Governed by Data, Invisible in Law: Biometric Surveillance, Platform Precarity, and the Datafication of Migrant Labor in Malaysia

1. Introduction: When Data Governs, and Law Remains Silent

Between Visibility and Abandonment

Malaysia is simultaneously one of the most digitally ambitious and one of the most migration-dependent economies in Southeast Asia. The MyDigital Blueprint launched in 2022 articulates a national vision of full digital transformation — smart borders, integrated labor registries, AI-augmented public services, and data-driven governance across every sector of the state (Ministry of Digital, Malaysia, 2022). Running in parallel to this ambition is a labor economy structurally dependent on approximately 2.2 to 3 million documented migrant workers, plus an estimated 1 to 2 million undocumented workers, drawn predominantly from Indonesia, Bangladesh, Nepal, Myanmar, the Philippines, and India (ILO, 2021; IOM, 2020). These two realities — digital transformation and migrant labor dependence — converge in a formation of governance that this paper calls datafied dispossession: the condition in which workers are rendered exhaustively legible to the state and employers through data, while remaining structurally invisible to the law that purports to protect them.

The paradox is precise. Malaysia’s migrant workers are among the most intensively governed populations in the country. Their biometric identifiers are captured at borders, stored in centralized federal databases, cross-referenced with employer records and health registries, and continuously updated through mandatory reporting requirements (Wahab et al., 2021; Awal et al., 2020). Their labor is monitored through app-based attendance systems, GPS location tracking, automated productivity platforms, and algorithmic performance management (Zuboff, 2019; Reyes, 2022). Their employment histories, financial records, and travel movements are profiled by recruitment agencies and shared across jurisdictions without their knowledge or consent (Beduschi, 2021; Chowdhury, 2026b). They are, in every technical sense, data-rich subjects. Yet the Personal Data Protection Act 2010 (PDPA) — Malaysia’s primary data governance instrument — does not apply to the Federal Government or its agencies, the very institutions that hold the most sensitive data about migrant workers (Dencik et al., 2019). The result is governance without accountability: total data capture without corresponding rights.

Contribution and Structure

This paper makes three interconnected contributions. First, it situates Malaysia’s migrant labor data governance within the emerging theoretical framework of digital migration studies (Leurs & Smets, 2018; Viola et al., 2023), demonstrating that the datafication of migrant workers is not a peripheral technical matter but a central political and ethical issue requiring urgent scholarly and policy attention. Second, it draws on decolonial theory — particularly Chowdhury’s (2026a) Indigenous Gnoseology and Chowdhury et al.’s (2023) Ubuntu philosophy — to argue that the epistemological marginalization of migrant workers in data governance reflects and reinforces their political and economic marginalization, and that genuine reform must address the epistemic as well as the institutional dimensions of this problem. Third, it develops a concept of relational data sovereignty that moves beyond state-centric models to articulate a governance framework grounded in reciprocal obligation, worker agency, and institutional accountability.

The paper proceeds as follows. Section 2 develops the conceptual framework, engaging with data colonialism, digital migration studies, and decolonial epistemology. Section 3 examines biometric governance and the employer-tied data architecture. Section 4 analyzes platform surveillance and algorithmic labor control. Section 5 addresses cross-border data flows in recruitment systems. Section 6 evaluates the Malaysian legal and regulatory landscape. Section 7 proposes a relational model of data sovereignty and its institutional implications. Section 8 concludes with reflections on the broader significance of migrant data justice for ASEAN and the Global South.

2. Theoretical Framework: Data Colonialism, Digital Migration, and Decolonial Epistemology

Migrants as Datafied Subjects

The datafication of migration — the transformation of movement, identity, labor, and life into data points governed by digital systems — has emerged as a central concern of critical migration studies over the past decade (Leurs & Smets, 2018; Viola et al., 2023). Leurs and Smets (2018), in their foundational intervention on digital migration studies, identify a structural asymmetry at the heart of this process: from above, states and corporations invest in digital technologies to render migrants legible, trackable, and manageable; from below, migrants use digital tools to navigate, resist, and survive conditions of structural precarity. This dual dynamic — datafication from above, digital survival from below — defines the political terrain on which migrant data rights must be understood. In the Malaysian context, the asymmetry is acute: the state’s investment in biometric and data infrastructure vastly outpaces any investment in the rights or capabilities of the workers that infrastructure governs.

Viola et al. (2023), surveying the intersections of migration studies and the digital, observe that datafication has produced a new governance paradigm in which migrants are administered as much through data profiles as through physical enforcement — a shift that has outpaced both legal frameworks and theoretical tools. Beduschi (2021), writing from within international human rights law, reaches a structurally identical conclusion: AI-driven migration management systems across the Global South and North alike routinely deploy data technologies against migrants under frameworks that provide no meaningful accountability to those affected. These convergent observations from distinct disciplinary traditions establish the analytical context for this paper’s examination of Malaysia.

