From Brussels: The Islamic Legal Conceptions of Privacy

By: Sonny Zulhuda

IMG_20190130_094243Last week (1st February 2019) I concluded the International Conference on Privacy and Data Protection (CPDP2019) in the heart of Europe, City of Brussels. It is organised by a consortium of primary European universities, supported by global companies, and endorsed by the European Union institutions.

It’s the 12th edition of this annual global event on privacy & data protection. 3 days of fascinating and thought-provoking talks, speeches and discussions. Thank you @CPDPconferences for inviting me as a speaker on privacy in Islam.

Thanks to @darahallinan who initiated this panel for the first time. Entitled “Islamic Legal Conceptions of Privacy.” The idea is to understand how privacy is actually a universal value adopted by wide and global communities and traditions.

Being the first speaker, I first introduced that for every Muslim, Islam is the way of life and provides a comprehensive guidelines for both private and public interactions.

Then I spoke mainly on the evidences from the Quran (as the primary source of Islamic law) which provide basis of privacy right and how to implement it in life, starting from early childhood: they should ask parent’s permission before entering their private rooms at three specific times in a day.

I highlighted how important it is to respect others’ dignity by not transgressing their rights, not spying on them, not backbiting, not ridiculing them, and not calling them by undesired labelling/tagging.

Muslims are told to get mutual consent when affecting others’ rights, to record agreements, to enter their houses upon prior consent, and to leave if asked to. Not less importantly a command to investigate information received (verification and authentication).

Those are exactly the rights pertinent to privacy and data protection nowadays.

At the end, I noted that 1. Islam calls for peace, justice and harmony; 2. Privacy is one of important rights to be preserved; and 3. At all time, Muslims will be accountable to God, Society and oneself.

And not forgetting I also shared some updates on the privacy laws and Personal Data Protection laws in both Indonesia and Malaysia. Some good news here and there.

Thank You Chair, moderator and fellow panelists Prof Andrew Adams (Japan), Prof Elizabeth Coombs (Malta), Nighat Dad (Pakistan), Lahoussine Aniss (Marocco), and Patrick Penninckx (EU) for making it a beautiful panel. Looking forward to connecting further. Thank you @CPDPconferences.

#PrivacyinIslam #CPDP2019 #Brussels #Malaysia #Indonesia #PDPA

Advertisements

Menyoal Tren “10 Years Challenge”

By: Sonny Zulhuda

jpdp

Akhir-akhir ini pengguna media sosial pasti sudah banyak melihat foto-foto transformasi wajah yang dilabel hashtag #10yearschallenge. Tidak kurang, politisi dunia hingga artis dan selebriti pun berpartisipasi dalam trend yang satu ini. Aktivitas ini dimanfaatkan oleh masyarakat media sosial sebagai bahan hiburan dan obrolan yang menarik dan tidak jarang menggelitik.

Namun, mungkin banyak yang sadar bahwa foto-foto yang disebar itu akan memudahkan pihak media sosial atau pihak ketiga untuk melakukan beberapa pekerjaan mereka seperti:

1. Penyempurnaan database wajah individu berikut kronologi tahun dan usia.
2. Penelitian pola transformasi wajah manusia berdasarkan usia, periode, dan demografi lainnya seperti ras, gender, lingkungan, dan lainnya.
3. Pemrograman pada teknologi artificial ingelligence dalam melakukan rekaan wajah secara lebih akurat.
4. Identifikasi dan penyamaran.

Apalagi, dengan label yang sangat indikatif seperti #10yearschallenge akan semakin memudahkan penyaringan dan interpretasi data sehingga memberikan jalan pintas untuk pencarian data itu sendiri. Label hashtag itu sama dengan fungsi metadata. Semakin banyak hashtag, maka akan semakin mudah pencarian data tersebut di domain publik.

Continue reading

From Privacy Suit to EU GDPR: Data Protection Updates from Malaysia – As reported in the Borneo Post

By: Sonny Zulhuda

The beginning of the year saw my interview with the Malaysian daily the Borneo Post that was published on 1st January 2019. This interview was initiated by my colleagues from the consultancy firm Straits Interactive. The report was entitled “Malaysians increasingly aware of risks with data breach.” It can be found in this link.

