Padu, MySejahtera data safety in spotlight? MCCA pushes for parliamentary review

SHAH ALAM - The government needs to hold a special session of the Dewan Rakyat and Dewan Negara to discuss and debate various issues regarding the development, security and data breaches of the national Central Database System (Padu) and the MySejahtera application.

Malaysian Cyber Consumer Association (MCCA) president Siraj Jalil said that this was necessary because the implementation of these two systems involves the sharing of highly sensitive and confidential data, not only personal information like identification card numbers but also bank account numbers, residential addresses and users' monthly incomes.

He added that the Malaysian Auditor General's Report Series 2 (2021) revealed that more than three million MySejahtera user records had been accessed suspiciously from an account known as Super Admin and there were also 1.12 million attempts to breach its database system.

He emphasised that the special session was crucial because Malaysians wanted the government to provide a detailed explanation regarding the status and assurance of the government’s commitment to the security and sovereignty of the personal data they shared when registering previously.

"The public also wants to know what is happening with the Padu and MySejahtera systems. Will the government continue to remain silent without giving any feedback on the data they entered into these two databases?

"This is not a trivial issue, as the government has spent a substantial amount, involving hundreds of millions of ringgit of taxpayers' money, to establish Padu and MySejahtera.

"Therefore, the public needs to know about the ownership of big data by the government today, not only in terms of its usage and direction but also in terms of cybersecurity issues, the sovereignty of the collected data, who manages this data and what benefits it brings to the people," he told Sinar Premium.

Siraj said that the government clarified that the MySejahtera application was owned by the National Digital Department (JDM), formerly known as the Malaysian Administrative Modernisation and Management Planning Unit (Mampu), though it was previously controlled by a third party.

However, he noted that the MySejahtera issue remains unresolved as its ownership has changed hands several times, starting with a Singapore-based company, Kpisoft (M) Sdn Bhd, then to the National Cyber Security Agency (NACSA), the Health Ministry and now JDM.

"Thus, the public is unclear about the status, security, and sovereignty of MySejahtera data, as the application was previously owned by a private entity, which raises the risk of misuse by irresponsible parties.

"Therefore, I believe that in addition to Padu, the MySejahtera issue also needs to be discussed, reviewed and debated in the Dewan Rakyat and Dewan Negara as soon as possible," he added.

He further mentioned that the public’s perception of the government had worsened because Padu still lacked a clear direction.

"Moreover, the government is now creating various other systems, including MyDigital ID, MyDiesel Subsidy, Budi Madani and many more, which are causing confusion, disappointment, and anger among the people," he said.

He explained that this situation contrasts with the database systems of the National Registration Department (JPN) or the Malaysian Immigration Department (JIM), which were fully controlled by these departments through legal enforcement and the appointment of a Director-General, even though the system infrastructure may have been developed by a third party.

Machang MP Wan Ahmad Fayhsal Wan Ahmad Kamal said that the government must be transparent about the status of the Padu system, whether it would continue to be used or be abolished.

The Bersatu Supreme Council member emphasised that this was necessary as the Prime Minister Datuk Seri Anwar Ibrahim and the Finance Minister II Datuk Amir Hamzah Azizan have not addressed the use of Padu as a mechanism for targeting diesel and RON95 petrol subsidies during recent debates in the Dewan Rakyat.

“If the Padu database system is truly no longer being used as the basis for targeted subsidies, then what was the purpose of the Economy Minister’s strong push for Padu implementation previously, or was he acting on his own accord?

"Was the decision to establish the Padu system made solely by the Economy Minister without consulting the Cabinet? How was it decided?

"The public needs detailed information because the cost to build the Padu system wasn’t cheap; in fact, it was more expensive than the losses faced by Fashion Valet Sdn Bhd (FashionValet)," he said.

Wan Ahmad Fayhsal noted that the concern raised by MCA President and Ayer Hitam MP Datuk Seri Wee Ka Siong that the total development cost of Padu amounted to RM85 million, is very important, even though it was refuted by Economy Minister Rafizi Ramli in the Dewan Rakyat last Thursday.

Thus, Wan Ahmad Fayhsal agreed that the government should hold a special session in Parliament to debate this issue to avoid negative perceptions among the public.

Here is an overview of key database systems in Malaysia:

1. MySejahtera

- Launch Date: April 16, 2020

- Users: 38 million

- Cost: RM160 million

- Developers: National Security Council, SKMM and Mampu

- Function: Helps the government and public manage the Covid-19 pandemic.

Since Jan 1, 2023, the public can make appointments at the Health Ministry clinics through this app.

The government plans for MySejahtera to become a super app, including functions such as infectious disease surveillance, organ donation registration, and blood donation records.

2. Primary Database (Padu)

- Launch Date: Jan 2, 2024

- Users: 30.08 million

- Cost: RM31 million

- Developers: Economy Ministry, Statistics Department and Mampu

- Function: Provides a secure and comprehensive national database.

Enables the implementation of targeted policies.

3. MyDigital ID

- Launch Date: October 2023

- Users: 1 million

- Cost: RM80 million

- Developer: Mimos

- Function: A digital identification system that facilitates individuals in accessing and performing online transactions using a single password.

It does not replace MyKad, nor does it store any biometric or personal data.

A single government application that centralises all agencies, including Padu, MySejahtera, MyJPJ, the MyGov portal, and LHDN, as well as private entities like Touch & Go.