Data Protection Challenges in Smart Cities: An Examination of the Malaysian Legal Framework
DOI:
https://doi.org/10.32890/uumjls2025.16.1.7Keywords:
Smart cities, data protection, artificial intelligence, comparative legal analysis, personal data protection actAbstract
Smart cities are the future of urban development as they incorporate state of the art technology to enhance the living standards of the citizens. However, these advances have real challenges in terms of data protection, more so in countries like Malaysia, where the legal aspects are still developing. This paper will critically analyze Malaysia's legal framework for data protection in the context of the Malaysian Smart City Framework and its data collection and processing practices. In this paper, the three fundamental principles of data protection, namely necessity, consent and safeguards will be examined. Using a comparative law approach, this research compares Malaysian laws with international standards, in particular the General Data Protection Regulation of the EU. This comparison shows some serious gaps and hurdles in Malaysia's approach, particularly with regard to protection from automated decision-making and surveillance technology. This research will also show that Malaysia must improve its legislation to ensure privacy will not be invaded when the smart city technologies are have already become so widespread. The findings advocate the need for Malaysian laws and policies to be positively realigned with technology to create a privacy-aware model and fit for purpose for the shifting requirements of smart urban arenas.
References
Ahmad, R. A., & Yeo, P. (2021). Malaysia Smart City Outlook 2021–2022 (pp. 1–130). Malaysian Industry-Government Group for High Technology. https://icsc-my.org/programmes/malaysia-smart-city-outlook-2021-2022-msco/
Alawadhi, S., Aldama-Nalda, A., Chourabi, H., Gil-Garcia, J. R., Leung, S., Mellouli, S., & Walker, S. (2012). Building understanding of smart city initiatives. Electronic Government: 11th IFIP WG 8.5 International Conference, EGOV 2012, Kristiansand, Norway, September 3–6, 2012. Proceedings (Vol. 11, pp. 40–53). Springer Berlin Heidelberg.
Alam, T. (2021). Cloud-based IoT applications and their roles in smart cities. Smart Cities, 4(3), 1196-1219.
Baron, M. (2012). Do we need smart cities for resilience? Journal of Economics & Management, 10, 32–46. https://www.ue.katowice.pl/fileadmin/_migrated/content_uploads/3_Baron_Do_We_ Need_Smart_Cities_for_Resilience.pdf
Bridges, L. (2021). Infrastructural obfuscation: Unpacking the carceral logics of the Ring surveillant assemblage. Information, Communication & Society, 24(6), 830-849.
Bu, Q. (2021). The global governance on automated facial recognition (AFR): Ethical and legal opportunities and privacy challenges. International Cybersecurity Law Review, 2(2), 113–145.
Bunders, D. J., & Varró, K. (2019). Problematizing data-driven urban practices: Insights from five Dutch ‘smart cities’. Cities, 93, 145-152. California Consumer Privacy Act, 2018 Cal. Legis. Serv. Ch. 55 (A.B. 375). https://oag.ca.gov/ privacy/ccpa
Cardullo, P., & Kitchin, R. (2019). Smart urbanism and smart citizenship: The neoliberal logic of ‘citizen-focused’ smart cities in Europe. Environment and Planning C Politics and Space, 37(5), 813–830. https://doi.org/10.1177/0263774X18806508#_i13
Caron, X., Bosua, R., Maynard, S. B., & Ahmad, A. (2016). The internet of things (IoT) and its impact on individual privacy: An Australian perspective. Computer Law & Security Review, 32(1), 4–15. https://doi.org/10.1016/j.clsr.2015.12.001
Chong, S. Z., & Kuek, C. Y. (2022, December). Facial recognition technology in Malaysia: Concerns and legal issues. International Conference on Law and Digitalization, (pp. 101–109). Atlantis Press. https://doi.org/10.2991/978-2-494069-59-6_10
Christofi, A., Wauters, E., & Valcke, P. (2021). Smart cities, data protection and the public interest conundrum: What legal basis for smart city processing? European Journal of Law and Technology, 12(1), 1–36. https://ejlt.org/index.php/ejlt/article/view/822
Communications and Multimedia Act 1998 (Incorporating latest amendment - Act A1220/2004) https://www.mcmc.gov.my/skmmgovmy/media/General/pdf/Act588bi_3.pdf
Drachsler, H., & Greller, W. (2016). Privacy and analytics: It is a delicate issue—a checklist for trusted learning analytics. Proceedings of the Sixth International Conference on Learning Analytics & Knowledge (pp. 89–98). https://doi.org/10.1145/2883851.2883893
Edwards, L. (2016). Privacy, security, and data protection in smart cities: A critical EU law perspective. European Data Protection Law Review, 2(1), 28–38. https://papers.ssrn.com/sol3/papers.cfm? abstract_id=2711290
European Data Protection Board. (2020). Guidelines 05/2020 on consent under Regulation 2016/679 (Version 1.1). https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202 005_consent_en.pdf
European Data Protection Supervisor (2017), ‘Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A Toolkit’. https://edps.europa.eu/sites/ edp/ files/publication/17-04-11_necessity_toolkit_en_0.pdf
European Parliament and Council. (2024, June 13). Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union.
