Big Data, Bigger Debate: Malaysia’s PADU System and the Future of Digital Governance

INTRODUCTION

In the rapidly evolving landscape of digital governance, nations worldwide are grappling with the challenges and opportunities presented by large-scale data integration initiatives. Malaysia’s recent foray into this arena, the Pangkalan Data Utama (PADU) or Central Database Hub, represents a bold step towards centralised data management. However, it ignited a firestorm of debate over issues of privacy, federalism, and the very nature of the social contract between citizens and the state. This analysis examines the PADU initiative, its objectives, implementation challenges, and the varied responses it has elicited from different segments of Malaysian society.

THE PADU VISION: PROMISES AND PITFALLS

At its core, PADU embodies the Malaysian government’s aspiration to streamline public service delivery and enhance policymaking through comprehensive data integration. The initiative aims to consolidate a vast array of personal and socioeconomic data from various government agencies into a single, unified database. This centralisation, proponents argue, will enable more efficient resource allocation, reduce bureaucratic redundancies, and facilitate more targeted policy interventions.

The potential benefits of such a system are indeed compelling. In theory, PADU could simplify citizens’ interactions with government services, from tax filing to welfare applications. For policymakers, the rich dataset could offer unprecedented insights into population demographics, economic trends, and social needs, potentially leading to more responsive and effective governance.

However, implementing this vision is not without its challenges. The extensive data integration required for PADU presents significant technical difficulties. Ensuring data accuracy, managing updates across multiple agencies, and maintaining system integrity are complex tasks that necessitate not only technological solutions but also strong institutional and regulatory frameworks.

Moreover, the centralisation of such vast amounts of personal data inevitably raises privacy concerns. In an era marked by frequent data breaches and, consequently, by heightened awareness of digital rights, the government faces the challenge of assuring citizens that their personal information will be properly protected. Concerns about surveillance and potential misuse of data for political purposes are prominent in public discussions; these highlight the need to balance administrative efficiency with individual privacy rights.

REGIONAL REACTIONS: SARAWAK’S STRONG NEGATIVE RESPONSE

Sarawak’s response to the PADU initiative provides an interesting example of the challenges involved in implementing national digital projects within a federal system. The state’s decision to pause participation in PADU, announced in March 2024, drew attention to the complex relationship between federal and state governments in Malaysia.

In March 2024, the Sarawak government made a significant announcement: the state would halt its participation in PADU. This decision seemingly stemmed from concerns over preserving Sarawak’s autonomy and safeguarding its citizens’ personal data. The state government’s stance underscores Sarawak’s careful approach to federal initiatives that could potentially impact its self-governance. Following this announcement, a directive was issued to all state ministries, departments, and the Resident’s Office, instructing them to temporarily cease registering Sarawakian citizens’ information in the PADU system until further notice. This instruction was further disseminated to community leaders, village heads, and Village Development and Security Committees (JKKK) across the state.

This move stems from multiple concerns. Firstly, there are apprehensions about data sovereignty, specifically regarding the storage of Sarawakians’ personal data outside state jurisdiction. Secondly, scepticism exists among Sarawak ministers, including the Tourism, Creative Industry, and Performing Arts Minister, Abdul Karim Rahman Hamzah, regarding the true motives behind PADU’s data collection. There are concerns that the data could be used for political purposes, particularly during elections. This concern aligns with a global trend of scepticism towards public data collection and the use of technology for political microtargeting.

Additionally, Sarawak has developed its own centralised data system, the Sarawak Government App, managed by the Service Modernisation Unit under the Chief Minister’s Department, which is considered sufficient for the state’s needs. Furthermore, earlier federal government initiatives, such as e-Kasih (national poverty database), BR1M (Bantuan Rakyat 1 Malaysia), Prihatin, among others, are deemed adequate for the distribution of subsidies. These factors, along with concerns about potential personal data breaches, have reinforced the decision to postpone the PADU registration. Sharifah Hasidah Sayeed Aman Ghazali, the Deputy Minister in the Sarawak Premier’s Department (Law, MA63, and Sarawak-Federal Relations), has raised further concerns about the lack of comprehensive privacy laws in Malaysia. She noted that, unlike other countries with specific Privacy Acts, Malaysia relies primarily on the Personal Data Protection Act 2010 (PDPA 2010), which is focused on regulating the processing of personal data in commercial transactions. While the PDPA outlines basic data protection principles such as consent, purpose limitation, and data security, she emphasised that it is not a comprehensive ‘privacy rights’ law and does not fully address broader privacy concerns.

However, since Sharifah Hasidah’s statement in March 2024, the PDPA 2010 has been amended to better address privacy issues. The PDPA (amendments) 2024 include the mandatory appointment of a Data Protection Officer (DPO) by data controllers and processors, a requirement for data controllers to notify the Personal Data Protection Commissioner of data breaches, and an increase in the maximum penalty for breaches of the principles under the PDPA, from MYR 300,000- and two-years’ imprisonment to MYR 1 million- and three-years’ imprisonment. Additionally, the rules regarding data transfers have been updated, allowing data controllers to transfer personal data outside Malaysia if the destination country has laws substantially similar to the PDPA or provides an adequate level of protection equivalent to that of the PDPA.

