1. Advertisers should comply with all relevant data protection legislation. Guidance on this legislation is available from the Malaysian Communications and Multimedia Commission (MCMC). Although data protection legislation has a wide application, these clauses relate only to databases used for direct marketing purposes. The clauses should be observed in conjunction with the legislation; they do not replace it.
2. Advertisers should take all necessary steps to ensure that: (i) Advertisements are suitable for those targeted;
(ii) Advertisements are not sent unsolicited to consumers if explicit consent is required;
(iii) Advertisements are not sent to consumers who have asked not to receive them or who have not had the opportunity to object to receiving them, if appropriate. Those consumers should be identifiable;
(iv) Databases are accurate and up-to date and, if rented, bought, etc., have been run against the most relevant suppression file operated by the relevant Preference Service. Reasonable requests for corrections to personal information should be acted upon within 60 days;
(v) Anyone who has been notified as dead is not mailed again and the notifier is referred to the relevant Preference Service; and
(vi) If asked in writing, consumers or the ASA (with consumers’ consent) are given any information available on the nature and source of their personal details. Responsibility for complying with the above sub-clauses may not rest directly with advertisers but with other data controllers. Those responsible will be expected to comply.
3. Unless it is obvious from the context, or if they already know, consumers should be informed at the time when personal information is collected:
(i) who is collecting it (and the representative for data protection queries, if different);
(ii) why it is being collected;
(iii) if is intended to disclose the information to third parties, including associated but legally separate companies, or put the information to a use significantly different from that for which it is being provided, in which case an opportunity to prevent this should be given.
4. The explicit consent of consumers is required before:
(i) Processing sensitive personal data, including information on racial or ethnic origin, political opinion or religious or other similar beliefs, trade union membership, physical or mental health, sex life or any criminal record or allegation of criminal activity;
(ii) Advertising through fax.
(iii) Advertising through e-mail or SMS text transmission, save that advertisers may market their similar products to their existing customers without explicit consent so long as an opportunity to object to further such marketing is given on each occasion.
5. If after collection it is decided to use personal information for a purpose significantly different from that originally communicated, advertisers should first get the explicit consent of consumers. Significantly different purposes include:
(i) Disclosure of personal information to third parties for direct marketing purposes;
(ii) Use or disclosure of personal information for any purpose substantially different from that which consumers could reasonably have foreseen and to which they might have objected.
6. The extent and detail of personal information held for any purposes should be adequate and relevant and should not be excessive for that purpose.
7. Personal information must always be held securely and should be safeguarded against unauthorized use, disclosure, alteration or destruction.
8. Personalinformationshouldnotbekeptforlongerthanisnecessaryforthepurposeor purposes for which it was obtained.
9. Consumers are entitled to have their personal information suppressed. Enough information should be held by companies, though not for direct marketing purpose, to ensure that no further marketing communications are sent as a result of information about those consumer being re-obtained though a third party. If they want to reduce all unsolicited contact, consumers should register their names and contact details on all relevant suppression files.
10. Consumers who have asked for personal information about them to be suppressed may be contacted if they ask to be reinstated.
11. Advertisers are permitted to use published information that is generally available provided the consumer concerned is not listed on a relevant suppression file.
12. Any proposed transfer of a database to a country outside Malaysia should be made only if that country ensures an adequate level of protection for the rights and freedom of consumers in relation to the processing of personal information or if contractual arrangements are in place to provide that protection.