Hi
is CTOS affected by the Malaysia's Personal Data Protection Act 2010 (PDPA) ?
Can we prevent CTOS from showing or providing our data without our consent when the act is fully enforced ...
anyone can shed some light ...
» Click to show Spoiler - click again to hide... «
here is an article i saw:
New enforcement date of the Personal Data Protection Act 2010 announced
Baker & McKenzie
Kherk Ying (Kherk) Chew and Hong Sze Chen
Malaysia
July 15 2013
Announcements have been made by YB Dato' Sri Ahmad Shabery bin Cheek, Minister of Communications and Multimedia, that the Personal Data Protection Act 2010 ("PDPA") which was passed by the Malaysian Parliament in 2010, will come into force on 16 August 2013. It is reported that Tuan Haji Abu Hassan Ismail will likely to be appointed as the Personal Data Protection Commissioner. Nonetheless, to date, the official Gazette formalizing the date of coming into force has not been published.
Once the PDPA comes into force, data users will have a three-month transitional period to comply with its provisions in respect of existing personal data being processed, but will have to immediately comply with its provisions in respect of new personal data collected.
There are seven data protection principles that form the basis of protection under the PDPA:
General Principle
Notice and Choice Principle
Disclosure Principle
Security Principle
Retention Principle
Data Integrity Principle
Access Principle
The principles will provide protection to the individual’s personal data, thereby safeguarding the interests of consumers, and e-commerce, network and non-network facility practitioners.
The penalties for breaching the PDPA include the imposition of fines of up to RM500,000 and/or a term of imprisonment not exceeding two years. Directors, CEOs, COOS, managers or other similar officers have joint and several liability for non-compliance by the body corporate, subject to the due diligence defence. The Commissioner is not empowered to order compensation for damage suffered, and there is no express right to pursue a civil claim for non-compliance.
While the scope, rights and obligations prescribed by the PDPA will become more clearly defined and also evolve through the regulations, guidelines, codes of practice and court decisions, organisations must now begin to examine their current policies, processes, contractual right rights and obligations and third party notifications which relate to personal data.[FONT=Impact]

I believe PDPA Act dictates a person needs to give consent for the release of information. Therefore they can restrict information being disclosed.
However, that being said; if one is not willing to disclose, then would the other party eg banks wants to give the person the loan or would a potential business partner wants to partner the person on the basis if that person is not willing to give consent for disclosure... is there something that person is hiding?
So probably one might need to ponder on that.