The Malaysian Communications and Multimedia Commission (MCMC) has reportedly directed the Malaysia’s telecommunications firms to provide detailed records of phone calls and internet usage as part of a data initiative known as the “Mobile Phone Data” project. According to the South China Morning Post (SCMP), which cited two unnamed industry sources, the commission allegedly issued a letter in April instructing telcos to submit logs covering the first quarter of 2025.
These logs reportedly include metadata such as call histories, IP call records, and precise geolocation coordinates. SCMP added that MCMC has warned companies that failure to comply with the request would constitute an offence under the Communications and Multimedia Act. Telcos that refuse to hand over the requested data risk a penalty of RM20,000 or up to six months in jail.
“They are asking for call records, IP call records, location, latitude and longitude,” one source told SCMP. “We have asked MCMC about transparency and accountability for the use of the data. We don’t know if MCMC will make a public statement that such an exercise is under way.”
The development comes amid growing public concern over data security in Malaysia, particularly following a series of cyberattacks and personal data breaches. Just last month, the personal WhatsApp account of Home Minister Saifuddin Nasution Ismail was confirmed to have been compromised by an “unidentified and irresponsible party.” Authorities have since advised the public to exercise caution and avoid responding to any messages or calls claiming to be from the minister.
Such concerns are not without precedent. In 2017, Malaysia experienced one of its worst data leaks, where information belonging to 46.2 million mobile users was stolen and sold on the dark web. The breach affected customers of major telcos such as CelcomDigi, Maxis, and U Mobile. It also included leaked records from medical bodies such as the Malaysian Medical Council (MMC), the Malaysian Medical Association (MMA), and the Malaysian Dental Association (MDA).
Given these incidents, privacy advocates are likely to call for stronger oversight and clearer reasons for government data collection. Without transparency or clear communication, the move could spark more debate over the balance between security and privacy.
MCMC has yet to issue a statement regarding the reported directive. Until official clarification is provided, it is best to view SCMP’s information with scepticism.
(Source: SCMP)
