THE Malaysian Digital Economy Consumers Association (myDigitalConsumer) has called for stronger personal data protection laws following the alleged disclosure of a telephone bill that belongs to social media entrepreneur Khairul Aming.
The case, which is currently under investigation, involves the reported disclosure of Khairul Aming’s telephone billing records.
While authorities have yet to determine how the information was accessed or released, the incident has reignited concerns over how sensitive personal data is protected and who can gain access to it.
According to myDigitalConsumer, the incident should not be viewed in isolation. Rather, it highlights the broader risks posed by unauthorised access to telecommunications records, identity information, financial data and government-held records.
The association noted that Malaysians routinely use their MyKad number as the primary identifier for government and private sector services.
If such information is inadequately protected, individuals with unauthorised access may be able to piece together sensitive personal information from multiple sources, increasing the risk of identity theft, financial fraud, impersonation and other forms of cybercrime.
It also expressed concern over the increasingly common practice of security personnel at gated communities, commercial buildings and private premises photographing visitors’ MyKad or driving licences during registration.
“A photograph of a MyKad or driving licence contains substantially more personal information than is ordinarily necessary for visitor management,” the association said.
“Consumers are often left unaware of where these images are stored, how long they are retained, who has access to them, whether they are adequately secured or whether they may later be disclosed, copied or misused.”
The association said such practices appear inconsistent with internationally recognised data protection principles, including purpose limitation, data minimisation, security, retention limitation and accountability.
It also urged the government to review Section 3 of the Personal Data Protection Act 2010 (PDPA), which exempts the Federal and State Governments from the Act.
According to myDigitalConsumer, consumers should not receive different levels of protection simply because their personal data is held by a government agency rather than a private organisation.
While acknowledging that Malaysia need not replicate the European Union’s General Data Protection Regulation (GDPR) in its entirety, the association said the country should adopt internationally recognised best practices to ensure consistent protection of personal data across both the public and private sectors.
Among its recommendations are extending statutory data protection obligations to government agencies, introducing national guidelines to prohibit unnecessary photographing of MyKad and driving licences during routine visitor registration, strengthening identity verification procedures before customer information is disclosed, and imposing tougher enforcement against organisations or individuals responsible for unauthorised access, disclosure or misuse of personal data.
The association also called for a whole-of-government personal data governance framework aligned with international privacy standards.
Consumers, meanwhile, should safeguard their MyKad number and identity documents, avoid allowing unnecessary photographs or copies of their identification, ask organisations why personal data is being collected and how it will be protected, report suspected misuse to the relevant authorities, and regularly monitor their financial and telecommunications accounts for suspicious activity.
“Trust is the foundation of Malaysia’s digital economy,” the association said.
“Every personal data incident weakens public confidence in digital services and increases consumers’ exposure to fraud, identity theft and cyber-enabled crime.”
It added that Malaysia’s ambition to become a trusted digital nation depends on a modern, comprehensive and consistently applied personal data protection framework that protects individuals regardless of whether their data is held by public or private entities. ‒ July 21, 2026
Main image: Amanz
