KUALA LUMPUR (Dec 10): Malaysia may still not be ready to implement mandatory electronic Know-Your-Customer (e-KYC) verification for all social media users due to structural weaknesses in data protection and recurring large-scale breaches.
Under the government’s proposal, social media platforms must implement e-KYC verification — requiring users to upload identity documents such as their MyKad, passport, or MyDigital ID — by the end of the second quarter of 2026.
"While the government’s motivations are indeed legitimate, the implications are potentially severe [...] Malaysia still lacks a comprehensive data protection framework that binds government agencies, such as the MCMC [Malaysian Communications and Multimedia Commission]," Centre for Independent Journalism (CIJ) warned in its 2025 Freedom of Expression (FOE) report.
The watchdog argues that the policy could instead expose users to unprecedented privacy risks, intensify state surveillance, and severely restrict online expression.
It noted that Malaysians have long faced data breaches involving public and private institutions — including leaked identification databases — eroding public trust.
This vulnerability is compounded by newly amended provisions under the Communications and Multimedia Act 1998 (CMA), which widen the government’s ability to obtain, store and access user information under “broad and vague” investigatory powers.
Section 233 of the CMA, despite being ruled partially unconstitutional in its pre-amended form, remains the most frequently used instrument against online speech in 2025, according to the cases compiled by the watchdog in the report.
At the same time, the use of the Sedition Act rose sharply, with cases increasing by 84% to 36 from the previous year. Many investigations involved online comments relating to race, religion or royalty — or political criticisms that went viral on TikTok, Facebook or X (formerly Twitter).
“Embedding identity verification across digital interactions creates a worrying infrastructure for systemic, identity-linked surveillance,” CIJ said. With e-KYC, authorities could more easily map user interactions, track online communities and identify individuals engaged in political commentary or criticism.
The watchdog warned that e-KYC will intensify self-censorship among journalists, whistleblowers, activists and citizens already wary of punitive actions under the CMA and Sedition Act.
In 2025 alone, enforcement of freedom of expression-related laws surged 23% to 233 investigations, in what CIJ describes as an “expansive regulatory" ecosystem designed around deterrence.
The e-KYC policy also risks disproportionately excluding vulnerable groups — including the elderly, refugees, undocumented migrants, stateless persons and rural communities — many of whom lack formal identification or access to digital verification systems.
The exclusion of these groups, CIJ stresses, would narrow Malaysia’s digital participation and widen socio-economic divides.
The watchdog further added that civil society organisations Article 19 and Sinar Project cautioned that once normalised on social media, e-KYC requirements could extend to news portals, comment sections and messaging apps, creating a “function creep” that entrenches centralised identity control across the information ecosystem.