Data Colonialism and the Reproduction of Extraction

Couldry and Mejias (2019) develop the concept of data colonialism to describe a global process by which social life is restructured through the continuous extraction of data from populations for the benefit of corporations and states — reproducing colonial relations of power and extraction in a new digital register. This framing illuminates the structural dynamics of migrant labor datafication in Malaysia with particular force. Migrant workers’ biometric characteristics, labor records, financial transactions, health profiles, and behavioral patterns are continuously harvested and aggregated by systems they do not control, generating economic and political value for employers, agencies, and the state. The workers themselves receive nothing from this extraction beyond the continued permission to remain employed and present.

Mignolo’s (2011) analysis of the coloniality of power provides the deeper historical grounding for this critique. The administrative and epistemological violence of colonial knowledge systems — which constituted colonized populations as objects of governance rather than subjects of rights — is reproduced in digital form through the data governance of migrant populations. Quijano’s (2000) concept of the coloniality of power further illuminates how racial and national hierarchies are inscribed in the administrative systems that govern non-citizen labor populations — a dynamic that digital governance not only reproduces but deepens, by embedding these hierarchies in algorithmic systems whose logic is technically opaque and formally uncontestable.

Convoluted Mobility and Platform Precarity

Spanger and Andersen’s (2023) concept of convoluted mobility — developed through empirical research on transnational migrant workers in the Journal of Ethnic and Migration Studies — captures the experiential texture of the conditions this paper analyzes. Their argument is that the precarity of migrant workers is not a fixed attribute of their individual circumstances but is actively produced through the interplay between transnational migration infrastructure and individual agency, resulting in conditions of friction, stuckness, detour, and contingency that characterize the entire migration process from planning through arrival to employment. In the context of digital governance, this convoluted mobility is increasingly mediated and intensified by data systems: the employer-tied database that determines legal presence, the recruitment platform that shapes labor market access, the productivity monitoring app that governs daily work, and the biometric registry that conditions mobility itself.

Andersen and Spanger (2024), extending this analysis to migrant gig workers, demonstrate that platform-mediated labor simultaneously enables and constrains migrant workers’ agency — creating new forms of employment access while generating compulsory data relationships that are structurally coercive rather than contractually voluntary. Srnicek’s (2017) analysis of platform capitalism provides the economic frame: digital labor platforms do not merely connect supply and demand but extract, aggregate, and monetize data generated through the labor process, creating a new layer of value extraction that sits above the employment relationship itself. Migrant workers, in this architecture, are data generators as much as labor providers — and they receive no share in the value their data creates.

Toward Decolonial Data Governance

Chowdhury’s (2026a) conception of Indigenous Gnoseology — a theory of knowledge beyond epistemology, grounded in oral traditions, relational ethics, and the epistemic validity of non-Western knowledge systems — offers a foundational challenge to the data governance frameworks that currently govern migrant populations. Just as Indigenous communities have historically been governed through epistemological systems that deny the validity of their own knowledge and the legitimacy of their own rights claims, migrant workers are governed through data systems that deny them epistemic agency — the capacity to know, contest, and govern the systems that shape their lives. Chowdhury’s (2026d) further argument that oral moral and legal traditions constitute binding governance — “what is oral is moral and legal” — extends this challenge to the assumption that data rights can only exist where they are formally codified in written law. The moral obligations generated by the relationship between Malaysian society and the migrant labor that sustains it are real whether or not current law recognizes them.

Ubuntu philosophy, as elaborated in Chowdhury et al.’s (2023) work, provides the normative horizon: the principle that “I am because we are” implies that the conditions of dignified life for migrant workers cannot be separated from the conditions of dignified life for the societies that host and depend upon their labor. Chowdhury’s (2022) framework of reciprocity in social research — the argument that research and governance relationships must be grounded in mutual obligation, transparency, and benefit-sharing rather than extraction — translates this normative principle into a concrete institutional design principle for data governance. It demands that institutions collecting and benefiting from workers’ data owe those workers commensurate obligations: disclosure, access, correction, redress, and a meaningful share in the governance of the systems that affect their lives.

3. Biometric Governance and the Architecture of Employer-Tied Data

The Infrastructure of Biometric Capture

Malaysia has constructed a substantial biometric infrastructure for the governance of migrant populations. The Foreign Worker Centralised Management System (FWCMS) and the Expatriate Management System require the registration of biometric identifiers — fingerprints and facial images — for all documented migrant workers, administered by the Immigration Department and linked to employer registration records, visa status, and sector-specific permits (Wahab et al., 2021). During the COVID-19 pandemic, this biometric infrastructure was deepened through mandatory PCR testing registration and national vaccination databases, adding health surveillance to the existing architecture of identity and employment governance (Tenaganita, 2021). The result is a comprehensive data ecosystem that tracks migrant workers from border entry through employment to departure — or deportation.

