Searching Case Laws & Precedent on Legal Query.....!
Analysing the retrieved Case Laws
Scanned Judgements…!
Searching Case Laws & Precedent on Legal Query.....!
Analysing the retrieved Case Laws
Scanned Judgements…!
Exception to Personal Data Protection - Legal exceptions primarily arise when disclosure is authorized by law or court order, or when processing is necessary for specific legal purposes. For example, the Personal Data Protection Act 2010 (PDPA 2010) allows disclosure under court orders or legal obligations, such as in cases of court directives or statutory provisions ["GENTING MALAYSIA BERHAD vs DIRECTOR GENERAL OF INLAND REVENUE (LHDN) - Federal Court"] ["GENTING MALAYSIA BERHAD vs DIRECTOR GENERAL OF INLAND REVENUE (LHDN) - Federal Court"].
Legal Frameworks and Specific Exceptions - The PDPA 2010 explicitly permits the disclosure of personal data without consent in certain circumstances, notably when ordered by courts or when necessary for legal proceedings, as demonstrated by the court's authority to direct data disclosure ["Teng Kek Peng dan satu lagi lwn vs Maxis Berhad dan lain-lain"]. Similarly, the Indian Digital Personal Data Protection Act, 2023 (DPDP Act), provides exemptions where processing is required by law or for public interest, such as protecting decency or national security ["KARTHICK THEODRE vs THE REGISTRAR GENERAL - Madras"] ["Karthick Theodore VS Registrar General Madras High Court - Madras"].
Data Disclosure for Law Enforcement and Legal Proceedings - Courts and government agencies can lawfully access personal data without breaching data protection laws if such access is mandated by law or court order. For instance, the Indian courts recognize the necessity of balancing privacy rights with public accountability, allowing access to personal data of public servants when justified by public interest ["VIJAY PRAKASH vs UOI AND ORS - Delhi"], ["VIJAY PRAKASH vs UOI AND ORS - Delhi"]. Similarly, the Malaysian courts have upheld disclosures under legal orders, such as court directives or statutory obligations ["GENTING MALAYSIA BERHAD vs DIRECTOR GENERAL OF INLAND REVENUE (LHDN) - Federal Court"].
Privacy Rights vs. Public Interest - While privacy is protected, it is not absolute; courts often balance individual privacy against the public interest or transparency needs. For example, disclosures about public servants' personal data may be permitted if it serves the public interest or accountability, with restrictions in place to prevent unnecessary invasion of privacy ["VIJAY PRAKASH vs UOI AND ORS - Delhi"], ["RAJINDER JAINA VS CENTRAL INFORMATION COMMISSION - Delhi"].
International and Digital Contexts - In digital environments, exceptions to data protection include circumstances where processing is necessary for legal compliance or national security. The US courts, for example, have recognized that border searches of digital devices can be conducted under the border exception, though they involve significant privacy considerations ["United States vs Hamza Kolsuz - Fourth Circuit"], ["United States vs Hamza Kolsuz - Fourth Circuit"].
Analysis and Conclusion:Exceptions to personal data protection laws are primarily rooted in compliance with legal obligations, court orders, or public interest considerations. These exceptions are explicitly recognized in statutes like the PDPA 2010 and the DPDP Act 2023, which allow for disclosure when mandated by law or necessary for legal proceedings. Courts generally balance individual privacy rights against transparency, accountability, and security needs, especially in contexts involving public officials or national security. Digital searches, such as border searches of devices, are also exceptions but are subject to heightened privacy concerns and legal standards. Overall, lawful exceptions serve to reconcile privacy rights with the need for legal compliance and public interest, provided they are exercised within the boundaries set by law and judicial oversight.
In today's digital economy, protecting personal data is crucial for businesses and individuals alike. But what happens when data is tied to a commercial transaction? Under Malaysia's Personal Data Protection Act 2010 (PDPA), there are specific exceptions that allow processing or disclosure without consent. If you're wondering about the exception to Personal Data protection, this post breaks it down based on key court findings and legal principles.
We'll explore the main legal finding, court interpretations, and practical implications, drawing from authoritative sources. Note: This is general information and not specific legal advice. Consult a qualified lawyer for your situation.
The PDPA regulates the processing of personal data in commercial transactions within Malaysia. Personal data is defined broadly but its protection hinges on context. Generally, PDPA safeguards data by requiring consent, but exceptions exist.
The primary exception arises when the data pertains to a commercial transaction. In such cases, personal data may be processed or disclosed without the individual's consent, provided the data relates directly to a commercial activity and other statutory requirements are met. KETUA PENGARAH HASIL DALAM NEGERI vs GENTING MALAYSIA BERHAD - 2025 MarsdenLR 3417TAN KOK PIN vs LOH CHUN HOO & ORS - 2022 MarsdenLR 1696
This carve-out recognizes that commercial dealings inherently involve data sharing, balancing privacy with business needs.
Court documents emphasize that personal data is protected under PDPA unless it involves a commercial transaction. KETUA PENGARAH HASIL DALAM NEGERI vs GENTING MALAYSIA BERHAD - 2025 MarsdenLR 3417TAN KOK PIN vs LOH CHUN HOO & ORS - 2022 MarsdenLR 1696. Data unrelated to commerce—such as personal interests, habits, family records, or medical data—falls outside PDPA's scope.
