Is it right to divulge Covid-19 patients’ personal data to other residents?

Covid-19 infections among members of strata communities have been seen to increase drastically as the pandemic rages on in the nation.

The pandemic has changed the way homeowners use and enjoy the common properties of their subdivided buildings. While they are expected to contribute to the maintenance, management and the upkeep of the strata development as a whole, their rights to use and enjoy the common properties have come under significant control and regulation.

The promulgation of the movement control order (MCO) under the Prevention and Control of Infectious Diseases Act 1988 and the Police Act 1967, coupled with the recent declaration of Emergency has led strata dwellers to increasingly ask themselves what is or what is not permissible in law.

One such subject is whether the Joint Management Body, Management Corporation (MC) or Sub-MC (collectively referred to as “management bodies”) has the powers to disclose personal details such as the names or unit numbers of Covid-19 patients to other residents (whether expressly requested by them or disclosed by the management bodies on their own accord).

For ease of discussion, reference here will be made to the MC alone.

The MC is a body corporate having perpetual succession and a common seal which may sue and be sued – Section 17(4) Strata Titles Act 1985. The authority that the general body exercises, is exercised on behalf of all proprietors for their common benefit in relation to their common property. Its powers are limited to regulating control over maintenance and management of the subdivided building or land and the common property in the strata development, pursuant to the Strata Management Act 2013 (SMA).

Communication skills in managing crisis

While strata proprietors presently find themselves in the height of struggle deciphering misinformation and conflicting accounts of what is permissible and what is prohibited, a worrying trend has emerged in the Malaysian property management scene where a frenzy of misquoting and erroneous citing of legislation in circulars, notices and newspaper articles are widespread.

Although most of them are inadvertent mistakes made by laymen, some of such instances could have been avoided. For instance, some circles have cited the Personal Data Protection Act 2010 (PDPA) against MCs disclosing personal data of residents.

The fact is, although the common ground is that personal data of Covid-19 patients or that of their families cannot be disclosed to other residents, making reference to PDPA is wrong.

The Court of Appeal in Amber Court Management Corp & Ors. (suing in their capacity as council members) v Hong Gan Gui & Anor [2016] stated that the MC is neither a trading nor a non-trading corporation. It follows, therefore, the MC is not a commercial entity and its dealings with proprietors are not commercial in nature.

In the absence of any case precedent, any suggestion that the PDPA applies to MCs is perhaps stretching the legislative intent a little too far.

The PDPA is intended to regulate the processing of personal data of subjects in commercial transactions with data users and it provides for matters connected therewith and incidental thereto.

The pandemic has shown the need for management bodies and their appointed property managers to improve their communication and crisis management skills. It includes alerting the relevant authorities when coronavirus cases are detected, displaying appropriate notices for residents and handling matters pertaining to home quarantine.

Keeping the community informed of the latest standard operating procedures is necessary. This is because no one really knows how long this pandemic would last or when the next transmissible disease would break out. It is of utmost importance that provisions of essential services such as utilities, security and cleaning service must not be disrupted.

Misguided proposals may lead to prejudice

Without a full understanding of the prevailing laws, some misguided property managers may propose issuing documents to obligate residents into consenting to disclosure of their personal details. Purportedly, such disclosures would enable the majority of the residents to take extra precautions to stay safe from any potential infection.

Even so, the minority’s right to peacefully recover in their own homes while under quarantine or the right to return to their homes after treatment without being subjected to unpleasant shunning and social stigma, must turn the scale against the will of the majority.

Also, to leave such annihilatory decisions to the province of property managers or the management committees is frankly inappropriate. The material prejudice the minority could suffer has wide-ranging negative social and legal consequences on communities. Social distancing need not lead to social division!

Although the powers to collect and deal with personal data are limited and restricted to the course of performing their duties and functions under the SMA, there is more to this than meets the eye.

The truth is, in carrying out their statutory duties, they can, and often do, collect personal data such as names of proprietors, their contact details, identity card numbers, details of their property including parcel share units and vehicle numbers, names of visitors or emergency contacts, as well as the names and addresses of the sale and purchase agreement lawyers who act for the proprietors and even thumbprints. That’s a substantial amount of personal data collection, come to think of it.

Property managers or the security guards of a condominium are all data intermediaries who collect and process personal data on behalf of the MC. There is a possibility these data intermediaries may abuse residents’ personal data.

The SMA and the regulations therein do not clearly spell out the remedies available to proprietors in this regard. The dealing with residents’ personal data must confirm what is expressly provided for in the SMA or may be fairly regarded as incidental to those powers. For example, the MC has no business collecting marriage certificates or bank statements or school report cards!

It is trite law that a body created by a statute only has powers granted expressly or by implication in that statute. The obligations and powers of the MC are set out in Section 59 of the SMA wherein subsection (2) reads: “The powers of MC shall be as follows: …”.

Although it is not always imperative, it is correct to hold that the phrase is couched in mandatory conclusive terms. Therefore, to solve the conundrum of whether MCs can disclose personal details to other residents, one needs to look no further than the SMA.

Lacuna in the SMA vis-à-vis personal data

There is no real attempt to develop and implement policies on the proper handling of personal data by MCs. This was hardly even debated adequately when the SMA was enacted.

When proposals for reform of the SMA are put forth, it is hoped that the Bar Council Malaysia will lead the discourse and pave the way to introduce the necessary safeguards against the abuse of personal data.

These are legal questions on the rights and liabilities of proprietors and the duties and powers of the MC. Such discourse must involve adequate legal analysis.

Saraswathy Shirke Deo, Esq, is a legal practitioner and Datuk Chang Kim Loong is the Hon Secretary-general of the National House Buyers Association (HBA).

HBA can be contacted at:
Email: [email protected]
Website: www.hba.org.my
Tel: +6012 334 5676

This story first appeared in the EdgeProp.my E-weekly on March 5, 2021. You can access back issues here.

Get the latest news @ www.EdgeProp.my

Subscribe to our Telegram channel for the latest stories and updates 

Click here for more property stories