PURPOSE

N2N Connect Berhad (“N2N”) and its subsidiaries (each, the “Company” and collectively, the “Group”) are committed to complying with the Personal Data Protection Act 2010 of Malaysia (“PDPA”). This Personal Data Protection Policy (“Policy”) contains the policies and practices of the Group to comply with the PDPA.

REQUIREMENTS

The requirements of the Company under the PDPA are as follows:

• develop and implement policies and practices necessary for the Company to meet its obligations under the PDPA;
• develop a process to receive and respond to complaints that may arise with respect to the application of the PDPA;
• communicate to its employees information about this Policy;
• make information available on request about the Policy and the complaint process referred to in paragraph (b) above; and
• (i) appoint one or more data protection officers. These are the persons responsible for ensuring that the Company complies with the PDPA (“Data Protection Officers” or “DPO”); and (ii) make available to the public the business contact information of at least one of the Data Protection Officers.

N2N has implemented this Policy and certain personal data protection internal practices (“PDP Internal Practices”) attached hereto as Annex A for the Group to meet the requirements under the PDPA.

PRIMARY DATA PROTECTION RULES

The Company MUST comply with the following rules when collecting, using or disclosing Personal Data of any individual:

WHAT IS PERSONAL DATA

• from such data alone; or
• from such data and other information that the organisation has or is likely to have access.

• Personal contact information, including name, personal address, personal email address and telephone number, bank account and tax details;
• NRIC, passport or other equivalent identification number; and
• Other information where the individual can be identified from such information.

Personal Data does NOT cover an individual’s “business contact information” such as his/her position, title, business address, business email/ fax number

PURPOSES OF COLLECTION, USE AND/OR DISCLOSURE OF PERSONAL DATA

PERSONAL BEHAVIOUR & CONDUCT IN N2N

• actual consent; and
• deemed consent under the PDPA
• Other information where the individual can be identified from such information.

• the collection, use or disclosure is necessary to respond to an emergency that threatens the life, health or safety of the individual or another individual;
• the Personal Data is publicly available;
• the collection, use or disclosure is necessary for any purpose which is clearly in the interests of the individual, if consent for its collection, use or disclosure cannot be obtained in a timely way;
• the collection, use or disclosure is necessary for any investigation or proceedings;
• the collection, use or disclosure is necessary for evaluative purposes; and/or
• in any other circumstances set out in the PDPA.

WITHDRAWAL OF CONSENT / CORRECTION AND ACCESS TO PERSONAL DATA

RETENTION PROTECTION AND DISPOSAL OF PERSONAL DATA

POWERS OF PDPC AND CONSEQUENCES OF NON-COMPLIANCE WITH PDPA

• if it is satisfied that an organisation is in breach, impose a financial penalty of up to Rm 500,000.00 and/or jail imprisonment up to 3 years;
• give directions for the destruction of Personal Data collected or for that the organisation ceases to collect or use Personal Data in breach of the PDPA;
• review any complaint by an individual against an organisation for refusal to provide access to his/her Personal Data; and
• give such directions as it thinks fit to ensure compliance with the PDPA

GENERAL

  End  

ANNEX A – PDP INTERNAL PRACTICES

DATA PROTECTION OFFICER(S)

The department or office of the DPO has been set up to oversee the Group’s compliance with the PDPA. Other employees within the Group may be delegated to act on behalf of the DPO or to take responsibility for the day-to-day collection and processing of Personal Data. The DPO may be contacted at:

The Data Protection Officer
N2N CONNECT BERHAD
Level 9, Wisma N2N,
Tower 2, Avenue 3, Bangsar South,
No. 8, Jalan Kerinchi,
59200 Kuala Lumpur, Malaysia.
Email: dpo@n2nconnect.com

