30 June 2021
TODAY, three in every four persons in Malaysia are using the MySejahtera (MySJ) app — the all-in-one contact tracing app developed to monitor public movement and tracing since the outbreak of Covid-19 last year — making it an obvious resource to be exploited.
Given its wide user base and abundance of valuable data, it is an open secret that many technology and IT companies have been attempting to persuade the government to put MySJ to good use when the pandemic is over.
In April, Communications and Multimedia Minister Datuk Saifuddin Abdullah observed that MySJ could be expanded to include the e-commerce, education and delivery services sectors, in addition to functioning as a one-stop platform or super app. He reportedly said if MySJ’s use were expanded, the app currently used by nearly 25 million Malaysians would be able to provide various services under one platform.
The Edge has learnt that several technology firms in the country, including e-wallet and e-payment players, have made overtures to MySJ on potential collaborations. Some of them intend to offer technological support to turn MySJ into a super app, whereas others have set their sights on accessing its huge database.
However, data privacy and security concerns of MySJ users will be among the top sensitive issues to be considered before the app can be transformed into a super app. If these issues are not adequately addressed, the government can expect considerable public backlash.
After all, MySJ was not meant to be used for commercial purposes when it was mooted last year. As such, Putrajaya has to tread very carefully lest it backfire on the administration.
According to MySJ’s website, the app was developed through a strategic cooperation between the National Security Council (NSC), the Ministry of Health (MoH), the Malaysian Administrative Modernisation and Management Planning Unit (Mampu), Malaysian Communications and Multimedia Commission (MCMC) and Ministry of Science, Technology and Innovation (Mosti).
MySJ was developed to support the implementation of the Prevention and Control of Infectious Diseases Act 1988 (Act 342). The app can be used by all Malaysians and residents of Malaysia, who can download it for free from Galeri Aplikasi Mudah Alih Kerajaan Malaysia, the App Store, Google Play Store and Huawei AppGallery.
“I don’t think you can touch the MySJ user base,” a CEO of a digital firm tells The Edge. “I know the MySJ guys really well and the MoH team that oversees the MySJ initiative. I can tell you there are things that you can and cannot do with the user database.”
He stresses that MySJ is governed under the Prevention and Control of Infectious Diseases Act 1988 (Act 342), which is an act that allows for actions under government agencies to execute certain things when fighting epidemics and pandemics. Thus, the data comes under tighter control than the regular Personal Data Protection Act 2010 (Act 709) (PDPA).
“Perhaps a ‘government super app’, where all government services can be made available on the app, would make better sense. But as I say that, can you imagine the challenges that will have to be addressed to launch these services?” says the CEO who prefers to remain anonymous.
“Of course, a ‘commercial super app’ also makes sense, given the database that MySJ has. But then again, it is hard to see how it could happen, with the legal and regulatory constraints.”
MySJ is owned and operated by the government of Malaysia. It is administered by MoH and assisted by NSC and Mampu. In line with the PDPA, the government had given the assurance that users’ personal information would be used only for the purpose of managing and mitigating the Covid-19 outbreak, and would not be shared with any other party.
Transformation will not be straightforward
Vision Group managing partner Chua Zhu Lian says MySJ’s transformation into a super app will not be as straightforward as just plugging data into a platform.
There are elements such as user-friendliness, user features as well as user value involved that require delicate planning, design and decades of hard work of continuous transformation from meeting ever-changing customer demands.
“Within the e-wallet space, we can already observe that only a few have produced apps that are used by their customers on a daily basis. If we continue going up the pyramid and assess how many eventually get close to becoming a super app, few players can really lay claim to their customers not being able to live without them [the apps],” Chua tells The Edge.
Vision Group is an integrated business enabler ecosystem comprising in-house infrastructure and subject matter experts in the field of banking and finance, technology and digital transformation.
