PicPay v MyKad? Insight into Malaysian Law
C Information Content and Applications
While the MyKad was originally intended to contain four applications —the national identity card, driving licence, passport information and health information — it now incorporates eight applications, with the possibility of additional applications being integrated in the future. The other four applications are the electronic purse, ATM access, transit application (the ‘Touch ’n’ Go’ feature) and the Public Key Infrastructure (‘PKI’) feature for online transactions.[38] In the near future the government intends to merge the MyKad with the Payment Multi-Purpose Card (‘PMPC’),[39] which will enable the MyKad to have debit and credit card functions and other financial applications.
The MyKad replaces the existing paper-based laminated national identity card as well as the driving licence. It displays on its surface most of the information currently printed on the existing national identity card, driving licence and passport.[40] However, pursuant to recent amendments to sch 1A to the Regulations,[41] additional personal information can be displayed on the card’s surface and stored in the chip. Consequently, the cardholder’s gender and religion (if the holder is Muslim) are now displayed on the MyKad surface. The chip contains information including: race and religion (for all), thumbprints,[42] polling station code and date of registration as a voter, code for criminal record and restricted residence, driving summons or compound[43] and demerit points and health information.
Apart from personal identification and driving licence information, the MyKad also complements the Malaysian international passport for exit from and re-entry into Malaysia, although the passport is still required for entry into and exit from foreign countries. It was originally announced that Malaysians travelling to Brunei would be allowed to use the MyKad in lieu of a passport,[44] but according to the NRD Director-General, Wan Ibrahim Wan Ahmad, this development has been delayed due to a need to protect the personal information in the MyKad when the card is used as a travel document.[45] Health information in the MyKad includes blood group, any allergies, implants, long term illnesses, medical prescriptions and dosage, and records of the holder’s last two ward admissions or clinical visits and diagnoses (if any).[46] In addition, while he was Prime Minister, Dr Mahathir announced the inclusion of additional information on marital status[47] and voting constituency.[48] This announcement indicates that the nature and categories of personal information that can be stored in the MyKad in the future are not closed.
The electronic purse application in the MyKad facilitates payment for small purchases and can be used for commercial transactions and transactions with government agencies (which until now have required the cumbersome process of obtaining bank drafts or money orders). The ATM access application allows storage of up to three bank accounts in the MyKad and enables MyKad users to carry out common banking activities, such as cash withdrawals, balance inquiries and transfers of funds.[49] As part of the transit application, the ‘Touch ’n’ Go’ feature facilitates payment of bus and light rail transportation fares and parking fees, as well as payments at toll booths and at other outlets which accept this payment system.[50] The PKI application in the MyKad provides security for online transactions as well as the transmission of information over networks because public-key cryptography allows for the use of digital signatures and therefore for the authentication of identity.[51]
Proposed applications include Employee Provident Fund (superannuation) transactions,[52] voter registration, ticketless air travel and car park access.[53] The MyKad is also now used by organisations to control the access of visitors and employees to secured areas,[54] for work scheduling and for the internal flow of information and operations within these organisations.[55] As indicated by Dr Mahathir, the possibilities for usage of the MyKad are immense and ‘[t]he journey into the digital era has not just ended with th[e] launch [of the MyKad], rather; this is the beginning of a new era of civilization.’[56]
At present, the MyKad is optional for Malaysians except where they have lost or damaged their existing paper-based identity cards[57] or are applying for an identity card for the first time.[58] Administratively, however, the NRD has ceased to issue the existing paper-based identity cards since 31 July 2001.[59] Thus, there is effectively no option — all Malaysians will at some stage have to change to the MyKad.[60]
The MyKad therefore represents, on the one hand, a single smart card that can be used for multiple purposes and which the government promises will propel Malaysians towards ‘an incredible transformation in their lives’.[61] On the other hand, the MyKad contains, in one card, considerable personal and potentially sensitive information about the cardholder. It also has considerable capacity for expansion into other domains. As a result, serious information privacy issues must be urgently addressed.
http://www.austlii.edu.au/au/journals/MULR/2004/15.html