The article started to to note that Malaysians now are more aware about the risks associated with breaches of their personal data. In fact, we in Malaysia have seen in the past five years, that there is a sharp increase in data privacy civil suits in the local Malaysian courts.

Among the points I highlighted in the interview are as follows:

What are the costs of data breaches?

  • The cost of data breaches can be seen in many areas. In terms of legal liabilities, companies in breach of the Malaysian PDP Act 2010 can be fined up to RM500,000 – for offences such as unlawful sale or unlawful collection of personal data, as well as collection of data without the required certificate of registration.
  • And when a data breach occurs, costs can also be incurred through technical repairs and loss of reputation. Business can also suffer because of bad publicity.
  • Civil suits can also be brought against companies, and these can cost businesses a lot of money. Malaysians are becoming increasingly more aware of the risks associated with breaches of their personal data, and we have seen a sharp increase in data privacy civil suits in the local Malaysian courts in the past five years.

Are we prepared? Here is what I said:

  • Unlike companies in the US and Europe, many companies in the Asean have yet to reach an acceptable level of preparedness. Data protection does not tend to be a part of the business culture, however some industries (banking and finance) are more prepared due to legislation and legal requirements.
  • To bolster the understanding and preparedness of other industries, we need more public awareness, training, and certified professionals in the field of data protection.

What are among the common concerns?

  • One major concern in Malaysia is how much our MyKad (ID cards) details are easily and unnecessarily exposed. Many people needlessly impose the collection or retention of MyKad details before people start business communication or interactions, enter premises, or participate in events. Unfortunately, lots of people are happy to submit these details and this gives the impression that these practices are approved and not an issue.
  • Another problem is direct marketing, as well as unsolicited commercial calls, emails and text messages. While it’s clear individuals have the right to refuse direct marketing, it still regularly happens.

What has been prepared?

  • I highlighted that leading consultant like Straits Interactive plays the role to champion a public-private partnership by establishing alliance with academia, industries and the government. This partnership will ensure Malaysia as a nation moves together and responds to data privacy issues with a common understanding and comprehensive programmes.

Does the European Union GDPR (General Data Protection Regulations) have anything to do with the Malaysians?

  • With the passing and enforcement of the EU General Data Protection Regulation (GDPR) in May 2018, Malaysia needs to gear up for these stronger laws and better enforcement.
  • The GDPR applies to companies who also interact with European citizens, and this requires short-term training programmes and certifications in the field of data protection.
  • A collaboration at the regional level is also timely and necessary. We are heading towards that.

Credit on this Interview to the Straits Interactive and the Borneo Post.

“Right to be Forgotten” in Indonesian Data Protection Law (A Focus Group Discussion with BINUS University)

By: Sonny Zulhuda

This report is based on what has been written on BINUS Website in the original Indonesian version. The Focus Group Discussion took place on 11th August 2018 in Kuala Lumpur. The participants were Prof. Dr. Shidarta, Prof. Dr. Bambang Pratama, and Reinhard Christian Surya from BINUS Law School, Jakarta and myself. The main topic was on the the right to be forgotten.

I reckoned in that meeting that the regulation on right to be forgotten as introduced in the latest 2016 amendment to the Indonesian e-transactions laws (namely UU ITE in Indonesian) was a drastic development bearing in mind that there is still no comprehensive legislation in Indonesia dealing with the protection of personal data which is now increasingly becoming a new global norm. In my view, Indonesia should first settle with the currently ongoing debate on the draft bill of the Personal Data Protection law.

Right to be forgotten is indeed a sub-set of many rights relating to personal data processing of an individuals. In many laws, this right to be forgotten is interchangeably discussed with the right to data deletion.

fgd binus 2018

In Malaysia this right is impliedly given because it mandates every data user (those who process personal data of individuals) to ensure data are deleted when they are no longer necessarily required. Similar provisions can be found in the laws of other countries such as UK, Hong Kong and Singapore. In Indonesia, there is still no law (Undang-undang) which defines and lays down similar requirements.

