KUALA LUMPUR: Opposition leader Datuk Seri Anwar Ibrahim has raised several questions over the government's decision to sell the MySejahtera contact tracing application to a private company.
The application, that was rolled out in April 2020, was fully owned by the Health Ministry initially, under the National Cyber Security Agency's (Nacsa) and National Security Council's (NSC) supervision.
However, the government, on Nov 26, 2021, agreed to give up control of the application and the Health Ministry, subsequently, appointed MySJ Sdn. Bhd. by direct negotiation to take over MySejahtera.
In December 2021, the Public Accounts Committee (PAC) proposed for the government to take over MySejahtera's operations without incurring any additional costs since the application has become an integral part of the national health system.
Anwar, in a statement today, said the PAC also raised several questions regarding the sale of MySejahtera during a hearing last Thursday.
"Health Ministry officers who testified in front of the PAC claimed that MySJ Sdn. Bhd. is not related to KPISoft, the company which built MySejahtera as a corporate social responsibility (CSR) initiative.
"KPISoft has since changed its name to Entomo. The claim that there is no relation between KPISoft/Entomo and MYSJ Sdn. Bhd must be scrutinised. The directors of MySJ Sdn. Bhd. include two founders of KPISoft.
"The directors of MySJ Sdn. Bhd. also include individuals with political and business connections to parties in the ruling coalition government, including Tan Sri Shahril Shamsuddin, who was the chief executive officer of Sapura Energy until March 2021, and Tan Sri Megat Najmuddin who was an Umno division chief and later became a senior member of Bersatu.
"Furthermore, 81.4 per cent of MySJ Sdn. Bhd. is owned by another company, Revolusi Asia Sdn. Bhd, of which, 88 per cent is owned by the founders of KPISoft.
"In other words, 71.2 per cent of MySJ Sdn. Bhd. is owned by two co-founders of KPISoft, which built MySejahtera.
"To say that there is no link between KPISoft/Entomo and MySJ Sdn. Bhd. is inaccurate," he said.
Anwar also questioned the government's decision to sell MySejahtera via direct negotiation, instead of conducting a transparent public tender.
"What are the reasons for MySJ Sdn. Bhd. being the only company under consideration for this project?
"Under an open tender, these facts would be scrutinised by the government and the public. In the case of a direct negotiation, this deal appears to resemble a pattern of rewarding companies and individuals that have political and business connections to the ruling government.
"Does the government frequently reward individuals or companies that conduct CSR for the benefit of the Malaysian people with lucrative contracts?
"That MySJ Sdn. Bhd. includes directors whose expertise in operating a software/information technology business is not clear raises further concerns about the logic of this direct award to MySJ Sdn. Bhd," he said.
Based on the Health Ministry's data, Anwar said, the MySejahtera application has registered over 11 billion check-ins since December 2020, that contains intimate details about people's personal preferences, consumption patterns, social network.
"We assume that MySejahtera databases also include private personal health data about individual's reported health symptoms and Covid-19 positive diagnosis.
"So, the sale of MySejahtera to a private company raises substantial concerns about data privacy and the potential abuse of private health related data about millions of Malaysians.
"The PAC was informed that all data in MySejahtera and its confidentiality is under the control of the Health Ministry.
"But, what is MySJ Sdn Bhd's scope of work, pertaining to the operation of MySejahtera and how is the Health Ministry able to ensure that the data collected by MySejahtera will not be misused by third parties, including MySJ Sdn Bhd.
"Are the terms of this contract in compliance with the past assurances given by the Health Ministry regarding the appropriate use of Malaysians' personal private health data, MySejahtera's data privacy policy, and the country's data privacy laws?
"What are the MYSJ Sdn. Bhd. obligations to ensure that the data which Malaysians shared via MySejahtera on the basis of a public mandate will not be used for marketing, product development, surveillance, or discriminatory purposes?
"These questions must be clarified by the Cabinet," he added.