Compliance to personal data protection principles: A study of how organizations frame privacy policy notices. Issue 4 (July 2017)

• Record Type: Journal Article
• Authors: Chua, Hui Na; Herbland, Anthony; Wong, Siew Fan; Chang, Younghoon
• Is Part Of: Telematics and informatics. Volume 34:Issue 4(2017)
• Page Start: 157
• Page End: 170
• Publication Date: 2017-07
• Subjects: Personal Data Protection Act -- Privacy policy -- Compliance -- Personal data -- Information privacy; Telecommunication -- Periodicals; Computer networks -- Periodicals; Télécommunications -- Périodiques; Réseaux d'ordinateurs -- Périodiques; 384
• DOI: 10.1016/j.tele.2017.01.008
• Languages: English
• ISSNs: 0736-5853

Abstract

Highlights: We examined how organizations' privacy policy meet the compliance requirement. We found privately-owned organizations have higher compliance level. Sectors with more personal sensitive data have significantly higher compliance score. Government sectors have the lowest compliance score and highest readability score. Foreign and local sectors demonstrate statistically significant comparable compliance scores. Abstract: This study examines how organizations in Malaysia frame their privacy policy notice to comply with the Personal Data Protection Act (PDPA, 2010) and if these organizations differ in their level of compliance and the readability of their privacy notices. We collected the online privacy polices of 306 organizations from 12 sectors to assess their readability and compliance with PDPA requirements. The results show that private-owned organizations have higher compliance level compared to public-owned organizations. Sectors that hold more personal sensitive data obtain higher compliance scores. Non-governmental organizations demonstrate higher compliance level compared to government-owned organizations. Despite differences in the compliance scores, most organizations fail to meet the requirements of the PDPA. Our study also reveals that readability has a negative correlation with the compliance score because simple and shorter version of the privacy policies often lack detailed information. Our findings provide valuable insights into organizations' privacy policy compliance across different sectors in Malaysia. Specifically, the Malaysian authority should implement more effective mechanisms to enforce the compliance of the PDPA. Organizations should also take corrective actions to improve the compliance scores of their online privacy policies.