Digitalising Energy: Navigating the Protection of Consumer Rights and Privacy in Malaysia

Abstract

The digitalisation of the energy sector, driven by technologies such as smart infrastructure, Internet of Things (IoT) devices, and AI-powered energy management systems, has transformed the way consumers interact with energy services. While these technologies offer greater efficiency and convenience, they also raise important legal concerns regarding consumer data privacy, transparency, informed consent, and data security. This article examines the legal implications of digital energy technologies, with particular attention to how energy providers collect, process, and use consumer data and the risks associated with data security breaches. Using doctrinal and comparative legal methods, the article analyses Malaysia’s Personal Data Protection Act 2010 (PDPA), including the reforms introduced by the Personal Data Protection (Amendment) Act 2024, against the European Union’s General Data Protection Regulation (GDPR). The analysis assesses whether Malaysia’s post-amendment framework adequately protects consumers against the privacy risks associated with increasingly data-driven energy services. Although the recent amendments have strengthened Malaysia’s data protection framework, several regulatory concerns remain, particularly in relation to transparency, consumer control over personal data, and the governance of emerging digital technologies. The article concludes that further sector-specific safeguards and effective enforcement mechanisms are necessary to strengthen consumer autonomy, privacy, and data security in Malaysia’s digital energy sector.