What is MySejahtera?
MySejahtera is an application developed by the Government of Malaysia to assist in managing the COVID-19 outbreaks in the country. It allows users to perform health self-assessment on themselves and their families. The users can also monitor their health progress throughout the COVID-19 outbreak. In addition, MySejahtera enables the Ministry of Health (MOH) to monitor users’ health condition and take immediate actions in providing the treatments required. MySejahtera is developed through strategic cooperation between the National Security Council (NSC), the Ministry of Health (MOH), the Malaysian Administrative Modernisation and Management Planning Unit (MAMPU) and Malaysian Communications and Multimedia Commission (MCMC).
On 3rd August 2020, The Malaysian government has decided to mandate the use of contact tracing app MySejahtera in all premises.
What are the laws related to the implementation of MySejahtera?
MySejahtera was developed to support the implementation of the Prevention and Control of Infectious Diseases Act 1988 [Act 342]. Providing false information is an offence under Section 22 of the Prevention and Control of Infectious Diseases Act 1988 [Act 342] and Section 233 of the Communication and Multimedia Act 1998 [Act 588].
The roles of the laws and MySejahtera on this Pandemic
We are now facing a global pandemic in the form of COVID-19, a new viral respiratory disease caused by a new strain of Coronavirus. Whilst the virulent nature of COVID-19 is alarming, unnecessary panic and selfish behaviour such as hoarding supplies can and will cause more harm than the disease itself.
MySejahtera is governed under the Prevention and Control of Infectious Diseases Act 1988 (Act 342), which is an act that allows for actions under government agencies to execute certain things when fighting epidemics and pandemics. Thus, the data comes under tighter control than the regular Personal Data Protection Act 2010 (Act 709) (PDPA).
The Prevention and Control of Infectious Diseases Act 1988 may provide some assistance. This is an act intended to govern the prevention and control of infectious disease. Infectious disease means any disease specified in Part II of the First Schedule of the Act. Obviously, COVID-19 is not listed therein. However, this new disease could fall under the category of “any other life-threatening microbial infection” under the said schedule.
Any person who disobeys any lawful order, directions or restrictions imposed by any authorised officer or has breached any rules or regulations made under the Control of Prevention and Control of Infectious Diseases Act 1988 commits an offence under of the said act.
The persons who commit such offences under the Act shall be liable to the Penalties under Section 24 and Section 25 of this Act as follows: –
1st offence – imprisonment term not exceeding 2 years, or fine, or both;
2nd or subsequent offence – imprisonment not exceeding 5 years, or fine, or both;
Continuing offence – a further fine not exceeding RM200 every day which such offence continues.
Director-General or any public officer authorized for this purpose may compound any offence under this Act, which has been prescribed by regulations as compoundable, by collecting from offender a sum of money not exceeding RM1,000.
Even looking at the scheme of the Act, it is clear that there is first and foremost, a duty on each and every individual to do their own part in the battle against such pandemic.
A check on MySejahtera’s privacy policy shows that the app will not record users’ personal data except when it is voluntarily given and with their permission. The policy also states that personal data collected will be used for no purpose other than those related to managing Covid-19, unless it is required to comply with a legal obligation. In addition, it emphasises that personal data collected by the app is not to be disclosed to any third party or transferred to a place outside of Malaysia for commercial purposes.
In terms of data confidentiality, personal data collected by the app will be kept confidential in accordance with the privacy policy, pursuant to any applicable laws that may take effect from time to time. User data for “check-in” is stored for a period of 90 days and purged thereafter.
The privacy policy further states that the app implements security features that adhere to global standards to protect the confidentiality and security of user information. Data in transit is encrypted, while data at rest is stored in a highly secure server.