In its Indonesian report, the Website continues to note: Continue reading

“Can my lecturer access my personal information?” – And Other Issues of Data Protection at the Higher Learning Institutions 

By: Sonny Zulhuda 

In the past week alone, I spoke about the personal data protection law at two Malaysian public universities; Universiti Sultan Zainal Abidin (UniSZA) Kuala Terengganu and Universiti Malaysia Pahang (UMP) Pekan. While the former was an internal programme, the latter talk was attended by other public universities’representatives who were members of Majlis Tatatertib dan Disiplin Universiti-universiti Awam Malaysia (MATDUM).

In this post, I would like to note some discussions we had on the implementation of the Personal Data Protection Act 2010 at the University environment.

IMG_20170319_095449

The education industry is indeed among those where personal information is highly processed. The data subjects include students (prospective, actual and graduates), university’s employees, as well as any individuals involved in the data processing.

Continue reading

Developing Privacy-Friendly Mobile Apps: Takeaways for Mobile Developers

By: Sonny Zulhuda

Image credit: computerworld.com

Image credit: computerworld.com (click on the image for full display)

This week (28th Aug) I will be participating in a national event dedicated for the modern digital lifestyle in Malaysia, named KL CONVERGE! which runs from 27th-29th August 2015 at Kuala Lumpur Convention Centre (KLCC) in the heart of the Malaysia’s capital. Visit the site here: http://www.klconverge.my/.

As the site highlights, KL CONVERGE! is a multi-platform digital content and creative industry event showcasing the world’s latest achievements and opportunities in the music, film, gaming and Internet space. It seeks to provide an immersive experience to show “how technology and content is an everyday part of our lives.” The event is bringing together leading industry executives from multimedia, applications, Internet and creative content to discuss, deliberate, showcase and celebrate the issues, opportunities and successes in digital space.

I have a honour to be part of the event to speak about key privacy issues for mobile apps developers – thanks to my friends and partners at the Data Protection Academy (DPA) LLP (Noris and Eddie). The discussion will reflect the new legal landscape brought about by the Personal Data Protection Act 2010 that concern mobile apps designers and developers. It’s this Friday, 28th August 2015 at 4.00PM (not one of the best time to listen a talk – sigh) at Room 306 KLCC Convention Hall. It is adjacent to the majestic Petronas twin tower, and it is a free admission event 😉 (ugh.. still..) (*_*)

In the one-hour talk, I will demonstrate the salient features of the data privacy laws in Malaysia and the emerging global trend, especially concerning the users/consumers of mobile apps. Issues such as data collection, notification and retention will be touched. Not less importantly will be the issue of personal data security that each mobile apps developer will have to consider when they decide to retain users’ personally identifiable information (PII). But on top of all those, I am posing a big question: “Should you ever collect the users’ personal information at all?” — I am at the moment finalising my presentation and will share here the key points in due course. See you there, if you make it:)

The Problems with IoT (Internet of Things)

By: Sonny Zulhuda

Today I will be speaking at the IT Governance, Assurance and Security Conference 2015, held annually by ISACA Malaysia and the Malaysian National Computer Confederation (MNCC). In the slotted debate panel, I will be speaking about the problems and challenges brought about the Internet of Things (IoT) vis a vis individuals’ privacy. My debate counterpart will be Mr. Hizamuddin from MDEC.

Here are some details:

Debate ISACA

And here is for the event link:

http://www.isaca.org/chapters3/Malaysia/Documents/IT%20GOV%202015.pdf

The summary of my points are aa follows:

=== IoT vs Privacy ===

1. IoT is conceptually flawed/problematic because it equates human and other objects (“things”)

* Under EU Data protection law, there is a legal rule protecting individuals against data automated processes

* IoT, like any other innovations, is wrongly perceived as technical matters, not really human affairs

* Privacy is a fundamental need, its protection cannot be sidelined, reduced or outsourced to others (including things)

2. Businesses looking for a quick RoI, invested only on technical requirements, not on the prerequisite culture

3. Those countries who introduce IoT (US, EU, Japan, Korea) are already equipped with a strong privacy laws, unlike Malaysia where the law is in the making at initial stage.

  • September 2019
    M T W T F S S
    « Aug    
     1
    2345678
    9101112131415
    16171819202122
    23242526272829
    30  
  • Visitor

    free counters

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,630 other followers