A governance fix bundled with a mandate expansion
On August 3, 2026, Malaysia's Dewan Negara (Senate) passed the Communications and Multimedia Commission (Amendment) Bill 2026, following the Dewan Rakyat's approval on July 15 after debate by 14 MPs from both government and opposition benches. The Senate vote came after 11 senators spoke, and Deputy Communications Minister Teo Nie Ching used the debate to state the bill's central governance fix plainly: "Pengerusi tidak boleh terdiri daripada anggota badan perundangan. Ahli Parlimen tidak boleh, Ahli Dewan Undangan Negeri (ADUN) juga tidak boleh" — the MCMC chairman can no longer be a sitting MP or state assemblyman.
That closes a real gap. Since the Communications and Multimedia Act 1998 first gave the minister sole authority to appoint the commission's chairman, nothing barred a sitting legislator — someone who votes on the regulator's budget and answerable to party leadership — from also running it. Malaysia is not unique in fixing this after the fact, but the fix is sound and worth banking.
The steelman: a 28-year-old statute catching up
The rest of the 17-clause bill is defensible on similar grounds. MCMC's threshold for approving contracts without ministerial sign-off rises from RM5 million to RM50 million — a ceiling untouched since 1998, before Malaysia had commercial broadband, let alone the data-centre and submarine-cable contracts the regulator now oversees. The commission's appointed membership grows from five to seven seats, with expertise requirements broadened to cover economics and consumer protection alongside engineering and law, and the ministry's secretary-general joins as an ex officio federal member. None of this is control-dressed-as-housekeeping: a 1998-era procurement ceiling genuinely constrains a regulator now negotiating cloud and cable infrastructure worth many multiples of RM5 million, and broader board expertise is a reasonable governance upgrade.
Where the bill goes further: Section 16
The more consequential clause sits in the bill's amendment to Section 16 of Act 589, which empowers MCMC to "develop and regulate security standards and standards on infrastructure and platforms that promote interoperability, trust and spur growth of the communications and multimedia industry." Separately, the bill grants MCMC power to "audit, or cause to be audited, the activities of any licensee or any other person providing services related to communications systems." Unlike the RM50 million contract figure — a specific, auditable number — "platform standards" and "trust" are undefined terms left to the commission's own rulemaking, with no statutory definition of what counts as an infrastructure or platform standard, who gets consulted before one is set, or what recourse a platform has if it disagrees.
Not a one-off
This is not the first time MCMC's toolkit has expanded faster than its accountability mechanisms. When Parliament passed earlier Communications and Multimedia Act amendments on December 9, 2024, ARTICLE 19 and the Centre for Independent Journalism warned the changes gave MCMC wider authority to decide what content stays online, compel user data from service providers, and suspend Content Application Service Providers for non-compliance — powers the groups argued sat uneasily against Section 3(3) of the same Act, which states nothing in the CMA "shall be construed as permitting the censorship of the internet." The pattern repeated this year with the under-16 social media registration rules, where a public consultation running February 12 to March 31, 2026 drew criticism from civil society as too rushed to meet basic standards of evidence-based policymaking before enforcement began June 1. Section 16's platform-standards mandate now adds infrastructure and interoperability rulemaking on top of that existing content-moderation toolkit, continuing a trend of the regulator's discretionary reach growing net of new checks.
Why proportion matters for a regulator courting data-centre capital
Malaysia's own MyDIGITAL blueprint enters Phase 3 (2026–2030) explicitly betting on the country becoming, in the government's words, the "Heart of Digital ASEAN" — anchored by projects like the Sovereign AI Cloud and the MADANI submarine cable connection (SALAM). That bet depends on global cloud operators and platforms treating Malaysia's regulatory environment as predictable. A contract ceiling defined to the ringgit signals exactly that kind of predictability; an undefined power to set "platform standards" that "promote trust," enforceable through new audit authority over "any person providing services related to communications systems," signals the opposite. Firms sizing up data-centre or cloud capex in Malaysia versus Singapore, Vietnam, or Indonesia will price in the more open-ended clause, not the one on which the government made its own case for specificity.
The proportionate fix
The chairman rule and the contract ceiling should stay — they are overdue and well-scoped. Section 16's new standard-setting power needs the same specificity treatment: a statutory definition of what qualifies as an infrastructure or platform standard, a mandatory public consultation and comment period before any standard takes effect, and an appeal route for an affected operator before enforcement rather than after. MCMC's new obligation to publish civil and criminal proceedings and compounds is a genuine transparency gain worth keeping alongside that fix. Parliament proved with the RM50 million figure that it can write MCMC's new powers with precision. It should hold Section 16 to the same bar before this discretion becomes the next bill civil society is asking lawmakers to rein back in.