway for a person to get redressed.
25:43Like, say, I want to look at what information you have.
25:46I should be able to easily go to those, there must be a channel by which I can easily do
25:52that.
25:52I must say, certain apps, right, even the existing apps that I use, I can't find a help button.
25:59Especially now, they will channel me to an AI chatbot with a preset set of answers.
26:06And if the preset set of answers don't really relate to your situation, you're sort of stuck.
26:12There's no information, there's no number to call, there's no address for you to send physical
26:18letters, or to visit a customer service centre.
26:21So, these things are soft barriers that stop you from accessing, you know, having control
26:28over set data.
26:29Like, even the most, this is the most trivial thing.
26:33How can apps or websites have, not have, or rather the government does not regulate the
26:40design of apps or websites, so that the enforcement or assistance mechanism within the set website
26:46apps are made clear so that people can find them, right?
26:49I mean, I think that's a low-hanging fruit that they can use immediately without even
26:53inventing the law.
26:54And it needs to be in plain language.
26:56You know, your TNCs and legalists, nobody's going to take the time to read it, right?
27:03And, like, come on, I am trained to be more aware, and I've been in, like, instances where
27:07I'll just, like, tickle, I've got no time to read through the whole thing.
27:11But, okay, maybe I'll circle back to one super basic question.
27:15One super basic question, what is your right to begin with?
27:19What are the people's right to begin with when it comes to protecting data and information?
27:26The existing structure, right?
27:29There is a measure of protection, but it's more focused on commercial transactions, right,
27:36under the PDPA, essentially.
27:37I think most people are aware of the PDPA.
27:39The others, the Digital Safety Act, these are newer laws, and honestly, I don't think
27:45it relates much to the individual, or at least directly, right?
27:51So, that is the PDPA.
27:53So, the PDPA regulates the taking of information, how that information is used, and how long
28:00it can be retained.
28:01I love the fact you're saying PDPA, but we've been talking about this this whole time, and
28:04it only applies to private, right?
28:05Yeah, yeah, yeah.
28:06What about the government data breaches, and...
28:11That is a distinctive question.
28:13I think more people should be asking this question.
28:17Exactly.
28:18The largest holder of Malaysian personal data is basically the government, right?
28:24The most sensitive data.
28:26Exactly.
28:27Right?
28:27JPN, JPJ, immigration, they've got the most critical, sensitive data.
28:33And we have very little recourse when there is a data leak or a misuse of that data, right?
28:40And I think this has to be really addressed, and PDPA needs to be amended again.
28:46I know you just went through an amendment in 2024, but it needs to be amended again, and
28:52it needs to go beyond commercial transaction one.
28:55Second, it needs to apply across board.
28:58And we look at GDPR, for example, it addresses both, right?
29:01And it looks at the mandate and the scope is about data processing, and less than who are
29:09the actors processing it, all right?
29:11Whereas in Malaysia, we are very focused on who is the ones who are processing the data.
29:16Okay, all right.
29:17So just to pivot a bit, right?
29:19So this is in terms of the sovereignty you have over your data.
29:25But in terms of, let's step back a bit and not talk about your interaction or the sharing
29:32of data between you and the company.
29:34Of course, there are three tests within PDPA.
29:35We've touched upon it.
29:36There is something that you can complain.
29:39Let's say a company is misusing your data outside of its designated purpose.
29:44But in terms of individual to individual interaction, there are laws that govern this sort of interaction
29:53where, let's say, someone sends you, harasses you online.
29:59There are certain provisions in the Commissioners and Multimedia Act that can be applicable
30:04because these are harassment.
30:07So laws, penal offenses, right, or criminal offenses relating to harassment, that exists in the
30:17Commissioners and Multimedia Act as well as in the Penal Code.
30:21So, stalking laws, right, recently, I think, the most recent, I mean, a couple years back,
30:26there was a new amendment to the Penal Code, and then stalking is now a criminal offense.
30:32So if your gripe in terms of data and it is being misused by an individual who is using
30:41it to harass you, who is using it to stalk you, of course, you can make the necessary police
30:45reports, either with the MCMC or with the police.
30:52But this is, of course, limited to interactions where it falls under the criminal jurisdiction.
30:58But when we talk about data protection, it is not just in those interactions.