Sarawak’s position on the PADU initiative carries substantial weight due to its unique status within Malaysia. With a population of 2.5 million and the largest land area in the country, the state holds a pivotal role in the national implementation of such programmes. Its diverse population, which includes many indigenous communities, makes it a critical area for testing national policies. Additionally, Sarawak’s autonomy, granted under the Malaysia Agreement of 1963, allows it more control over internal affairs such as education and resource management. This legal autonomy means that federal initiatives like PADU might need to be more thoroughly adapted to fit Sarawak’s distinct governance and priorities.

PUBLIC REACTIONS: THE CASE STUDY OF REDDIT

Why Reddit?

The announcement and implementation of PADU sparked significant public interest and concern across various social media platforms, including Reddit. For this analysis, I choose to focus on Reddit due to its unique structure and the nature of the discussions it fosters. Unlike more popular platforms like Facebook, Instagram, X (formerly Twitter), YouTube, and TikTok, Reddit offers a distinct interactive experience that emphasises community-driven discussions and in-depth conversations. This makes it an ideal platform for analysing public sentiment and discourse surrounding PADU.

As of March 2024, Reddit boasts 1.22 billion users worldwide, with over 306 million weekly active users and more than 100,000 active communities, known as subreddits. Each subreddit functions as a dedicated space for discussions and content sharing on specific topics, similar to how forums or communities operate on other platforms. While Reddit does not rank among the top 10 most popular social media platforms in Malaysia, it still has a notable presence, with subreddits like r/Malaysia having around 909,000 active users and r/Bolehland having about 111,000 members as of July 2024.

Despite its relatively smaller user base in Malaysia, Reddit’s community-driven nature and focus on detailed discussions provide valuable insights into public sentiment. The platform’s structure supports sustained engagement, enabling users to share their views, disseminate information, and debate complex topics such as PADU. This makes Reddit a pivotal space for citizens to articulate their opinions and engage in meaningful dialogue about new systems and policies.

One of Reddit’s most notable features is its upvote and downvote system, which allows users to collectively determine the visibility and prominence of posts and comments. This system ensures that contributions deemed valuable or insightful rise to the top, while less relevant content is pushed down, resulting in a more curated and community-driven dialogue. Additionally, Reddit’s semi-anonymous nature encourages users to express their views more freely, allowing for a broader range of perspectives and more nuanced exploration of complex topics.

Reddit’s moderation system, which relies on community moderators and site-wide policies, helps maintain the quality of discourse by enforcing rules that discourage low-effort or disruptive content. This moderation, coupled with the platform’s encouragement of self-regulation, fosters an environment where substantive discussions can thrive. In the context of PADU, Reddit has served as a critical space for Malaysian citizens to scrutinise the initiative, share concerns, and engage in extended debates, making it an essential venue for gauging public sentiment and understanding the broader implications of PADU for different segments of the population.

For this analysis, I examined popular discussion posts with either more than 100 upvotes or more than 100 comments in two Malaysian subreddits, r/Malaysia and r/Bolehland, between 1 January 2024, and 1 April 2024 (PADU registration ended at 11:59 pm on 31 March 2024; see Table 1). While comments on Reddit may not provide a comprehensive representation of public opinion on PADU, this analysis offers valuable insights into prevailing perceptions and concerns surrounding the system.

Table 1: Selected subreddits related to PADU between 1 January 2024 – 1 April 2024

	Posts related to PADU within the subreddits	Subreddit	Date posted	Upvotes	Total comments
1	Explaining PADU to all the monyets	r/Malaysia	23 March 2024	226	169
2	Even if you don’t PADU, you still got PADU-ed	r/Malaysia	1 April 2024	673	143
3	Bentangkan PADU biar terang	r/Malaysia	23 March 2024	279	88
4	Another Vulnerability Exposed by People for the padu.gov.my website	r/Malaysia	2 January 2024	260	72
5	Sarawak wants PADU halted, questions why citizens should ‘bare naked’ confidential data	r/Malaysia	23 March 2024	196	90
6	Have you PADU yet? If not? Why yet don’t?	r/Malaysia	8 January 2024	155	181
7	PSA Please Register Your PADU Account Now at https://padu.gov.my/	r/Malaysia	2 February 2024	128	89
8	Padu developed using outdated methods, says cybersecurity expert	R/Malaysia	29 March 2024	124	70
9	Did you PADU or not?	R/Malaysia	20 March 2024	110	178
10	What’s your reason not registering PADU	R/Bolehland	18 March 2024	144	137
11	Rafizi response to accusation PADU getting hack	R/Bolehland	20 February 2024	319	105
12	Korang, aku nak tanya ni. Semua rakyat Malaysia wajib ke daftar PADU? Kalau tak daftar tak boleh ke? Korang dah daftar ke belum?	R/Bolehland	28 February 2024	62	141
TOTAL				2676	1463

N=1463 comments analysed

ANALYSIS OF PUBLIC SENTIMENT BASED ON REDDIT DISCUSSIONS

The public reaction to the PADU initiative, as observed through Reddit discussions, presents a nuanced landscape of concerns, criticisms, and scepticisms. These discussions, primarily from the subreddits r/Malaysia and r/Bolehland, offer a detailed view of how different segments of the population perceive the PADU initiative. This analysis identifies key themes such as security concerns, opacity of government intentions, scepticism about the system’s capabilities, criticism of government policies, and reasons for not registering for PADU.

