Axiata Group Berhad 16%

OVERALL – 16%

Axiata’s overall score was second to last among telecommunications companies, near the bottom of a cluster of four companies that scored between 14-18 percent. Malaysia was rated “Partly Free” in Freedom House’s 2015 “Freedom on the Net” index. Celcom, Axiata’s subsidiary in Malaysia, is subject to the country’s license, rules and regulations – many of which are not published or made available to the public.

Nonetheless, Malaysia’s legal and regulatory environment does not prevent Axiata from making explicit commitments to respect users’ rights and from improving its disclosure of policies and practices that affect users’ freedom of expression and privacy. This commitment gap and the company’s low relative performance provide a natural point of engagement for stakeholders and the company. Beyond this, and in light of the fact that regulators are known to impose content restriction in Malaysia, it is even more important that Axiata discloses its process for responding to government requests and publishes of a transparency report, especially considering there are no known legal restrictions on at least minimal disclosure.

COMMITMENT – 0%

Axiata was the only company in the Index to receive no credit for any element in this entire category. While all companies are subject to the prevailing laws and regulations in the markets in which they operate, there is no clear justification that precludes Axiata from performing better on this category. As stated above, the company’s complete failure to provide relevant disclosure here provides a strong point of dialogue for engagement between stakeholders and company representatives.

FREEDOM OF EXPRESSION – 23%

Axiata placed fifth out of eight telecommunications companies on Freedom of Expression, although its score was less than half that of the leading telecommunications company, Vodafone. Axiata’s Malaysian operating company Celcom received credit for making its terms of service available (F1), and for disclosing some information on reasons why it would restrict content or access to the service (Indicators F3 and F4).

Transparency about requests for content restriction and enforcement of terms of service: A major gap remained with respect to the company’s policies and practices that affect freedom of expression, including enforcement of terms of service, user notification about content or account restriction, and the company’s response to third-party requests to restrict content or access to the service. Malaysian laws, to our knowledge, do not limit the ability of Axiata and Celcom to disclose even general information concerning these issues. As with most jurisdictions, laws can limit company disclosures; in Axiata’s case, the Malaysian Official Secrets Act 1972 may prevent it from disclosing some information about requests, but it is unrealistic that this law affects every governmental request that Axiata receives.

Network management: Celcom was transparent in stating that it performs network management (F10).

PRIVACY – 17%

Axiata earned only three percentage points more than the two companies that tied for last place among telecommunications companies in this category, Etisalat and MTN. Axiata’s regulatory context does not justify its lack of disclosure across the indicators assessed in this category.

Handling of user information: Somewhat in parallel to its performance on freedom of expression-related indicators, Axiata received credit for disclosures related to its privacy policies as well as disclosures regarding collection and sharing of user information (Indicators P3 and P4). Notably, it outperformed all telecommunications companies except AT&T and Vodafone on disclosure about collection of user information (P3), but its disclosure about sharing of user information (P4) was relatively minimal. The Malaysian operating company Celcom provides no options for users to control the collection and sharing of user information (P5), and users are given no meaningful access to their own information (P6). Such disclosure is poor despite positive regulation for data protection. For example, the Malaysian Personal Data Protection Act 2010 (PDPA) established a limit that personal data may not be kept longer than is necessary for fulfillment of the purpose for which it was collected. However, neither Axiata nor Celcom provide clarity on how this time frame is operationalized (P7).

Transparency about requests for user data: The company received no credit on indicators examining disclosures about its process for responding to third-party requests for user information (P9), user notification about third-party requests (P10) or data about third-party requests (P11). Notwithstanding the Official Secrets Act noted above, our understanding of Malaysian law indicates that the company should be in a position to disclose at least some types of requests that Celcom receives to share user information.

Security: Axiata faces no meaningful obstacles to improving its disclosures about security practices (P12), nor is there any reason why the company cannot make stronger efforts to educate users about security threats (P14).