31:03It is, it is, it is, it is seeped into the very fabric of society and how we interact with
31:07the world nowadays, so, yeah.
31:09Okay.
31:11What would be the best, I mean, you mentioned just now about the amendments, but what would
31:14be the best policy recommendations in general for, to start off?
31:19I think while we wait for amendments and, you know, in Malaysia, the history of amendments
31:24can take a while.
31:25Yeah.
31:25I think we need to look at different measures.
31:29To start with, and I will look at it now in the context of transparency, to understand
31:36what safeguards and measures that government already have in place to protect our data.
31:41So we are not saying that automatically they need to be held accountable, but they have
31:45a responsibility in protecting the data that they are holding, all right?
31:48So there needs to be real disclosure about what these safety measures are, what these safeguards
31:54are, how are they dealing when they're, when there's leak.
31:57Very often now, we hear of these major, major leaks when there's a whistleblower, all right?
32:02But we, we don't get notification from government that there's been a particular data leak, all right?
32:07So I think those kind of measures can already be put in place at this point in time.
32:12The biggest challenge here we see is the GLCs, all right?
32:18They seem to fall through the cracks at this point in time.
32:21And when it comes to data and transfer of data, sharing of data for various purposes, it
32:28happens not just between government agencies, you know, between this, but it's also government
32:33to a third party, all right?
32:35So again, I think current policy measure will require transparency in terms of how data is
32:42going to be managed in this context, all right?
32:44And a third thing I think, and again, as I said earlier, the whole data colonization is
32:50also appearing in our digital trade agreements, all right?
32:55How are we protecting our data sovereignty?
32:59Again, and it, there are many measures of doing it, but for us, we are really challenged
33:04because we have very little information being disclosed.
33:07First, to start with disclosed information.
33:10Wherever data becomes a commodity between any agreement, you have to disclose, all right?
33:16Second thing is put in place all these safeguards.
33:19And third place, the third thing is remedies in the event of leaks.
33:25And these things can happen through all the different government measures.
33:29And I think even now that the government is working on the AI governance framework, this
33:36is an opportunity really, because if they are taking a risk-based assessment, data is
33:41going to be one of the biggest risks that they need to manage in the context of AI, all
33:46right?
33:46So there are different measures that could already be put in place.
33:49I mean, you're talking about AI, I think AI also exposes more recently, I mean, with the
33:56advent of AI recently, it shows how vulnerable data are, because a lot of AI models are trained
34:04of available public information.
34:08So that's why if you Google certain individuals' names, if they're notable enough, you can get
34:13like the whole list of things that you can find on the internet.
34:17So the lack of regulation prior to the advent of AI, and now with the advent of AI, the speed
34:22by which the data can be collected, it's very concerning.
34:25And I think more people should be aware, and if you should push for the government to protect
34:33their data, because when we say data here, we actually mean that it's related to their
34:39safety online.
34:42Yeah.
34:43I think we need to, back to the question about data minimisation, we should really, again,
34:49define this as a policy and regulatory measure, right?
34:52We need to really minimise requirements for ID-based data collection, all right?
34:59And one perfect example would be, yes, EKYC is critical, but how do you do this in such
35:05a way that data is not retained, all right?
35:09And when it comes to even social media now under the age verification process, there is a requirement
35:15for EKYC or ID-based verification.
35:18And I think we can move away.
35:20Many countries are already looking at zero-knowledge proof, that means use of cryptography that limits
35:28the kind of information that is being collected or used to verify your identity, you know?
35:35Because the purpose of this data collection starts with verification of your identity, all right?
35:40So move away from very personal data.
35:44But I think we need to be really conscious, data is not just the data that's on your ID,
35:49all right?
35:50It is the metadata that is now a huge commodity.
35:54Your face.
35:54Yeah, your face, your biometrics, right?
35:57Those face real, I mean, how are we getting a lot of our deep fakes here too, all right?
36:02Exactly.
36:02And that was like pre-AI, that was as advanced as it was.
36:06Exactly, yeah.
36:06Yeah, so I think data minimization requires us rethinking access to metadata.
36:13Why is it if I use Waze or ToJu, right?
36:18I mean, of course, it requires, and that's their practice, access to our geolocation.
36:25You know, it tracks our history.
36:27It has IP access.
36:29You know, those kinds of things are very critical, very personal, and the harm is real
36:35because it goes beyond, you know, surveillance, right?
