Determining the Extent of the Inland Revenue Board’s Powers to Request for Disclosure of Personal Information: Genting Malaysia Berhad v Personal Data Protection Commissioner & Ors.

The recent case of Genting Malaysia Berhad v Personal Data Protection Commissioner & Ors is significant as it is the first time the Malaysian courts heard a challenge to the powers of the Director General of the Inland Revenue Board ("DGIR") to request for disclosure of personal data under the Income Tax Act 1967 ("ITA"). Here, one of the grounds of the challenge was based on the protection afforded under the Personal Data Protection Act 2010 ("PDPA").

The High Court ruled in favour of Genting Malaysia Berhad ("GMB") and held that the PDPA does not allow the DGIR to make blanket requests for access to personal data of all GMB’s customers, based on the following reasons:

1. The blanket demand made by the DGIR is an infringement of the right to life and personal liberty under Article 5(1) of the Federal Constitution, which guarantees the fundamental liberties of every person including the right to privacy.
2. The DGIR cannot use the ITA as an instrument of fraud to conduct "fishing expeditions" to gain bulk access to the personal data of GMB’s customers.
3. The exemptions under Section 39 and 45 of the PDPA cannot be relied upon by the DGIR, but may be relied upon by the data user (i.e. GMB).
4. To the extent of any conflict between the ITA and the PDPA, the PDPA shall prevail as it is a specific and more recent legislation enacted for the protection of personal data.
5. Notwithstanding Section 3(1) of the PDPA, which exempts the Federal Government and the State Government from the PDPA, regulatory authorities that are statutorily incorporated body corporates (e.g. the Inland Revenue Board) are still bound by the PDPA.

For more information, click here to read our Legal Update.