Malaysia must adopt greater clarity and transparency in the way it collects Mobile Phone Data (MPD) from the public, says Fong Choong Fook, Chairman of LGMS and one of the region’s foremost cybersecurity experts.
In a statement shared with SoyaCincau.com, Fong expressed support for the government’s broader digitalisation efforts, but raised red flags over the lack of public consultation and insufficient technical clarity surrounding the mobile data collection exercise.
He said the Malaysian public deserves to know how their data is being used and there does not appear to be any evidence of public consultation prior to the Mobile Phone Data initiative.
Referring to MCMC’s purported directive which demanded telcos to submit anonymised user data for national statistics, Fong said, “It is imperative that public consultation, transparency and independent oversight are part of the process, especially when it involves the rakyat’s data”.
He added, “Clear communication and technical accountability are key to maintaining public trust.”
According to the MCMC, the data collected is used to support statistical analysis by the Department of Statistics Malaysia (DOSM), especially for national planning and domestic tourism insights.
Anonymisation may not be foolproof
Although the regulator insists that the dataset excludes names, IC numbers or other personally identifiable information (PII), Fong cautioned that anonymisation may not be foolproof. There needs to be safeguards in place to ensure that anonymised data cannot be reverse-engineered or misused.
Fond explained, “Anonymisation is a standard process that involves breaking down information, randomising it or adding noise to make it unrecognisable.”
“But unless the public knows what method was used, there is no way to determine whether the data is truly protected from re-identification,” he added.
Call for Independent Verification and Technical Transparency
Fong stressed that public communication should have been front and centre. He said if the data is truly anonymised and used for legitimate statistical purposes, it should had been transparent with the explanation of the methodology and backed by independent verification but it appears there isn’t any public consultation before hand.
He added, “The process must be auditable. Independent experts with no conflict of interest should be brought in to verify how the data is anonymised and handled.”
When it comes to data, Malaysians have the right to be concerned as there have been a long history of data breaches involving government-linked departments and agencies.
One of the biggest data breaches in Malaysia occurred in 2017 when personal details of millions of Malaysians containing IC numbers and home addresses were leaked from a database which was managed under MCMC’s oversight. No prosecutions have been reported so far.
Fong urged for stronger technical assurances and independent oversight to verify the integrity of anonymisation protocols. He said, “My view is that it is best for these assurances to be technically validated, audited and made accountable through third-party expertise.“
He also recommended a clear framework involving public consultation, neutral technical experts and independent bodies with no conflict of interest to provide oversight.
Data when combined becomes powerful information
Fong also warned that there could be potential danger lies in how data is combined and interpreted.
“One data field by itself may be meaningless,” he said. “But when you start connecting an IC number to an address, then to a name, and then layer that with location behaviour — it becomes powerful information. And powerful information, when analysed, becomes intelligence.”
“Intelligence can help society — but it can also be exploited. That’s why all information, regardless of how mundane it seems, should be treated with care, seriousness and strong safeguards,” he added.
