Summary and Facts
In Ketua Pengarah Hasil Dalam Negeri v Genting Malaysia Bhd [2025] 2 MLJ 822, the Court of Appeal considered the legality of a data disclosure request by the Director General of Inland Revenue (“DGIR”) and the implications of the Personal Data Protection Act 2010 (“PDPA”) on such requests.
Genting Malaysia Bhd, which operates a large-scale resort and customer loyalty programme, was requested by the DGIR to disclose personal data of its loyalty cardholders to assist in income tax profiling. Genting refused, citing protection under the PDPA. The DGIR then sought clarification from the Personal Data Protection Commissioner (“PPDP”), who confirmed via a letter that disclosure was permissible under Section 39(b)(ii) of the PDPA and Section 81 of the Income Tax Act 1967 (“ITA”).
Relying on this, DGIR forwarded the PPDP’s letter to Genting. In response, Genting initiated judicial review proceedings, seeking to quash both the PPDP’s confirmation letter and DGIR’s follow-up email. The High Court granted the judicial review, holding that the request for personal data contravened the PDPA and the right to privacy. DGIR appealed against this decision.
Legal Issues
• Whether the DGIR’s forwarding email constituted a reviewable decision under Order 53 Rule 2(4) of the Rules of Court 2012.
• Whether Genting’s judicial review application was time-barred under Order 53 Rule 3(6).
• Whether the DGIR’s request for personal data fell within the scope of Section 81 of the ITA.
• Whether compliance with Section 81 ITA would amount to a breach of the PDPA.
Court’s Findings
• The Court of Appeal allowed the DGIR’s appeal and overturned the High Court’s decision.
• The Court ruled that DGIR’s email forwarding the PPDP’s letter was not a decision that altered Genting’s legal rights or obligations, and therefore did not meet the threshold of a reviewable decision under judicial review.
• The Court further found that the judicial review application was time-barred, as it was filed significantly outside the three-month window prescribed by Order 53 Rule 3(6). The latest relevant correspondence was dated 13 May 2019, while the application was only filed on 7 February 2020.
• Due to the above jurisdictional findings, the Court did not address the substantive issue of whether the request breached the PDPA.
Practical Implications
This case highlights two key takeaways: First, not all government communications are subject to judicial review — only those that legally affect rights or obligations. Second, strict timelines apply; judicial review must be filed within three months, or it risks dismissal regardless of merit. For companies like Genting, it’s a reminder to act swiftly when challenging regulatory demands, especially involving personal data.