Ignorance has allowed excessive collection of personal data

I REFER to the news report “Going full force to enforce PDPA” in The Star, Nov 26 which quoted cyber law expert Prof Abu Bakar Munir as saying that the Personal Data Protection Act (PDPA) clearly prohibits the collection of excessive data.

However, do people generally understand what is collection of excessive data?

Do people have a choice to decline providing excessive personal data when held to ransom by service providers who are themselves ignorant of what is legal and allowed under the law?

Aren’t the following tantamount to the collection of excessive data?

> ASKING customers to provide MyKad number, address, other personal details repeatedly although the person is already registered as a customer of the service provider with a unique account ID;

> ASKING customer to provide information on personal interests, hobbies, affiliations of any sort that have no direct relation to the request for services of a service provider; and

> MAKING copies of ID as a condition to visit or access a residential area or office complexes.

These experiences form the perception of the public and the front-line personnel collecting personal data that it is perfectly legal under the PDPA to ask for and keep such information.

We need more public education and awareness in order for data users to comply with the provisions of the PDPA and prevent those not authorised under any law to collect personal data such as security guards manning entry points of residential and office complexes. MUHAMMAD SHA’ANI ABDULLAH Secretary General Malaysian Digital Economy Consumer Association