Malaysia legislation
Section 129
Section 129
(2)
For the purposes of subsection (1), the Minister may specify any place outside Malaysia if—
(a)
there is in that place in force any law which is substantially similar to this Act, or that serves the same purposes as this Act; or
(b)
that place ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection afforded by this Act.
(3)
Notwithstanding subsection (1), a data user may transfer any personal data to a place outside Malaysia if—
(a)
the data subject has given his consent to the transfer;
(b)
the transfer is necessary for the performance of a contract between the data subject and the data user;
(c)
the transfer is necessary for the conclusion or performance of a contract between the data user and a third party which—
(i)
is entered into at the request of the data subject;
or
(ii)
is in the interests of the data subject;
(d)
the transfer is for the purpose of any legal proceedings or for the purpose of obtaining legal advice or for establishing, exercising or defending legal rights;
Personal Data Protection 89
(e)
the data user has reasonable grounds for believing that in all circumstances of the case—
(i)
the transfer is for the avoidance or mitigation of adverse action against the data subject;
(ii)
it is not practicable to obtain the consent in writing of the data subject to that transfer; and
(iii)
if it was practicable to obtain such consent, the data subject would have given his consent;
(f)
the data user has taken all reasonable precautions and exercised all due diligence to ensure that the personal data will not in that place be processed in any manner which, if that place is Malaysia, would be a contravention of this Act;
(g)
the transfer is necessary in order to protect the vital interests of the data subject; or
(h)
the transfer is necessary as being in the public interest in circumstances as determined by the Minister.
(4)
Where the Commissioner has reasonable grounds for believing that in a place as specified under subsection (1) there is no longer in force any law which is substantially similar to this Act, or that serves the same purposes as this Act—
(a)
the Commissioner shall make such recommendations to the Minister who shall, either by cancelling or amending the notification made under subsection (1), cause that place to cease to be a place to which personal data may be transferred under this section; and
(b)
the data user shall cease to transfer any personal data of a data subject to such place with effect from the time as specified by the Minister in the notification.
(5)
A data user who contravenes subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding three hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
Act 709
(6)
For the purposes of this section, “adverse action”, in relation to a data subject, means any action that may adversely affect the data subject’s rights, benefits, privileges, obligations or interests.
Unlawful collecting, etc., of personal data