Author: Farihin Azlan

Mobile phone data (MPD) has emerged as a growing subject of public debate in Malaysia, driven largely by legitimate concerns surrounding privacy, surveillance and consent. High-profile data breaches in recent years have heightened public sensitivity, often overshadowing the broader societal value that MPD can offer when governed ethically, transparently and within existing legal frameworks. At its core, MPD refers to technical data generated when mobile devices interact with telecommunications networks, such as signal strength, duration of transmission and general mobility patterns. When anonymized and aggregated by licensed operators, this data cannot be traced back to individuals, nor does it reveal the content of calls, messages or online activity.

Globally, responsibly managed MPD has demonstrated its value as a public policy tool. Aggregated mobility data was widely used during the COVID-19 pandemic to guide public health responses, while in other contexts it has supported urban planning, transport optimization, tourism management and emergency response. In Malaysia, similar applications could help identify underserved communities, improve transport efficiency, strengthen disaster preparedness and enhance tourism strategies. However, unlocking this potential depends heavily on public trust and confidence in how data is handled.

Trust must precede technology. Public concern is less about whether MPD is useful, and more about who uses it, for what purpose, and under what safeguards. Transparency is therefore fundamental. Organizations collecting or processing MPD must clearly communicate the purpose, scope and protections in place before any data use occurs. Whether the goal is traffic management, rural development or tourism planning, openness, impact reporting and accountability are essential to reinforcing compliance with the Personal Data Protection Act (PDPA) and building public confidence.

Consent within the MPD ecosystem is embedded in the contractual relationship between consumers and their service providers. Telecommunications companies, bound by PDPA obligations, act as custodians of subscriber data. Any sharing with third parties should involve only anonymized and aggregated datasets processed by the telcos themselves, ensuring that no personally identifiable information leaves their control. This approach helps maintain privacy while enabling data-driven insights for public benefit.

Safeguards against misuse are equally critical. Even anonymized data carries risk if poorly managed, particularly through inference, where datasets are cross-referenced with other sources to enable re-identification. This underscores the need for strong anonymization combined with aggregation, strict access controls and responsible data stewardship. International best practices increasingly emphasize privacy-by-design, independent oversight and transparent governance as essential pillars of ethical data use.

Balancing civic benefit with privacy requires consistent standards across all stakeholders. Public trust erodes when data protection laws appear to be applied unevenly. For Malaysia to gain public acceptance, the same transparency, accountability and ethical standards must apply to all entities, public and private alike. Independent oversight, such as a data privacy commission, would further strengthen confidence by ensuring impartial enforcement and protecting against selective application of rules.

With strong safeguards, clear purpose and independent governance, MPD can evolve from a source of concern into a valuable national asset. Used responsibly, it can inform smarter investments, improve public services, support tourism growth and enhance long-term economic resilience, while respecting individual privacy. Malaysia’s digital ambitions and regional position present an opportunity to lead in ethical big data governance, demonstrating that technological progress and public trust can advance together.