‘Advisable for management bodies of high-rise residences to abide by act’

Siti: Residents can still sue under tort due to defamation as a result of their details being leaked.

EXPERTS are conflicted on whether the Personal Data Protection Act 2010 (PDPA) binds management bodies of high-rises from disclosing details about residents who contracted Covid-19.

Following a StarMetro report on Feb 24 on the privacy aspect of such residents, several quarters said it was unclear if the PDPA was applicable.

All of them, however, discouraged disclosure of such information.

National House Buyers Association honorary secretary-general Datuk Chang Kim Loong said the PDPA made no mention of joint management bodies (JMBs) and management corporations (MCs).

“PDPA only applies to the processing of personal data with regards to commercial transactions, which may include goods, services, investments, financing, banking and insurance.

“JMBs and MCs are non-profit organisations that do not conduct commercial activities, ” he said, adding that they should still refrain from disclosing details of Covid-19 positive residents to avoid them being stigmatised.

Petaling Jaya city councillor Derek Fernandez said the definition of “commercial transactions” contained in the act covered a wide variety of activities, which could include those carried out by management bodies.

“One of the things covered under it is the provision of service.

“Since JMBs and MCs collect a monthly maintenance fee to service the building, it could be argued that they are involved in a commercial transaction and therefore covered by PDPA.

“This matter needs to be clarified by the government, ” he said.

Bar Council Intellectual Property Committee co-chairperson Foong Cheng Leong said it was unclear if management bodies were involved in the processing of personal data for commercial purposes.

“There are different views to this. Nevertheless, there is no blanket exemption for JMBs and MCs.

“In light of this uncertainty, it’s advisable for them to comply with the PDPA.

“In any event, disclosure of information of residents with Covid-19 is highly discouraged as it could breach the PDPA and even amount to an invasion of privacy, ” he said.

When contacted, human rights lawyer Siti Kasim said PDPA only applied if management bodies collected residents’ data for commercial transactions.

“If they’re not collecting data for commercial purposes, then PDPA does not apply.

“However, the residents can still sue them under tort due to defamation as a result of their details being leaked, ” she said.

The Housing and Local Government Ministry, in a statement to StarMetro, said JMBs and MCs were bound by the PDPA not to disclose the identity of Covid-19-positive residents.

“It will suffice for them to inform residents of only the blocks where Covid-19 cases were confirmed.

“This is to ensure that residents remain vigilant against transmission of the virus, ” it said.