The data and/or information would only be considered as personal data protectable by PDPA if it involves any transaction of commercial nature. TAN KOK PIN vs LOH CHUN HOO & ORS - 2022 MarsdenLR 1696
Even sensitive information isn't protected if non-commercial: if the data and/or information does not relate to any commercial transaction, no matter how detailed or confidential the data and/or information is, such data could not be classified as personal data under PDPA. TAN KOK PIN vs LOH CHUN HOO & ORS - 2022 MarsdenLR 1696
Protection is contingent upon its connection to a commercial transaction. Courts stress commercial transaction repeatedly, limiting PDPA to business-related data. TAN KOK PIN vs LOH CHUN HOO & ORS - 2022 MarsdenLR 1696
Purely personal info like medical records or hobbies isn't PDPA-protected unless linked to commerce. This narrower scope prioritizes transactional efficiency over blanket privacy.
In one case, a court granted relief tied to commercial elements, underscoring PDPA's focus. KETUA PENGARAH HASIL DALAM NEGERI vs GENTING MALAYSIA BERHAD - 2025 MarsdenLR 3417. Entities must assess: Is the data purely personal or transaction-linked?
While PDPA is Malaysian-specific, global principles echo its commercial focus. In India, consumer protection cases highlight transaction nature over entity status:
Primary determinant for categorizing an entity as a ‘consumer’ is nature of transaction rather than identity or status of entity itself—If a transaction involves purchase... for personal use... (Consumer Protection Act context). Idmc Ltd. VS Ernst & Young Llp
Commercial services for profitability exclude consumer remedies, mirroring PDPA's non-protection of non-commercial data. M/s IDMC LTD. vs M/S ERNST & YOUNG LLP - 2025 Supreme(Online)(NCDRC) 2902INDNCDRC00000007361
Privacy jurisprudence reinforces limits. India's Supreme Court in privacy rulings notes:
Right to privacy – Any intrusion into privacy of a person – Must be backed by a valid law, having a legitimate aim and should be proportionate... (Aadhaar case). Justice K. S. Puttaswamy (Retd. ) VS Union of India - 2018 7 Supreme 129
Commercial necessities often justify processing, akin to PDPA exceptions. RTI Act discussions balance disclosure:
One’s right to information and other’s right to privacy and confidentiality - Both must be harmonized. Central Public Information Officer, Supreme Court of India VS Subhash Chandra Agarwal - 2019 Supreme(SC) 1256
These align with PDPA's transaction-based carve-out, emphasizing proportionality in commercial spheres.
Data protection regimes globally, like EU GDPR, allow exceptions for legitimate interests (e.g., contracts), paralleling PDPA. Central Public Information Officer, Supreme Court of India VS Subhash Chandra Agarwal - 2019 Supreme(SC) 1256
PDPA doesn't list broad exceptions beyond commerce; the transaction's nature is key. No consent needed for direct commercial data, but comply with other laws (e.g., confidentiality contracts). Idmc Ltd. VS Ernst & Young Llp
To navigate PDPA:
Businesses in consultancy or services should note: Breach claims may fail if non-consumer/commercial. M/s IDMC LTD. vs M/S ERNST & YOUNG LLP - 2025 Supreme(Online)(NCDRC) 2902
The standout exception to Personal Data protection under PDPA is non-commercial data, which escapes regulation entirely. Commercial transaction data enjoys processing freedom without consent, promoting business fluidity while protecting privacy elsewhere. KETUA PENGARAH HASIL DALAM NEGERI vs GENTING MALAYSIA BERHAD - 2025 MarsdenLR 3417TAN KOK PIN vs LOH CHUN HOO & ORS - 2022 MarsdenLR 1696
Key Takeaways:- PDPA protects only commercial-linked personal data.- Non-commercial info (e.g., medical, family) is unprotected, regardless of sensitivity.- Always evaluate transaction nature for compliance.- Broader privacy rights persist beyond PDPA.
In summary, the primary exception to personal data protection under PDPA is when the data is not connected to a commercial transaction. TAN KOK PIN vs LOH CHUN HOO & ORS - 2022 MarsdenLR 1696
For tailored advice, reach out to legal experts. Stay compliant and privacy-savvy!
References:1. KETUA PENGARAH HASIL DALAM NEGERI vs GENTING MALAYSIA BERHAD - 2025 MarsdenLR 3417: Judicial review on PDPA-commercial links.2. TAN KOK PIN vs LOH CHUN HOO & ORS - 2022 MarsdenLR 1696: Scope of personal data in PDPA.
#PDPA #DataProtection #PrivacyLaw
Personal Data Protection Act 2010 (" Court against three Respondents, namely Personal Data Protection Commissioner (1st Respondent), Personal Data Protection Deputy Commissioner (2nd Respondent) and the Director General of Inland ... The JR also prayed for several declarations against the DGIR, among others, that the request for information under s 81 of ITA 1967 was in breach of the personal data....
