1Malaysia greetings: Spam or privacy violation?

IT’S not every day that one gets a personal greeting from the prime minister via e-mail or SMS. But when Datuk Seri Najib Razak did just that to over five million Malaysians for Chinese New Year in February 2011, he got flak from the DAP in Parliament for imprudent use of taxpayers’ dollars.

Another DAP MP, Teresa Kok, in a press statement, demanded that Najib explain “why he wasted RM63,000 of taxpayers’ money to spam 1.25 million Malaysians with ‘Salam 1Malaysia’ at the jaw- dropping  cost of 5 sen per e-mail address”.

It may come as news to Kok, but five sen per e-mail is actually not “jaw-dropping”. According to digital marketers, the cost of acquiring e-mail addresses from Malaysian databases ranges from 15 sen to 80 sen per e-mail address. The value of the e-mail address increases with the level of precision surrounding the user’s profile. So, contrary to Kok’s wild accusation, the PM had in fact acquired the e-mail addresses at what can be described as a “competitive price”.

The real issue here is whether or not it was appropriate for the PMO to utilise taxpayers’ money to engage in what could be construed as spamming. Some recipients of the Salam 1Malaysia electronic direct mail (EDM) might regard the e-mail as none too different from e-mails offering penile extensions or erectile dysfunction drugs.

In engaging in such “spamming” activities, did the PMO end up violating the electronic privacy rights of the recipients?

E-Privacy: A Nebulous Matter in Malaysia

In April 2010, the Malaysian government passed the Personal Data Protection Act. The existence of the Act means all forms of data collection in Malaysia are now subject to a legal regime and control measures dictating when data can be stored and how it can be used.

However, as the Data Commissioner stipulated in the Act has not yet been appointed, the law would not appear to be strictly in force. Nonetheless, the majority of digital marketing companies and brands who engage customers in the digital marketing sphere have long self-regulated on this matter. It can be argued that electronic privacy rights do exist for Malaysians, but the exact nature of those rights remains open to debate.

The PMO acknowledged that it bought e-mail addresses from Media Prima Bhd and the Ministry of Higher Education (MOHE). This was presumably done because the 1Malaysia website’s database was too small. As buyer of the addresses, the PMO technically hasn’t done anything wrong, since legal onus on ensuring the integrity of the personal data is on Media Prima and MOHE.

What justification?

Questions do arise, however, as to whether Media Prima and MOHE have conformed to the legal requirements of the Act. Or, since the Act is regarded as not yet being in force, whether they have conformed to relevant best practices in their collection and sharing of personal data of their users. Media Prima‘s privacy policy, as cited by the PMO in its reply to Parliament, appears to give the company a wide berth to share the personal data of users collected in its database.

The questions Media Prima needs to answer are:

how it justifies the Prime Minister of Malaysia to be a “third party that may attract the interest and attention of individuals”; and,

how the EDM can be justified given that the prime minister did not actually attempt to sell the recipients anything that can be construed as a service, product or a promotion.

As for MOHE, the issue of personal data integrity is particularly relevant as its database may have users that are under the age of 18. Most digital marketers avoid sending EDMs to users below the age of 18 since these users would be under the legal age of consent.

MOHE’s privacy policy states (translated from Bahasa Malaysia) “that personal data may be shared with other public agencies to assist in the provision of more effective services, such as the resolution of complaints which may require a response from other agencies”. MOHE, in sharing its database with the PMO, needs to explain just how this sharing serves to enhance the ministry’s own effectiveness in providing services to the public or in the resolution of complaints.

Telcos, too, have some explaining to do regarding the dissemination of the prime minister’s greeting to four million recipients via SMS. It is likely the PMO had asked telcos to mine their databases for Chinese Malaysian customers within a certain age or income group. But Maxis Bhd, Celcom Bhd and Digi Bhd should explain how sending what could be viewed as either SMS spam or a political message, qualifies as corporate social responsibility in any manner or form.

Stick to social media

The PMO, in its parliamentary reply, took great care to emphasize that at no time did the prime minister have access to, or obtain, the personal data of any of the recipients.

However, seeing as the message was a Chinese New Year message, it presumably would have only be sent to recipients who were Chinese. It can therefore be argued that the PMO, when it purchased those e-mails from Media Prima, had obtained a very sensitive piece of personal data about the recipients: their ethnicity.

The PMO did not in itself violate the privacy of the recipients of the Salam 1Malaysia SMS or e-mail. Rather, it is the entities which provided PMO with the e-mail addresses, who may have been loose with their privacy policies, or who may have failed to adhere to industry-accepted standards on the sharing of personal data. And in purchasing or utilising the databases of such entities, the PMO has indicated a willingness to work with parties that don’t exactly respect or value the personal data integrity of their users.

The experts advising the prime minister on digital strategies to engage the rakyat would do well to suggest that he to stick to Twitter and Facebook. As free, “opt in” communication channels, using these methods will at least avoid complaints about misuse of taxpayers’ dollars and violation of electronic privacy rights. Using social media will also avoid complaints about access to personal data or any digital marketing faux pas.

Perhaps the prime minister should also give some thought to whether perhaps he is a little too judicious with protecting his own personal data. He doesn’t seem to have an e-mail address on his 1Malaysia website that the rakyat can reach him at directly. At the very least, shouldn’t the recipients of his Salam 1Malaysia e-mail (particularly those who weren’t thrilled to receive it) be given the opportunity to return the ”favour”?

Bernice Low writes on technology issues for CNET Asia. When not digitally skewering someone in her blog, she’s busy dreaming up of Hollywood blockbuster movies in her other life as a screenwriter.