CONSENT FOR COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

• Employee must OBTAIN THE CONSENT of an individual BEFORE the: (i) collection; (ii) use; and/or (iii) disclosure of an individual’s Personal Data.
• All consents must be obtained IN WRITING. This is to mitigate against disputes
• When seeking such consent, employee must:
  • notify the individual IN WRITING of the PURPOSE(S) for which the Company intends to collect, use or disclose his/her Personal Data. The purpose should be clearly set out.
  • obtain the individual’s WRITTEN confirmation that the Personal Data provided is accurate and complete.
• If consent is obtained, the Personal Data must only be collected, used or disclosed by the Company for the purposes for which the consent was obtained, and not for any other purpose.
• The individual is entitled to WITHDRAW CONSENT given, on giving reasonable notice to the Company. In such event:
  • Employee should direct the individual to submit their notice of withdrawal in writing to the DPO;
  • On receipt of withdrawal notice, the DPO shall inform the individual of the likely consequences of withdrawing the consent; and
  • Upon withdrawal, the Company MUST CEASE to collect, use or disclose the Personal Data of such individual (as the case may be).

PROTECTION, RETENTION AND DISPOSAL OF PERSONAL DATA

• Employee must keep all documents containing any Personal Data and confidential information secure and locked at all times
• Employee must activate the self-locking mechanism for his/her computer if the computer is left unattended for a certain period.
• Employee must encrypt all electronic documents containing Personal Data.
• Documents containing Personal Data should be removed or disposed of once the purposes for which the Personal Data was collected are no longer being served by the retention of the Personal Data and the retention is no longer necessary for legal or business purposes
• Recycling of paper is encouraged but employee shall ensure that papers or documents containing Personal Data are SHREDDED BEFORE recycling
• Employee must delete the electronic files containing Personal Data PRIOR to the disposal of IT devices in which the Personal Data was kept or stored.
• Copying of Personal Data to removable storage devices or transmitting such data via email is strictly prohibited unless prior approval of the DPO is obtained.

ACCESS TO, CORRECTION AND ACCURACY OF PERSONAL DATA

• Upon request by an individual, the Company must provide him/her with:
  • his/her Personal Data which is in the possession or under the control of the Company; and
  • information about the ways in which the Personal Data has been or may have been used or disclosed during the past 1 year.

    There are some exceptions to the above obligations: opinion data kept solely for an evaluative purpose; Personal Data which is subject to legal privilege; Personal Data which, if disclosed, would reveal confidential commercial information that could, in the opinion of a reasonable person, harm the competitive position of the organisation; or any request for information that does not exist or cannot be found.

    Personal Data and information must NOT be provided where it could be reasonably be expected to: threaten the safety or physical or mental health of an individual, other than the individual who made the request; cause immediate or grave harm to the safety or to the physical or mental health of the individual who made the request; or reveal Personal Data about another individual.

• To assess the information set out above in 4(a), individual is required to submit his/her request by using the form set out in Appendix 1 (Access Form).

  Note: When processing an access request, it is important for employee to establish and verify the identity of the individual making the request.

• In order to comply with an access request made by an individual as set out above in 4(a)(ii), employee who is managing or handling the relevant Personal Data must maintain a disclosure list substantially in the form as set out in Appendix 2 (Disclosure List).
• An individual is entitled to request that an error in his/her Personal Data be corrected. Upon receipt of such a request, employee shall:
  • provide the individual with the form set out in Appendix 3 (Correction Form) for his/her completion; and
  • correct the Personal Data as soon as practicable and send the corrected personal data to every other organisation to which the Personal Data was disclosed by the Company within 1 year before the correction was made, unless that other organisation does not need the corrected personal data for any legal or business purpose.
• Employee should make reasonable efforts to ensure that Personal Data collected from an individual is correct, accurate and complete. This should be done at the stage when consent is first obtained or when the correction to the Personal Data is made.

SPECIFIC REQUIREMENT RELATING TO COLLECTION, USE AND/OR DISCLOSURE OF NRIC NUMBERS

• The Company may collect, use and/or disclose NRIC in the following specified circumstances (the “Permitted Circumstances”):
  • where collection, use or disclosure of NRIC numbers is required under the law (or an exception under the PDPA applies) (“Law Exception”); or
  • where collection, use or disclosure of NRIC numbers is necessary to accurately establish or verify the identities of the individuals to a high degree of fidelity (“High Fidelity Exception”).
• It is important to note that the treatment for NRIC numbers applies to other national identification numbers such as foreign identification numbers (FIN), work permit numbers, driver’s license number, birth certificate numbers and passport numbers and copies thereof
• Law Exception

