In 2021, the High Court ("HC") delivered a landmark decision in the case of Genting Malaysia Berhad v Pesuruhjaya Perlindungan Data Peribadi & Ors [2022] 11 MLJ 898 ("Genting"). The case involves a judicial review application by Genting Malaysia Berhad ("GMB") against the Director General of Inland Revenue (DGIR) in respect of the latter's request to access GMB’s database containing personal data of all its loyalty programme members.
The HC ruled in favour of GMB and held that regulatory authorities, such as the Inland Revenue Board ("IRB"), do not have the power to request bulk disclosure of personal data due to the safeguards provided under the Personal Data Protection Act 2010 (PDPA).
The HC also established specific principles governing data disclosure requests made by enforcement and regulatory authorities. For more information about the principles expounded by the HC, please click here to read our Legal Update on the HC's decision.
In April 2024, the Court of Appeal ("COA") overruled the HC's decision on procedural grounds. While the COA is yet to release its full grounds of judgment, IRB has indicated that the COA ruled that GMB was time-barred from initiating the action in the first place due to non-compliance with the timeframe for filing judicial review applications under the Rules of Court 2012.
GMB has since filed an appeal to the Federal Court ("FC") against the COA's decision, and the matter is currently pending before the FC.