36:39It could, you know, go into different kinds of social engineering, right?
36:44So again, we need to rethink how the default settings have to be put in place on all these apps.
36:50Even the default settings that you mentioned it, most of them involves proactive action
36:56on behalf of the user instead of being a default.
36:59It should be a default that you don't want to share.
37:01And you opt in, not opt out, right?
37:04I think that's the mentality in terms of data protection.
37:07So that's very crucial.
37:09And a lot of companies are already starting to do that, right?
37:13There are some tools, there are some apps, right, which, you know, doesn't automatically mean
37:20when you consent, you are allowing them to, say, use your data to train the LLM.
37:25Or, you know, for marketing purposes, it's the other way around.
37:28It asks your consent if they can use our data for other purposes.
37:34That's interesting because we talk a lot about, we've been talking about commodities, right?
37:40How these data are used to make more money.
37:48Unfortunately, that's the situation.
37:50How would you see Malaysians understanding this?
37:54Because we know that has become online, online content has become a business segment.
38:05So, I mean, okay, I grew up in each of the internet, I mean, like, from MySpace to Fenster to
38:13Facebook.
38:14And, you know, I wasn't online.
38:16My parents didn't allow me to go online when it was just chat rooms.
38:19So, but I knew of them.
38:22So, there was a social and cultural transition in terms of how people approach things online.
38:29People understanding that you can lie, you know, these are things that people, it used to be, I think it's
38:36very important to understand the mentality.
38:38You used to, you get news, if news is printed, you assume that it's true.
38:41You see stuff online, and at the point in the internet, in the early days, people thought everything online was
38:47true.
38:47And then eventually people find out that that's not the case.
38:50It may not be true.
38:51It may not be true, that's not the case.
38:53And then, you know, as social media progresses and it becomes a space by which people interact with each other,
39:00you know, then there was a cultural shift.
39:04You know, I remember you mentioned that, you know, things that are online are forever online.
39:10So, but that was true because people didn't understand that data preservation, that data safety is true.
39:17It was very early stages, right?
39:18Early stages.
39:18I mean, there was a server somewhere with all your information.
39:20The reason why you're on MySpace, and I will know yours, mine as well, all memories from that age is
39:27gone.
39:28It's because, you know, the server, the server, I think it was wiped out or something.
39:32They're like, so, I mean, and it's gone.
39:35Yeah.
39:36Right?
39:36But it just shows how the fact that information online, stored online, is not yours.
39:42Right?
39:42You don't have control over where it started, how long it started, and when it's gone.
39:46Right?
39:47So, again, so for people, and then eventually, when social media, not just social media,
39:53internet became crucial to every aspect of your day-to-day, then it becomes, then we go,
40:02there's less precaution because it's just a natural part of things.
40:06The thing that I harken back to, the reason why I'm mentioning all this before I use my thinking of
40:10thought,
40:10it's just that early on, I saw a video, someone said, nothing is free.
40:16So, when you register, you don't pay.
40:18Right?
40:19But when you, but you're the commodity.
40:22Yeah.
40:22Like, you are paying with your personal data, your biometrics, whatever, whatever information you share,
40:27that is what, that is how these companies, this is what these companies process,
40:33and what these companies use as commodity for their business.
40:36You are the thing that they are exchanging.
40:39So, to me, that's a thing that people have to understand.
40:41When you go online, when you don't have to pay for anything, you are the thing that, you are the
40:45currency.
40:46So, if you view it in that way, you, then you understand how valuable your data,
40:51I mean, hopefully, that's how I understand it, that's how I process information.
40:54And I hope, by me telling people this, people can understand that, how valuable data is.
41:02Yeah.
41:02I think maybe simple tips.
41:05I'm a firm believer that you shouldn't pile on the responsibility solely on the user.
41:12Right?
41:12Exactly.
41:12Responsibility is on key decision makers, and in this instance, our regulators and the government.
41:19Right?
41:19And, of course, the service providers.
41:22Aside from that, some simple things that users can do that can perhaps set a precedent or add pressure is,
41:29choose your product.
41:31Ingat-ta dulu, we used to, like, you know, tengok sirim chok.
41:34Yeah.
41:34Right?
41:34Okay, some level of accreditation.
41:37So, look for products that have got clearer data protection policies.