To be a super app, a company will need to be an integrator of irreplaceable components of the user’s daily life, Chua points out. Examples of a truly successful super app are those by Tencent Holdings Ltd and Alibaba Group Holding Ltd, which transcend multiple elements of their users’ lives, from chats and calls to work management and payments.
Chua admits to being concerned about the data privacy of people volunteering the information, since MySJ was developed in a time of great need and to curb the spread of Covid-19. Moreover, the request for the public’s data was regulatory-driven.
“I believe it will be a very tricky situation to convert what was supposed to be a pandemic life saver into an app for commercial use. The stakeholders of MySJ will certainly need to handle this matter delicately before access is granted,” he cautions.
A check on MySJ’s privacy policy shows that the app will not record users’ personal data except when it is voluntarily given and with their permission.
The policy also states that personal data collected will be used for no purpose other than those related to managing Covid-19 — unless it is required to comply with a legal obligation. In addition, it emphasises that personal data collected by the app is not to be disclosed to any third party or transferred to a place outside of Malaysia for commercial purposes.
In terms of data confidentiality, personal data collected by the app will be kept confidential in accordance with the privacy policy, pursuant to any applicable laws that may take effect from time to time.
User data for “check-in” is stored for a period of 90 days and purged thereafter.
The privacy policy further states that the app implements security features that adhere to global standards to protect the confidentiality and security of user information. Data in transit is encrypted, while data at rest is stored in a highly secure server.
A potentially powerful app
A head honcho at a home-grown ACE Market-listed technology firm believes that, purely from a business perspective, MySJ can be an extremely powerful app, if the government wants it to be.
Realistically, though, he does not see it happening anytime soon. The project, if it materialises, will be very uncertain, owing to various sensitive issues such as privacy concerns and political factors.
“At this point in time, most business players will just keep their mouths shut and try to do things quietly, because it is such a sensitive topic,” says the head honcho, who believes that, for starters, the government should consider allowing MySJ to partner with e-commerce operators in selling healthcare and medical-related products. This business model will enable the operators in the marketplace to share revenue with the government, instead of having Putrajaya charge them a fee.
“To me, this kind of business model is a no-brainer. If they are open to such opportunities, there will be plenty of existing players willing to work with them,” he suggests.
“We are not one of those companies that are trying to gain access to the MySJ database. But I do understand the emotions of some e-wallet players, especially those that do not have a strong user base at the moment.”
Those that have much bigger user data may feel differently.
A technopreneur involved in the digital wallet business points out that big, established e-wallet players may be opposed to the idea of MySJ being turned into a super app, since these companies have already burnt so much cash — including massive amounts of marketing dollars — to expand their user base.
He explains, “To them, it will be very unfair for the smaller e-wallet players to tap into the MySJ database just like that. And then, obviously, there are also privacy, safety and cybersecurity concerns. Users do not want their personal data to be shared or leaked to a third party.”
The technopreneur believes, however, that there are still ways to overcome these challenges. “For example, we can allow users to opt in. If you want to use the additional features, then you opt in and give permission to MySJ to share your personal data. If you don’t opt in, then everything remains as it is. If that is the way to do it, then it will be less controversial.”
A CEO of a marketing technology company acknowledges that many companies hope to develop the next super app. Given that MySJ was set up to fight Covid-19, however, with citizens downloading the app and using it for non-commercial purposes, leveraging its database to build a business is not the right thing to do, he says.
“Super apps are a lucrative business if you can build a successful one. WeChat has proved it. And it takes a lot of product and marketing effort. Commercial entities such as Touch ’n Go and Grab want to become the leader in the space, so they have invested heavily. It is a free market for other e-wallet players to jump on the bandwagon, but they should build it with their own efforts, not by leveraging government efforts such as MySJ.
“Let us take a step back. We all downloaded MySJ because we know it is part of the government’s efforts to fight Covid-19. That’s the core of the app. A citizen’s understanding of the aforementioned fact shouldn’t be exploited by any company’s business purpose.”
View Original Article