Ransomware Attack: How a PDP law compliance can be of any help

By: Sonny Zulhuda

Ransomware

No! We are not talking about how to cure a ransomware attack such as “WannaCry” after it happens. That is not going to happen. Legal compliance is, from the perspective of business continuity and data disaster management, always at the “preventive” side rather than “curative” or “recovery” domain. Just like how technically a data backup is more preventive rather than reactive.

Then, are we saying that complying with Personal Data Protection law is going to prevent incidents like ransomware attack? Not necessarily true. But obviously, by keeping yourself updated about legal requirements pertaining to personal data protection, you will activate a “standby” mode.

Complying with the legal requirements on data protection such as Data Security and Data Retention standards, for example, people in your organisation are made aware that some security measures had to be put in place to protect the personal data system, which often overlaps with other database or information systems in your organisation: payroll system, human resources system, financial system, CRM system, and so on, because in each of those there are personal data of data subjects that you or your organisation process/processes.

That is why, a compliance with PDP law such as the Malaysian Personal Data Protection Act 2010, can be a gateway to better data protection in your organisation from unwanted attacks or other risks to the data integrity and security. In fact, the PDPA 2010 hints that a data due diligence

In fact, the PDPA 2010 hints that a data due diligence such as your data risk management that you conduct in your organisation will not only mitigate the risk to data attack but also will be your “legal defence” in case such attack takes place despite your mitigating measures. This is what transpires from the provisions of the PDPA 2010.

So, the equation is not complicated:

Data due diligence = legal compliance + risk management = legal defence

Good luck! 🙂

Advertisements

Readings on SOSMA 2012 and the Electronic Monitoring Devices

By: Sonny Zulhuda

emd-sample-ag-250813

Electronic tagging is a form of surveillance which uses an electronic device (a tag) fitted to the person. It is commonly used as a form of electronically monitored punishment for people who have been sentenced to electronic monitoring by a court, or required to wear a tag upon release from prison. The use of electronic monitoring devices in Malaysia has been first introduced by the  Security Offences (Special Measures) Act 2012 (SOSMA) (Act 747). This article sourced few online reading materials relating to the use of electronic monitoring devices vis a vis the SOSMA. Therefore the similar concerns under the new amendment to the Criminal Procedure Code (CPC) 2012 are beyond the ambit of this survey.

In December 2015, Bernama reported that more than 200 people detained under the Prevention of Crime Act (POCA) have been strapped with an electronic monitoring device (EMD), quoting the Federal CID director, Datuk Seri Mohmad Salleh as saying. Salleh added that this effort was taken to monitor the movements of those people (apparently upon release – added), as well as to test the effectiveness of the device. Based on the similar report by Datuk Nur Jazlan Mohamed, the Home Deputy Minister, those who were detained under POCA include mainly those involved in gangsterism, violent crimes, property crimes as well as drug-related crimes. The report can be read here.

A similar provision on the use of EMD is also found in the Security Offences (Special Measures) Act 2012 (SOSMA). In section 7(1), the SOSMA provides for special procedures relating to the electronic monitoring device. It prescribes that, upon application by the Public Prosecutor under section 4 (which provides for the arrest and detention of a person believed to be involved in security offences), the Court shall order the person to be attached with an electronic monitoring device for a period as the Court may determine but which shall not exceed the remainder of the period of detention allowed under subsection 4(5) for purposes of investigation. Section 4(5) of SOSMA grants the maximum of extension to 28 days after the initial 24 hours of detention for the purpose of investigation.

Continue reading

  • October 2017
    M T W T F S S
    « Jul    
     1
    2345678
    9101112131415
    16171819202122
    23242526272829
    3031  
  • Visitor

    free counters

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,574 other followers