I refer to the letter by Belkisa Lim and would like to respond to some of the questions raised.

Foot-dragging by the government with regard to the Data Protection Act has been going on since 2001, when the government first intimated that it was drafting a DPA.

Since then, the DPA has been through a couple of drafts but it seems to be that it will remain forever the ungazetted bridesmaid, so to speak.

One of the significant downsides to the Bill is that it does not contain an explicit provision of the Right to Privacy. In most countries, this is a constitutional right, which means that it cannot be removed or abolished or repealed (generally without a significantly large majority - not always a foolproof way of safeguarding something).

Nor does the Malaysian Federal Constitution, which governs our rights as citizens, contain any explicit or positive proviso granting an affirmative right to privacy.

What does this mean? This means that nosy, prying, peeping-toms will continue to remain unprosecutable unless they happen to commit some other ancillary crime (ie. breaching your privacy is not an offence but outraging your modesty might).

It means naked pictures of your wife or husband, circulated on the Internet by a third party, would not be a breach of privacy, but might be linked to porn distribution as an offence. It means if your employer decides to install CCTVs, there's nothing to govern how or what they can and cannot do with the tapes and where they can and cannot put the CCTVs.

Technically, this means they could put it in toilets to make sure you're not spending too much time there! This also means that employers are free to read your corporate email, scan it for references (such as: "the boss is an idiot") and also means that anyone else can eavesdrop electronically on you and not face any recriminations, not even from you in a private lawsuit. (You could sue in tort but do not expect to win).

One suspects that one of the key reasons why the DPA has not gotten passed is because it fundamentally acts against the interests of the government, which in many respects, is the largest and most significant collector of personal information.

If you consider the number of times you need to submit your IC for even the most mundane things, you'll realise just how much information is being collected.

This is because the bill prohibits many of the kinds of activities that would be consistent with having a free reign of the database - such as merging information, looking for patterns or trails (if MyKad becomes used as an electronic wallet), examining information and then profiling it racially, selling the information, having in accurate information and correcting inaccuracies.

The government would also bear the legal responsibility (and hence, be open to lawsuits) for ensuring the data is secure and is not accessible by persons whom the data relates to.

Despite the many offences, the bill is very weak on punishment. There are provisions for fines but a lot of it is being held at the discretion of a person known as the Commissioner.

But because all of this is not yet law, it means that Genting Highlands can legally draw on or be linked to the MyKad database and make use of the information there. There is no recourse legally because there is no data protection act to regulate the collection, merging and access to personal data and no privacy act in which to base a right to privacy (and therefore subsequent invasion of privacy) on.

It's a grim picture indeed. But there are steps that you can take to keep Big Brother at bay. Be very careful with whom you volunteer personal information to, especially things like mobile phone numbers, IC numbers, address (use your office address if possible) and any other personal details.

It is your right to be reluctant to divulge this information and your right to know why this information is necessary. Avoid giving out your information for any tiny pointless free gift because your personal information is valuable .

Finally, make it a point to inform any company that you believe have access to MyKad's database that this is an unethical practice.