In this digital age, information and data of any individual can be obtained through the various facets of big data mining. As such, the protection of personal data and information becomes increasingly pertinent which is evident with the enactment of the Personal Data Protection Act 2010 (PDPA) in Malaysia.
The Income Tax Act 1967 (ITA) provides wide powers to the Director-General of Inland Revenue (DGIR) to request for disclosure of information and data from taxpayers for the purposes of tax audits and investigations. However, the issue arises where there is a potential conflict between the DGIR’s jurisdiction under the ITA to call for disclosure of certain data that may be protected by the PDPA. This is the question raised in the High Court case of GMB v Pesuruhjaya Perlindungan Data Peribadi & Others, where the High Court recently granted leave to the taxpayer to commence judicial review proceedings amongst others against the Commissioner of Personal Data Protection and the DGIR.
Brief FactsThe taxpayer is in the business of leisure and hospitality services which includes gaming, theme parks, retail and entertainment. The taxpayer has a loyalty program in which customers can sign up and a membership card will be given to collect and redeem points. In order to facilitate the issuance of a membership card, the customers would have to disclose personal information such as name, Malaysian Identity Card number, address and other personal information (Personal Data) to the taxpayer.
As part of an exercise to enlarge the tax base, increase tax collection and reduce tax evasion, the DGIR invoked Section 81 of the ITA and sought to obtain the Personal Data of all of the taxpayer’s customers. However, the taxpayer refused to disclose such information and stated that without consent from its customers, such disclosure would contravene the “Disclosure Principle” under Section 39 of the PDPA. As a major player in the country’s entertainment industry, the taxpayer emphasised that disclosure of its customers, which includes non-Malaysian customers, would infringe international privacy or personal data protection laws. It must be noted that the DGIR was not particularly seeking information relating to any specific individual but requested the Personal Data of all the taxpayer’s customers.
In its reply, the DGIR stated that it was competent and duly authorised to demand disclosure of the Personal Data under Section 39(b)(ii) of the PDPA read with Section 81 of the ITA. Section 81 reads as follows:
“The Director General may require any person to give orally or may by notice under his hand require any person to give in writing within a time specified in the notice all such information or particulars as may be demanded of him by the Director General for the purposes of this Act…”
Specifically, the DGIR was relying on Section 39(b)(ii) of the PDPA as the exception which empowers the authority to demand disclosure of the personal information of the customers. Section 39(b)(ii) reads:
“39. Notwithstanding section 8, personal data of a data subject may be disclosed by a data user for any purpose other than the purpose for which the personal data was to be disclosed at the time of its collection or any other purpose directly related to that purpose, only under the following circumstances:
(a) the data subject has given his consent to the disclosure;(b) the disclosure — (ii) was required or authorized by or under any law or by the order of a court…”
Alternatively, the DGIR stated that it could also demand disclosure vide tax audit and investigations.After various correspondences, the DGIR maintained its position and this sentiment was further bolstered by representations from the Deputy Commissioner of Personal Data Protection (Deputy Commissioner). The taxpayer being aggrieved by this request, applied for leave to commence judicial review. The question posed by the taxpayer is whether the provisions within the PDPA are wide enough to allow the DGIR to make a blanket demand of Personal Data of the taxpayer’s customers.
Upon hearing the parties, the High Court granted leave to the taxpayer to commence judicial review to challenge the decision of the Deputy Commissioner. The High Court allowed an interim stay by the taxpayer to stay the request made by the DGIR for the Personal Data until the judicial review application proper was determined.
Leave Stage HearingThe leave application for judicial review was contested by the Attorney General’s Chambers mainly on 2 grounds:
• Application was premature as there was no appealable decisionThe words contained within the Deputy Commissioner’s letter were “Jabatan ini berpandangan bahawa” and therefore, only expresses an opinion. The Deputy Commissioner was relying on representations made by the IRB in coming to this view. It maintained that it was not a decision because neither the Deputy Commissioner nor his department has jurisdiction over the ITA.
• Section 81 of the ITA does not violate the PDPA
There were also affidavits filed by the DGIR averring that Section 81 of the ITA entitles to request for the Personal Data from the taxpayer. According to the DGIR, this provision empowers the IRB to seek information and beyond the taxpayer’s income tax returns. The DGIR maintained that in order for the taxpayer to properly discharge its obligations under Section 81, it should disclose the requested information. The Personal Data were required from the taxpayer in order to ascertain individuals which were not registered as taxpayers with the DGIR to enable further investigations on those individuals.
Meanwhile, the taxpayer submitted that judicial review should be granted to for the following reasons:
• Consent requiredThe taxpayer submitted that as a data user under the PDPA, the taxpayer required consent from all of its customers (however, this position was later changed to only customers in Malaysia) to disclose the Personal Data to the DGIR. The repercussions of failing to comply with the relevant disclosure principle, the taxpayer can be liable in a fine, imprisonment and civil suits from its customers.
• Specific provision overrides general provisionAdditionally, the maxim generalia specialibus non derogant entails that where there is a specific provision on an Act on a point of law, that provision takes precedence over a general provision where there are inconsistencies. The PDPA was enacted specifically for the protection of personal data and as such, prevails over the general provision of the ITA.
• A decision is anything that has a compulsion to obeyThe taxpayer argued that the Deputy Commissioner had through its various correspondence taken a clear position that the taxpayer can disclose the Personal Data without infringing the PDPA and such a decision by the Deputy Commissioner cannot be simply regarded as insignificant. The decision made by the Deputy Commissioner must be viewed in its entirety and the decision is appealable as it is among others, something which is stated authoritatively or in a manner where there is a compulsion to obey.
• Scope of Section 81Additionally, the taxpayer protested that Section 81 gives the IRB the power to obtain information relating to the taxpayer’s taxes and tax returns. The taxpayer denies that participation in the loyalty programme means its customers are income earners or are acting in breach of the ITA.
CommentaryThis case is a good test case for the High Court to review whether the wide powers of the DGIR to request for information can be challenged in a court of law. The development of the case thus far suggests that the DGIR is not immune from judicial review proceedings in relation to data protection laws. The DGIR’s right to information must be balanced against the taxpayer’s right to personal data protection especially in instances where the DGIR is suspected of utilising the ITA provisions to carry out unlawful fishing expeditions to gather information. Unless there are good and cogent evidence to suggest tax avoidance or evasion practice, the DGIR ought to be careful in its quest to seek for more information.
January 14, 2021