41:42If I want to go on this platform, I want to go on this e-commerce space, do I even
41:51understand their TNC?
41:54And see what kind of measure.
41:57Increasingly, I mean, I don't want to say that everything is bad.
42:00Increasingly, people are becoming more responsible.
42:02Their data protection policies are becoming somewhat more user-friendly.
42:08So, choose your product on that basis.
42:26Okay.
42:27Change your security setting because most platforms, I mean, credible, reliable platforms, both e-commerce, social media platforms,
42:40FinTechs, and so on, do have certain level of security setting.
42:45But we need to go and do it.
42:47I mean, I think our other lobby would be to ensure that the security settings are set by default, right?
42:54And the third thing, I think, is always remember that consent button and the cookies and things like that.
43:02Accept or reject or, you know, customize, right?
43:06Go and look at it properly and personalize them or customize them and don't just say, you know, accept all.
43:13So, that's going to be simple tips to be more conscious because that would add pressure.
43:18Why is it more and more companies in Europe are adopting or at least applying the GDPR?
43:25Because there is pressure from both the state but also users hopefully are becoming.
43:29So, here we need to be conscious.
43:31We need to be informed of not just our rights but also the understanding of the real world harm.
43:38Okay.
43:38I love that we're talking about prevention.
43:40But prevention is, obviously, prevention is better than cure.
43:44But when things get, when things happen, you need a solution to it.
43:50And when you get in trouble, you need to address it, right?
43:52So, what are the actual avenues that we can redress that exist right now?
44:00Like, what should citizens look for when something bad happens to them?
44:05I mean, it depends on what happens, right?
44:07So, if there is a leak, data leak, and this is by companies, meaning let's say you go to a,
44:16like, okay, what has happened?
44:18Oh, yeah.
44:19There was one time that this happened to me.
44:23My brother went to the bank, and then, you know, he accidentally took something off the table that is not
44:29his.
44:29He thought it was his, right?
44:31And then he got a call from the bank teller's brother, you know, to return the object that he accidentally
44:37took.
44:38So, that simple act is a breach of a PDPA because his number, obviously, how did the brother get the
44:45number?
44:46It's obviously from the bank teller's, so then, therefore, it is from the bank, right?
44:49So, in this sort of situation, you have to understand who is the one, okay, the first thing you should
44:57do is to make sure how their data was leaked.
44:59If it is by a company, and it is from the data that you're given for a specific purpose, then
45:04you make the report, you report with the, within the complex mechanism within the PDPA.
45:11So, there was a misuse of the data, and then there will be an investigative process and a fine or
45:19whatever, whatever enforcement mechanisms will be imposed on, towards the company that has breached or leaked your data.
45:26But, again, the problem is just that it is an opaque process, and it doesn't really involve you, and as
45:32a user, your involvement would probably just be in terms of making the complaint, right?
45:39So, in an institution where the one that I elucidated to, where it's just a simple matter of someone contacting
45:45you, and you can make a complaint, yeah, the bank would be responsible, and that would be fine, imposed.
45:51But, in terms of data breaches that are more harmful, where a scam, like, there's a WhatsApp message that comes
46:00in, and you don't know.
46:02It's a scam call, but, so, your data has been leaked, but how has it been leaked?
46:06Yeah.
46:06You don't know.
46:07Yeah.
46:08So, in terms of that, because the PDPA doesn't really cover all sorts of intractions, you can make the complaint,
46:14but if it falls outside of the commercial intractions, if it's leaked through, let's say, JPN, or some other enforcement
46:19body, there's really no redress for you.
46:23But there's no redress for you, because you can make the complaint, and then, you know, nothing will happen.
46:30So, but, again, if there is something that, if this is a thing that occurred, of course, you should make,
46:35I'm not discouraging people for making the report.
46:38You should make the report to the commissioner for PDPA, and you should also make a complaint to MCMC, right,
46:46in terms of if there is a scam call, or any sort of a, whatever mode of communication,
46:52either through online, or through, through, through, through, through, through, through, through fake accounts, just make the report to MCMC.
47:00If it escalates to a level by which it is harassment, where they're not trying to sell you something, or
47:06they're not trying to dupe you into a commercial contract, or out of your money, it involves stalking.
47:12It involves doxing, bullying, harassment to yourself or your family, then that becomes a criminal offence.
