by Loh Heng Yeong, Yong Li Zen, Justine Teoh Biing Chian, Elisha Tan Kai Xuan
As digital engagement becomes deeply embedded in everyday life, jurisdictions across the globe are strengthening their legal frameworks to combat cyberbullying, doxxing, and online abuse. Echoing efforts already seen in other Commonwealth jurisdictions, Malaysia has recently introduced the Penal Code (Amendment) (No. 2) Act 2024. But how far do these legal reforms go?
From Minor Offences to Major Crimes
The existing framework prior to the amendment has a weak mechanism to deal with harassment-related. Under Section 14 of the Minor Offences Act 1955, a person found guilty of using abusive or threatening language to breach the peace could be fined up to RM100. Similarly, Section 503 (criminal intimidation) and Section 509 (insulting a person’s modesty) of the Penal Code addressed offline threats and indecent behaviour.
Introduction of the Communications and Multimedia Act 1998 (‘CMA 1998’), sought to address issues happening in the internet era. In Sections 211 and 233 CMA 1998, a content applications service providers and a facilitator who provide indecent, obscene, false, menacing or grossly offensive content with intent to annoy, abuse, threaten or harass a person is an offence.
New Sections for a New Era
In 2024, Malaysia introduced several new sections to the Penal Code to address online bullying causing harassment and the dissemination of another person’s personal information (doxxing) more comprehensively.
Cyberbullying (Sections 507B–507D):
Target threats and abusive communications that cause distress, fear, or alarm, or make someone believe harm will be caused to them or others. Penalties include up to 3 years’ imprisonment or fines.
- Section 507B: criminalises threatening, abusive, or insulting words, communications or acts that are intended to cause or are likely to cause harassment, distress, fear, or alarm.
- Section 507C: focuses on the perception of the victim — even if the perpetrator’s conduct is not directly targeted at them, criminal liability may arise where a person likely feels harassed or distressed.
- Section 507D: heightens the gravity of the offence where the conduct provokes fear of harm, and in extreme cases, when such provocation leads to attempted or actual suicide.
Doxxing (Sections 507E–507F):
The publication or circulation of someone’s personal information with intent to harass or cause harm. This includes scenarios such as sharing intimate photos or posting someone’s whereabouts to facilitate violence.
- Section 507E: prohibits the unauthorised publication or dissemination of a person’s identity information with the intent to harass or alarm.
- Section 507F: introduces offences for: (1) causing the victim to believe that harm may follow the publication; or (2) facilitating actual harm against the victim or their related persons.
Definitions (Section 507G)
Defines critical terms such as harm, identity information, and related person, expanding the scope of potential victims.
| Harm | Harm to a person’s body, mind, reputation or property, including psychological harm |
| Identity Information | Any information that identifies or purports to identify a person |
| Related Person | In relation to a person, any person whose safety or well-being would reasonably be expected to be of concern of the first-mentioned person |
But What If the Offender Is a Child?
Malaysia’s Child Act 2001 (‘CA 2001’) introduces specific provisions for offenders under 18. Sections 82 and 83 of the Penal Code requires the Court to perform a two-stage investigation in determining whether a child has attained the age of criminal responsibility:
| Sections 82 – Children under 10 years old | Automatically presumed incapable of committing crimes (irrebuttable presumption). |
| Section 83 – Children aged 10–12 | Presumed incapable unless proven to have “sufficient maturity of understanding” to grasp the nature and consequences of their actions (rebuttable presumption). |
This creates challenges when prosecuting cyberbullying cases involving young offenders. For example, a 9-year-old issuing online threats cannot be legally punished. An 11-year-old may only be held liable if the court is convinced of their maturity and understanding.
Consequences for Child Offenders
Even when criminal liability is established, punishment for child offenders prioritises rehabilitation. The court can impose a range of measures:
- Admonishment and discharge – Section 91(a) CA 2001
- Placement under a responsible person’s care – Section 91(c) CA 2001
- Good behaviour bonds (with mandatory parental involvement) – Section 91(b) CA 2001
- Payment of fine, compensation to victim or cover legal costs – Section 91(d) & 94 CA 2001
- Community service (up to 120 hours) – Section 91(da) & 97 CA 2001
- Probation (1–3 years) – Section 91(e) & 98 CA 2001
- Detention in Approved or Henry Gurney Schools – Section 91(f), 66, 67, 74 & 75 CA 2001
- Imprisonment only applicable to children aged 14 and above and for serious crimes and only as a last resort if no other suitable options are available – Section 91(h) & 96 CA 2001
Comparison with other jurisdictions: The UK and Singapore
With the introduction of the anti-cyberbullying and anti-doxxing provisions in the Penal Code, Malaysia’s legislative amendments draws parallels with other Commonwealth jurisdictions like Singapore’s Protection from Harassment Act 2014 (‘POHA’) and the UK’s Online Safety Act 2023 and Communications Act 2003:
| Feature | Malaysia | Singapore | UK |
| Anti-Cyberbullying Provisions | Sec. 507B, C and D) | POHA Sec. 3, 4 and 5) | (Communications Act 2003 Sec. 127 and Online Safety Act – See definition of Bullying Content) |
| Anti-Doxxing Provisions | Sec. 507E and F) | POHA Sec. 3 and 5) | (Communications Act 2003 Sec. 127 and Online Safety Act – See definition of Harm) |
- Singapore’s Protection from Harassment Act 2014: Features protection orders, enhanced penalties, and specific offences like stalking and harassment of public servants.
- UK’s Online Safety Act 2023: Places duties on online platforms to prevent harmful content, enforced by Ofcom, the communications regulator. Violations can lead to massive financial penalties, including up to 10% of global turnover for companies.
These comparative models highlight one key difference: corporate accountability. Malaysia currently lacks statutory duties for tech platforms to regulate harmful content. Should it follow in the UK’s footsteps?
A Progressive Step, But Is It Enough?
Malaysia’s updated legal arsenal marks a significant milestone in combating cyberbullying and doxxing. The new provisions provide greater protection for victims, clearer definitions, and stricter penalties for offenders. However, questions remain:
- Should Malaysia mandate tech platforms to take proactive steps against abuse?
- Can the current system adequately protect victims and rehabilitate young offenders?
- How can awareness and enforcement be improved?
These are important questions for policymakers, educators, and society at large. Because in today’s digital age, a cruel comment or a leaked photo can have devastating real-world consequences—and the law must keep up.
