The Blue Oceans for the Data Protection Officers (DPO)

By: Sonny Zulhuda

I recently concluded my talk at this event called Data Protection Excellence Network Forum 2019 upon invitation by Singapore Management University (SMU) and Straits Interactive on Tuesday this week (11/6/2019).

Featured together in the opening panel session with me were Commissioner Raymund Enriquez Liboro (Chairman of the Philippines National Privacy Commission), Dr Yudhistira Nugraha (Ministry of Communications and Informatics of Indonesia) and Kevin Shepherdson (Straits Interactive Singapore) discussing the trends and challenges of data protection law in the region and the new market demands for Data Protection Officers (DPO). The event with over hundred attendees were officiated by Dr Lim Lai Cheng who is the Executive Director of the SMU Academy.

Each of us spoke about the regional development of the data protection laws in Malaysia, Philippines, Indonesia and Singapore respectively.

Malaysia had first enacted the law in 2010. Both the Philippines and Singapore followed the suit in 2012. Indonesia is currently preparing a draft bill and is expected to legislate by next year (2020). In term of enforcement, Singapore has recorded dozens of imposition of fines and notices against contravention of their personal data protection law. Meanwhile, the Philippines may only expect enforcement to begin next year in 2020.

In Malaysia, efforts to implement the law come in a combination of prosecution, inspection, establishment of codes of practices as well as public education.

There are in Malaysia at least five successful prosecutions of data users who contravened the PDPA 2010. Besides, it was noted that six sectoral data fora had registered their Codes of Practices (COP) including the banking and insurance sectors, electricity, telecommunications, aviation, and legal services.

In 2018 alone, the office of PDP Commissioner has carried out at least 57 inspections on data users nationwide. Empowered under section 101 of the PDPA 2010, such inspection is meant to promote the compliance of the law while trying to correct and improve the practices by data users in term of processing personal data.

Screenshot_2019-06-14-08-48-17-927_com.microsoft.office.powerpoint

There is one interesting finding from the talk session. Each of the four countries commonly view that it is necessary legally for the data users to appoint a Data Protection Officer, a specifically designated high-level official to oversee the increasing challenges of data governance. Singapore and the Philippines have this in their laws. Indonesian draft bill includes this. And Malaysian government looks out to consider this matter in their ongoing review of the law.

This DPO is a blend of new skill. Straits Interactive noted that each lawyers and IT professionals make up to about 30% of the DPOs. Others come from business managers, HR, accountants, marketing as well as others. Therefore there is now an emerging need to somehow standardise the skill, hence the need for certifications. The good news is, this skill is acquirable.

In that Forum crowded by more than hundred of data users and data protection professionals from Singapore and the region, the demand for this market could not be overstated. It is simply obvious and there to grab.

So the ultimate message we had for all the lawyers, IT professionals and virtually everyone.. Is that there is a blue ocean in front of us now for the highly demanded data protection professionals. Let us swim there!

Ransomware Attack: How a PDP law compliance can be of any help

By: Sonny Zulhuda

Ransomware

No! We are not talking about how to cure a ransomware attack such as “WannaCry” after it happens. That is not going to happen. Legal compliance is, from the perspective of business continuity and data disaster management, always at the “preventive” side rather than “curative” or “recovery” domain. Just like how technically a data backup is more preventive rather than reactive.

Then, are we saying that complying with Personal Data Protection law is going to prevent incidents like ransomware attack? Not necessarily true. But obviously, by keeping yourself updated about legal requirements pertaining to personal data protection, you will activate a “standby” mode.

Complying with the legal requirements on data protection such as Data Security and Data Retention standards, for example, people in your organisation are made aware that some security measures had to be put in place to protect the personal data system, which often overlaps with other database or information systems in your organisation: payroll system, human resources system, financial system, CRM system, and so on, because in each of those there are personal data of data subjects that you or your organisation process/processes.

That is why, a compliance with PDP law such as the Malaysian Personal Data Protection Act 2010, can be a gateway to better data protection in your organisation from unwanted attacks or other risks to the data integrity and security. In fact, the PDPA 2010 hints that a data due diligence

In fact, the PDPA 2010 hints that a data due diligence such as your data risk management that you conduct in your organisation will not only mitigate the risk to data attack but also will be your “legal defence” in case such attack takes place despite your mitigating measures. This is what transpires from the provisions of the PDPA 2010.

So, the equation is not complicated:

Data due diligence = legal compliance + risk management = legal defence

Good luck! 🙂

Personal Data Governance from A Cyber Security Perspective

By: Sonny Zulhuda

Data privacy and data security are two sides of a coin – unseparable. Despite efforts by experts to explain this, yet the misunderstanding that they defeat each other is still widely looming.  In this APAC Cyber Security Summit held in on 3rd June 2016 in Kuala Lumpur and attended by more than two-hundred regional participants, I took another attempt to explain this: How protecting one’s data privacy can contribute to a larger information security practices. Not coincidentally, one can see it from the other side: In order to afford maximum protection of one’s privacy, efforts must be taken to secure his data. Thus, data security is part of a bigger personal data privacy protection. Confused? Don’t be.

APAC Cyber Summit 2016_1The truth is, personal data management does include protecting its confidentiality, integrity and availablity. And doing so, it means one must ensure the privacy and security of personal data goes side by side.

In a report released by the PriceWaterhouseCoopers (PWC) in 2016 on Personal Data Use Governance – Mitigate Risk while Unlocking Business Value, there is a sfift (or more sutiably, an expansion) of personal data risks landscape from merely a security and regulatory issue, to an intersection of issues of ethical, regulatory, litigation, security and serivce quality.

At this Conference, I highlighted the latest status and implementation of the Malaysian Personal Data Protection Act 2010 and tried to show how the new regulatory framework reshape the landscape of information security in Malaysia.

The points can be summarised as follows:

  1. Perspective #1. PDPA 2010 creates data management principles
  2. Perspective #2. PDPA 2010 spells out the duties throughout data lifecycle
  3. Perspective #3. PDPA 2010 identifies data risks
  4. Perspective #4. PDPA 2010 creates new data offences
  5. Perspective #5. PDPA 2010 creates duty of data due diligence
  • December 2019
    M T W T F S S
    « Nov    
     1
    2345678
    9101112131415
    16171819202122
    23242526272829
    3031  
  • Visitor

    free counters

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,632 other followers