Figure 1: Thematic analysis of collected comments (n=1463) on subreddits as analysed using Nvivo.

Figure 2: Word cloud of the most frequently used words in the analysed comments (n=1463).

Concern over data security: a dominant theme

Security concerns are the most frequently discussed issue among Reddit users regarding PADU (see Figure 1 and Figure 2). Many users express significant anxiety about the government’s ability to safeguard sensitive personal data from breaches or unauthorised access. These fears are well-founded, considering Malaysia’s history of high-profile data leaks that have compromised personal information and weakened public trust. For example, a report by Surfshark ranked Malaysia as the eighth most breached country in Q3 2023, with 494,699 accounts compromised. Reflecting this anxiety, one Reddit user pointed to a specific incident where the Sabah government’s official website was hacked, compromising 109 files from state agencies and illustrating the potential risks associated with government data security.

Reddit users are particularly critical of the perceived lack of urgency and transparency from the government in addressing these concerns (see Figure 3). Discussions often cite past incidents where Malaysian officials had downplayed the seriousness of data breaches, placing blame on individuals rather than acknowledging institutional weaknesses. This has further eroded public confidence in the government’s commitment to safeguarding data. The fear of identity theft and unauthorised use of personal information is a common theme, with many users feeling that the government’s assurances about data protection are insufficient.

Figure 3: Screenshot of one of the comments in r/Malaysia by user @65726973616769747461.

The opacity of the government’s intentions: Fueling distrust

A major concern is the perceived lack of transparency regarding the government’s intentions with the data collected through PADU. Many Reddit users are uncertain about the scope and purpose of the data collection, leading to widespread speculation and anxiety. The absence of clear communication from the government has heightened fears of potential misuse, particularly for surveillance or political manipulation. This ambiguity has fuelled public distrust, and many interpret the government’s silence as an indication of ulterior motives. Users have consistently called for greater transparency, seeking detailed explanations on the specific types of data being collected, how these will be used, and who will have access to it. Without clear answers, these concerns continue to undermine trust in the PADU initiative.

Scepticism about system capabilities and benefits

Scepticism about PADU’s potential effectiveness and its actual benefits remain a dominant concern in Reddit discussions. Users frequently question whether the centralised database will result in tangible improvements to government services and have a positive impact on daily life. Many cast doubt on the government’s technical capacity to manage such a large-scale system, especially considering previous instances where outdated technology and inadequate infrastructure have hindered similar efforts. A recurring fear is that PADU may be used as a tool for surveillance or control, rather than for improving the efficiency or quality of public services.

To address these concerns, the government must prioritise transparency in the technical implementation of PADU. Policy recommendations include conducting third-party audits of PADU’s technological infrastructure and publishing detailed reports on how data security, storage, and management will be handled. Additionally, implementing a pilot programme to test the system’s efficiency and security before full-scale deployment would build public confidence and reveal potential weaknesses early on. These measures would also mitigate concerns about whether PADU can manage large datasets without facing the same issues seen in other government systems.

Criticism of government policies and broader concerns

Beyond technical concerns, criticism also extends to the broader policies surrounding PADU. Many users raise alarms about potential conflicts of interest, particularly around the management of personal data by unknown or unaccountable third-party controllers. This lack of clarity raises serious questions about oversight, accountability, and the risk of political manipulation. Concerns about outdated methods of data handling and management have further fuelled public unease, leading to broader criticisms of the government’s digital governance strategy.

For PADU to gain public trust, the government needs to establish robust accountability mechanisms. Policy recommendations include creating an independent oversight body responsible for monitoring the data collection, usage, and storage processes. This body should have the authority to enforce strict compliance with data protection laws and to investigate any instances of misuse. Additionally, strengthening the existing Personal Data Protection Act (PDPA) with specific provisions addressing public sector data collection and enhancing legal recourse for violations would provide much-needed legal backing and reassurance to the public.

CONCLUSION

In conclusion, Malaysia’s PADU system represents a significant leap towards centralised data management and digital governance. However, it also highlights the complexities and challenges that come with such an initiative. The concerns raised by various stakeholders, from technical hurdles to privacy issues and federal-state tensions, underscore the need for careful consideration and robust safeguards.

As Malaysia moves forward with PADU, it will be crucial to balance the potential benefits of streamlined governance and data-driven policymaking with the imperative of protecting citizens’ rights and maintaining public trust. The ongoing debates and reactions, particularly on platforms like Reddit, reflect a vibrant discourse on the future of digital governance in Malaysia, signalling a need for transparency, inclusivity, and continuous dialogue between the government and its citizens.

---

This is an adapted version of ISEAS Perspective 2024/100 published on 28 November 2024. The paper and its references can be accessed at this link.