Personal Data Protection Act 2010 (" PDPA 2010") whereas the DGIR was of the view that such request was legally made under s 81 of Income Tax Act 1967 (" a href="./.. ... The DGIR then wrote to the Department of Personal Data Protection ("DPDP") for confirmation relating to the request for information. On 8 November 2019, the 2nd Respondent confirmed that such disclosure of information was allowable under s 39(b)(ii) of a href="./.. ... [3] The dispute which led to the JR began in 2....
The Digital Personal Data Protection Act, 2023 (in short ‘DPDP Act’) has received the assent of the President on 11.08.2023. ... The Data Fiduciary is expected to publish the contact information of a Data Protection Officer who would be liasoning with the Data Principal in regard to the processing of the personal data. ... Section 3(c) expressly states that the Data Protection Act shall not apply ....
SUMMARY OF THE DIGITAL PERSONAL DATA PROTECTION ACT 2023 25. The Digital Personal Data Protection Act, 2023 (in short ‘DPDP Act’) has received the assent of the President on 11.08.2023. ... The Data Fiduciary is expected to publish the contact information of a Data Protection Officer who would be liasoning with the Data Principal in regard to the processing of the personal data.....
Certain conflicts may arise in particular cases of access to information and the protection of personal data, stemming from the fact that both rights cannot be exercised absolutely. ... The second class of information with state or its agencies, is personal data of both citizens and artificial or juristic entities, like corporations. Individuals’ personal data is protected by the laws of access to confidentiality and by privacy rights. ... In India, there is n....
If public access to the personal data containing details, like photographs of public servants, personal particulars such as their dates of birth, personal identification numbers, or other personal information furnished ... Thus when a member of the public requests personal information about a public servant, - such as asset declarations made by him- a distinction must be made between the personal data inherent to the position and thos....
If public access to the personal data containing details, like photographs of public servants, personal particulars such as their dates of birth, personal identification numbers, or other personal information furnished to public agencies, is requested, the balancing exercise, necessarily dependant and ... Thus when a member of the public requests personal information about a public servant, - such as asset declarations made by him- a distinction must be made between the perso....
protection and represents a complete abdication of the OPs’ obligation to ensure data protection and maintain confidentiality as contractually agreed. ... Clause 26 of the engagement letter dated 28.08.2014 expressly provides that the use of electronic media for the transmission of data shall be an exception to the confidentiality obligation under the Agreement. ... These, inter-alia, enumerated the terms and conditions regarding mutual relationship and responsibilities of the contracting parties and te....
Section 2 9 of the T&C, that OPs shall process personal data forming part of the information shared by the complainant as per the applicable law and professional regulations. ... These, inter-alia, enumerated the terms and conditions regarding mutual relationship and responsibilities of the contracting parties and terms related to confidentiality and data protection. It was agreed with reference to a href="./..
Section 2 9 of the T&C, that OPs shall process personal data forming part of the information shared by the complainant as per the applicable law and professional regulations. ... These, inter-alia, enumerated the terms and conditions regarding mutual relationship and responsibilities of the contracting parties and terms related to confidentiality and data protection. It was agreed with reference to a href="./..
'We process your personal data on the ground that such processing is necessary to further our legitimate interests (including: (1) providing effective and innovative Services to our users; and (2) to detect, prevent or otherwise address fraud or security issues in respect of our provision of Services), unless those interests are overridden by your interest or fundamental rights and freedoms that require protections of personal data.' As per clause 2 of the Privacy Policy, processing of personal data is done unless the user's overriding interest is to be protected or the fundamental....
Similarly, in the context of the European Union, opinions of ‘the Article 255 Panel’ Courts from the jurisdiction have interpreted the term “personal data” broadly to even include information relating to the professional life of an individual. The data protection regime in the European Union regards information such as the name and surname, home address, location data, data held by a hospital or doctor and identification card number of an individual as personal data. 91. Article 4(1) of the EU General Data Protection Regulation (GDPR) defines personal data in similar terms:....
There are numerous case laws – both American and European – presented by the petitioners and the respondents with respect to the collection, storage and use of biometric data which have been taken note of above. These include balance against other fundamental rights, legitimate national security interest, public interest including scientific or historical research purposes or statistical purposes, criminal offences, tax purposes, etc. 172. S.K. Kaul, J. cited the European Union General Data Protection Regulations [Regulation (EU) 2016/679 of the European Parliament and of the Coun....
1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. In Florida v Jardines (569 US 1 (2013) ....
Thus, one of the cardinal principles of privacy protection is that personal information acquired for one purpose should not be used for another purpose without the consent of the individual to whom the information pertains. The philosophy underlying the privacy protection concern links personal autonomy to the control of data concerning oneself and suggests that the modern acceleration of personal data collection, especially by government agencies, carries with it a potential threat to a valued and fundamental aspect of our traditional freedoms.
An indispensable Tool for Legal Professionals, Endorsed by Various High Court and Judicial Officers
Please visit our Training & Support
Center or Contact Us for assistance
Scan Me!
India’s Legal research and Law Firm App, Download now!
For Daily Legal Updates, Join us on :
Back to top