Finch, K., & Tene, O. (2013). Welcome to the metropticon: Protecting privacy in a hyperconnected town. Fordham Urban Law Journal, 41, 1581–1604. https://ir.lawnet.fordham.edu/ulj/vol41/ iss5/4/
Fung, A. (2015). Putting the public back into governance: The challenges of citizen participation and its future. Public Administration Review, 75(4), 513–522. https://doi.org/10.1111/puar.12361
Gassmann, O., Böhm, J., & Palmié, M. (2019). Smart cities: Introducing digital innovation to cities. Emerald Group Publishing. https://www.researchgate.net/publication/333459285_Smart_ Cities_Introducing_Digital_Innovation_to_Cities
Giffinger, R., Fertner, C., Kramar, H., Kalasek, R., Pichler-Milanovic, N., & Meijers, E. J. (2007). Smart cities: Ranking of European medium-sized cities. Final report. Vienna University of Technology. https://www.researchgate.net/publication/261367640_Smart_cities_-_Ranking_ of_European_medium-sized_cities Heinz Huber v Bundesrepublik Deutschland, C-524/06, ECLI:EU:C:2008:724.
Islam, M. T., Sahula, M., & Karim, M. E. (2022). Understanding GDPR: Its legal implications and relevance to South Asian privacy regimes. UUM Journal of Legal Studies, 13(1), 45–76. https://doi.org/10.32890/uumjls2022.13.1.3
Kirwan, C. G., & Zhiyong, F. (2020). Smart cities and artificial intelligence: Convergent systems for planning, design, and operations (1st ed). Elsevier.
Koperal Zainal Mohd Ali & Ors v. Selvi Narayan & Anor 2021 6 CLJ 157. https://www.elaw.my/JE/ 01/JE_2021_19.pdf
Lawson, G. (1995). Outcome, procedure, and process: Agency duties of explanation for legal conclusions. Rutgers Law Review, 48, 313–357.
Lim, S. B., Abdul Malek, J., Hussain, M. Y., & Tahir, Z. (2021). Malaysia smart city framework: A trusted framework for shaping smart Malaysian citizenship? Handbook of Smart Cities (pp. 515–538). Springer International Publishing.
Lynn Jr, L. E. (2009). Restoring the rule of law to public administration: What frank goodnow got right and leonard white did not. Public Administration Review, 69(5), 803–813. https://doi.org/10.1111/j.1540-6210.2009.02030.x
Ministry of Housing and Local Government. (2018). Malaysia Smart City Framework. https://www.kpkt.gov.my/kpkt/resources/user_1/GALERI/PDF_PENERBITAN/FRAMEWORK/FRAME WORK_SMART_CITY_EXECUTIVE_SUMMARY.pdf
Nam, T., & Pardo, T. A. (2014). The changing face of a city government: A case study of Philly311. Government Information Quarterly, 31(Suppl. 1), S1–S9. https://doi.org/10.1016/j.giq.2014. 01.002
Nor, M. A. B. M., Tasrib, M. A. B. M., Francis, B., Hesham, N. I. B., & Othman, M. B. B. (2021). A study on the laws governing facial recognition technology and data privacy in Malaysia. Malaysian Journal of Social Sciences and Humanities, 6(10), 480–487. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1.
Samsudin, N. A., Rosley, M. S. F., Lai, L. Y., Omar, S. R., Rashid, M. F., Hanifi, N. S. N. M., & Bakhtiar, I. S. (2022). A comparative study of smart city initiatives in Malaysia: Putrajaya and Iskandar Puteri. Planning Malaysia Journal, 20(5), 1–20. https://doi.org/10.21837/pm. v20i24.1180
Sarker, I. H. (2022). Smart City Data Science: Towards data-driven smart cities with open research issues. Internet of Things, 19, 100528. https://doi.org/10.1016/j.iot.2022.100528
Saxena, S., & Al-Tamimi, T. A. S. M. (2018). Visioning “smart city” across the Gulf Cooperation Council (GCC) countries. Foresight, 20(3), 237–251. https://doi.org/10.1108/FS-11-2017-0068
Taylor, L. (2017). What is data justice? The case for connecting digital rights and freedoms globally. Big Data & Society, 4(2). https://doi.org/10.1177/2053951717736335
The Malaysian Communication and Multimedia Commission. (2008). Video surveillance in public space. https://www.scribd.com/document/707530753/CCTV-report-MCMC
The Singapore Personal Data Protection Act (2012). https://sso.agc.gov.sg/Act/PDPA2012
Vasseur, J. P., & Dunkels, A. (2010). Interconnecting smart objects with IP: The next internet. Morgan Kaufmann. https://www.researchgate.net/publication/234817468_Interconnecting_Smart_Ob jects_with_IP_The_Next_Internet
Vitunskaite, M., He, Y., Brandstetter, T., & Janicke, H. (2019). Smart cities and cyber security: Are we there yet? A comparative study on the role of standards, third party risk management and security ownership. Computers & Security, 83(6), 313-331. https://doi.org/10.1016/j.cose. 2019.02.009
Walz, A., & Firth-Butterfield, K. (2019). Implementing ethics into artificial intelligence: A contribution, from a legal perspective, to the development of an AI governance regime. Duke Law & Technology Review, 18, 176–200.
Published
Issue
Section
License
Copyright (c) 2025 UUM Journal of Legal Studies
This work is licensed under a Creative Commons Attribution 4.0 International License.
How to Cite
Research impact
Harvested 2026-09-06Counts differ between services because each indexes a different body of literature. None of them is the whole picture.