  Some of the examples as follows:

  • Under the Employment Act, all employers must maintain detailed employment records of employees covered by the Employment Act, which includes employees’ NRIC number and other relevant information. Organisations are therefore allowed to collect, use or disclose NRIC numbers (or copies of NRIC) for this purpose
  • An individual at an organisation becomes unconscious after sustaining a fall and has to be admitted to hospital. The staff at the organisation provides the hospital with the individual’s personal data including his name, NRIC number and medical allergies, without his consent as there is an applicable exception in the PDPA
• High Fidelity Exception

  The Company and its employees may collect, use or disclose an individual’s NRIC number if the following conditions are met:

  • it is necessary to accurately establish or verify the identity of the individual to a high degree of fidelity in the following situations:
    • where the failure to accurately identify the individual to a high degree of fidelity may pose a significant safety or security risk. For example, visitor entry to preschools where ensuring the safety and security of young children is an overriding concern; OR
    • where the inability to accurately identify an individual to a high degree of fidelity may pose a risk of significant impact or harm to an individual and/or the organisation. Such transactions typically relate to healthcare, financial or real estate matters, insurance applications and claims, applications and disbursements of substantial financial aid, background credit checks with bureau;
    AND
  • the individual has been notified and his consent has been obtained in accordance with the requirements under the PDPA.

  Both conditions (i) and (ii) must be met.

  The Company should assess whether its specific situation meets the above conditions before collecting the individual’s NRIC number. The Company must be able to provide justification on request of either the individual or the Commission as to why the collection, use or disclosure of the NRIC number is necessary to accurately establish or verify the identity of the individual to a high degree of fidelity

• Some alternatives to NRIC numbers that have been adopted by companies include usergenerated ID, tracking number, organisation-issued QR Code or monetary deposit. However, the Company should consider whether the alternatives provided are reasonable, and avoid collecting excessive personal data as an alternative to the individual’s NRIC number.

  The Company may consider collecting partial NRIC number when other alternatives are not satisfactory (for e.g. ‘6789’ from the full NRIC number of 80123-45-6789). This would not be PERSONAL DATA PROTECTION POLICY – APRIL 2020 © N2N Connect Bhd. All Rights Reserved. 14 subject to the Commission’s rules for treatment of NRIC numbers as it is not considered to be collection of full NRIC numbers

TRANSFER OF PERSONAL DATA

Legally enforceable obligations include any law, contracts, binding corporate rules or any other legally binding instrument

DATA BREACHES

• Data breaches can occur for various reasons. These may be caused by employees, external parties or computer system errors. The following are some possible ways in which a data breach may occur. The list is not meant to be exhaustive.

  Malicious activities	Hacking incidents/ illegal access to databases containing Personal Data Theft of computer notebooks, data storage devices or paper records containing Personal Data Scams that trick organisations into releasing Personal Data of individuals
  Human error	Loss of computer notebooks, data storage devices or paper records containing Personal Data Sending Personal Data to a wrong e-mail or physical address, or disclosing data to a wrong recipient Unauthorised access or disclosure of Personal Data by employee Mistakes in the printing process which may lead to the exposure of Personal Data Improper disposal of Personal Data (e.g. hard disk, storage media or paper documents sold or discarded before Personal Data is properly deleted)
  Computer system error	Errors or bugs in the programming code of websites, databases and other software which may be exploited to gain access to Personal Data stored on computer systems

• When data breach occurs or is likely to occur, employee MUST comply with the following:

  Containing the breach

  Where applicable, Notify IT Department immediately Shut down and isolate the compromised system that lead to the data breach IT Department shall establish whether steps can be taken to recover lost data and limit any damage caused by the breach Reset password Address lapses in processes that led to the data breach Put a stop to practices that led to the data breach

  Reporting the incident

  Employee and IT Department to immediately report matter to DPO with details on how and when the data breach occurred, types of Personal Data involved in the data breach DPO to report to the management of the Company to consider whether to notify the police if criminal activity is suspected and preserve evidence for investigation DPO to notify the affected individuals and/or PDPC taking into account the prevailing PDPC’s guidelines

COMPLAINT HANDLING PROCESS