47:20So, you should make a police report, right, and you can also make a complaint to MCMC, but honestly, you
47:26can just make a police report, because it'd be easier.
47:28They can just transfer.
47:29They have the jurisdiction as well to investigate, to investigate the offence, and it shouldn't be on you to decide
47:35what offence it falls under.
47:37I'm just telling you that if, if there is harassment, you are facing harassment online from an individual, whether or
47:43not you know them, right, you can make a police report.
47:47It is for the government to investigate, so you don't have to think too much about it, yeah.
47:50Including, I would say, non-consensual sharing of intimate images.
47:55Exactly, exactly.
47:56Oh my god, yeah.
47:57Yeah, yeah.
47:59That's another conversation.
48:01There is another conversation, but it's a very important conversation.
48:04It's just that, I mean, by right, if it happens, you should, I mean, of course, I understand that there
48:11are a lot of social stigma around it, but you should make a police report, and the police should be
48:17able to handle the case delicately, considering the nature of the investigation.
48:24But, but, but the, the, the recourse, I'm just, I mean, the recourse is available.
48:28Yeah.
48:28In terms of legal mechanisms, that's definitely an avenue you can take.
48:31Because we were talking about doctrinated images, and, I mean, that's further, but what I'm saying is now with the
48:38AI, people are actually manipulating the images that some laws are saying that that's not real, and some people are
48:46not taking it seriously, right?
48:47But, that's, yeah, yeah.
48:50Yeah, that's, that's, that's, there is still a cover, and I, I think, broadly, because I mentioned 2E3 of the
48:55Organization of Multimedia Act, which I have a personal problem, too, but it's broad enough.
48:59It's broad enough to cover it.
49:00Yeah, okay.
49:01It's broad enough, I mean, that's the whole conversation about 2E3, about how it should be segmented to different types
49:06of offenses, but it is broad enough, currently, to cover harassment by means of internet communication.
49:14Okay.
49:14So, if this is what has happened to you, you can use Section 2E3 of the Consimedia Material Act.
49:21There are other, I mean, because, see, the problem with categorizing the offenses is just, it goes into who, whether
49:29or not it is an individual or a corporate entity, and whether or not, how the communication is made, what
49:34platform.
49:35As a user, as a person, as an individual, you don't have to think about that.
49:38Just collect the evidence that has happened, the communication, make the police report, let the police handle it, and then,
49:44of course, if the, if it is not handled in a delicate manner, then, you know, you can also, there's
49:49redress for that, as well.
49:49I mean, there's also, of course, if you're, if this is happening on social media platforms, right, there is their
49:57own reporting mechanism, so, especially when it comes to doxing, and, you know, of course, you know, through their own
50:05community standards and their reporting mechanism, content can be taken down.
50:10And we've seen it, especially when it comes to very sensitive information, or when it's targeting particular communities that are
50:19already at risk.
50:21Yeah, yeah, thank you for mentioning that.
50:22I sort of, I was too focused on the legal mechanism, but there is internal mechanisms by this, by social
50:29media sites.
50:30However, of course, there is something to be said about how the government should make sure or ensure that the
50:33guidelines provide enough cover for in the sort of interactions of harassment that people, that people encounter online.
50:41All right, so, thank you so much for being on Think Twice.
50:47That's been a very in-depth discussion, and I hope people are able to take away the tips on how
50:54to protect your data and privacy online, because I think, based on the discussion today, the conversation for Global Media
51:02and Information Literacy Week,
51:03we have to understand that data resilience does not mean we resign ourselves to extreme sites, right?
51:11We have to meet the middle way, because in the modern world, we are required to connect, but it's just
51:18based on what we have and the options we have and ways to connect.
51:23So, I think it's very, very focused on vigilance, and also how we share, we have a shared responsibility on
51:33becoming a better ecosystem for everyone, right?
51:36So, above all, thank you so much, Awashla and Zayed, for being on Think Twice podcast.
51:43And for everyone out there, please be careful what you share, re-look at what you agree on, and I
51:51guess read the TNC?
51:52Yes, of course.
51:53Read the TNC.
51:54And if anything happens, you have the right to report to the police and to the MMCMC.
52:00And the platforms.
52:01And the platforms, of course.
52:03All right, thank you so much.
52:05This is Zinari Daily, signing out on Think Twice podcast.