Relevant stakeholders have expressed concerns over the draft personal data protection law, claiming some terms are ambiguous and parts are not clear regarding the use of personal data.

During a panel discussion on Saturday regarding the draft law, Sin Kim Sean, a board member at Open Development Cambodia (ODC), said the draft law contains opaque terms and unclear purposes that allow the use of personal data without owners’ consent in Article 15.

The panel discussion was organized by the Youth Internet Governance Forum committee at Cambodia Academy of Digital Technology.

Recently, the Ministry of Post and Telecommunications drafted the law on personal data protection, which comprises 72 articles. A total of 22 cover punishment, including imprisonment. While 25 Prakas will be followed by the draft law after it is enacted.

dynamic_detail_1

Personal data is information related to a person such as name, address, phone number, social security number, health data, political opinions, religious beliefs, biometric data and sexual orientation, just to mention a few.

The data is being collected through various means, such as assessments, evaluation, surveys, interviews, registration, and online monitoring.

In this digital era, some of the potential risks associated with the misuse of personal data are identity theft, discrimination, and reputational damage. However, there are also benefits of using personal data, for example, the data is used for targeted marketing, credit and loan evaluation, medical research, and crime analysis for financial benefit.

Therefore, it is really important for Cambodia to have laws that properly regulate and protect personal data. The draft on personal data protection is a good start, and there are Articles that prevent the misuse of personal data.

dynamic_detail_2

However, Kim Sean expressed some concerns about the draft law. She said “the purpose of the law is to protect personal data; however, to her, there are some articles that need to be taken seriously due to the opaque nature of the terms used in them.”

“If people ask you for your personal data, they must clearly state the objective of collecting your data, and how the data will be used and for what purposes before they can ask for consent,” she said.

Additionally, the amount of personal data collectors can access is limited to their stated objective. For instance, if someone is asked to take part in a survey about clothing, but they are being asked about how many children they have, the person has the right to not provide such information because it is not relevant to the objective.

Some terms, such as access, data subject, and cloud, are confusing, she added, because these terms are directly translated into Khmer to ការអាក់សេស, ប្រធានទិន្នន័យ, and ក្លោដ, respectively.

She explained that using the term ‘data subject’ when directly translated into Khmer as ‘ប្រធានទិន្នន័យ’ will confuse people. The term should be translated into ‘ម្ចាស់ទិន្នន័យ’ instead.

The draft law also fails to make it clear how individuals can request the removal of their personal data, or limit its use.

Article 32 states that data owners have the right to know who uses their data available on the internet, she said.

In general, the law does not mention the removal of personal data, whether the owners of data have the right to limit use, and the transfer of the data from one collector to another, or one place to another, she added.

Kim Sean said that the owners of the data should have the rights to remove and limit the use of it. In addition, the draft law does not clearly define what is considered "public interest" for the purposes of collecting personal data without consent.

Article 15 of the draft covers collecting and use of personal data without consent. It states that there is no consent needed when the collection of personal data is used in the public interest.

But, the term public interest has a broad definition. She said, “In the UK, they specified that there is no consent needed when personal data is collected for fraud prevention, counter-terrorism and anti-money laundering, instead of using the term public interest.”

In Article 15 (D), any personal data available on the internet as public can be used without the owner’s consent. However, in the UK, data collectors still have to inform the owners of the data before they can use it.

The draft law also does not require data collectors to inform individuals before using their personal data for scientific research.

In Article 15 (F), data collectors can use personal data without owners’ consent when it is used for scientific research. She said that in the UK, it is required that the use of data in scientific research is transparent, and its purposes of using it are also limited.

The draft law does not provide clear guidance on how to evaluate whether the interests of a data collector outweigh the interests of the individual whose personal data is being collected.

In Article 15 (G), data collectors can use personal data without owners’ consent when it is used for the interests of legitimacy, and the interest of legitimacy is greater than that of the owner of the data. “How can we know which interest is greater and how do we evaluate it?” Kim Sean asked.

However, she explained that in the UK there are three tests. They have to make sure that data collected is used for legitimate purposes. Second, the use of the data has to be necessary for the legitimacy internest, and lastly, they use the International Convention on Civil and Political Rights to balance the interests between the legitimacy and the owner of the data.