Biometric data occupies a special category in data protection frameworks precisely because it is uniquely identifying and irreplaceable: unlike a password, a compromised fingerprint cannot be changed (Eubanks, 2018). The aggregation of biometric data with employment records and health information in centralized government databases creates conditions of extreme and permanent vulnerability. Beduschi (2021) demonstrates, in comparative international analysis, that the deployment of biometric data in migration governance routinely outpaces the development of legal protections for affected populations, creating structural data vulnerability that persists long after the immediate governance function has been served. Simonsen’s (2022) ethnographic analysis of biometric border-crossing further demonstrates that the transformation of migrants into data-bearing subjects through biometric processing fundamentally alters the terms of their civic recognition — reducing them to a set of extractable physical characteristics that can be stored, shared, and acted upon independently of their presence, consent, or knowledge.

The Employer-Tied Visa as a Data Architecture

The employer-tied visa system — which binds migrant workers’ legal status in Malaysia to a specific employer — is not merely an employment regulation but a data architecture with profound implications for workers’ data rights. Under the Malaysian work permit regime, employers register workers in centralized government systems, hold primary responsibility for renewals and cancellations, and can initiate deportation proceedings by withdrawing sponsorship (Kaur, 2020; Awal et al., 2020). This means that an employer effectively controls the worker’s presence in the national database — and therefore their legal existence in Malaysia — as well as their labor. The data relationship is not bilateral but trilateral, with the employer as a structurally privileged third party whose data interests are institutionally protected at workers’ expense.

This configuration structurally undermines informed consent as a basis for data governance. Workers cannot meaningfully consent to data uses by their employer or the state because the alternative to consent — non-cooperation — risks the loss of employment and legal status (Dencik et al., 2019; Chowdhury, 2026b). Data protection frameworks that rely on consent as the primary legitimating mechanism for data processing are, in this context, instruments of a governance fiction: they imagine a voluntary, informed data subject in conditions where volition is systematically suppressed by the architecture of labor migration. As Chowdhury (2026b) argues in his foundational critique of procedural ethics in research governance, procedures that formally require consent while structurally precluding it do not protect subjects — they protect the institutions that collect their data.

Recruitment Supply Chains and Multilateral Data Extraction

The data asymmetry that characterizes the employer-worker relationship is compounded by the recruitment supply chain that precedes and frames employment. Workers are registered with recruitment agencies in their countries of origin before departure; their personal data — educational records, criminal background checks, health certifications, financial information, and increasingly biometric identifiers for digital verification — is compiled into profiles that circulate between agencies, employers, and government systems in both origin and destination countries (ILO, 2021; IOM, 2020). Workers rarely see these profiles, cannot correct inaccuracies, and have no enforceable rights over how they are used or shared.

Chowdhury’s (2023) ethnographic work with Bangladeshi migrant workers in Malaysia — conducted through a reciprocal, voice-centered methodology that treats workers as epistemic partners rather than research subjects — documents the experiential reality of this condition with striking clarity. Workers describe knowing that employers “have their files” while feeling entirely powerless to exercise any control over what those files contain or how they are used. This is what Chowdhury et al. (2022) identify as the structural denial of reciprocity in data relationships: the relationship between worker and institution is entirely one-directional, extractive rather than mutually constitutive. Spanger and Andersen (2023) connect this data asymmetry to the broader dynamic of convoluted mobility, arguing that the informational frictions and opacities that characterize the recruitment process are not incidental but are constitutive of the precarity that migrant workers carry throughout their employment.

4. Platform Surveillance, Algorithmic Discipline, and the Suppression of Solidarity

The Digital Factory Floor

The spread of digital labor management systems across Malaysian factories, plantations, and construction sites has introduced a new layer of continuous surveillance into the everyday labor of migrant workers. Smartphone applications mandated by employers track attendance, movement, and productivity through GPS location data, barcode scanning, and automated time-and-attendance logging (Zuboff, 2019; Reyes, 2022). In the electronics manufacturing sector — a major employer of migrant labor in Penang and the Klang Valley — factory management platforms capture output rates, error rates, rest period durations, and interpersonal interaction patterns on the production floor in real time, feeding this data into automated performance management systems that flag workers for disciplinary action based on algorithmic assessments without transparent human review (ILO, 2021; Human Rights Watch, 2021). Workers who do not comply with app-based monitoring face wage deductions or dismissal. The mandated nature of these applications means that the data they generate cannot be considered consensual in any meaningful sense — a point that Andersen and Spanger (2024) make with specific reference to migrant gig workers, observing that platform infrastructure positions workers within compulsory data relationships that are structurally coercive.

The plantation sector illustrates the most materially consequential form of algorithmic labor control in the Malaysian context. Fingerprint-based attendance systems, GPS tracking of harvest locations, and automated weighing and grading of produce are integrated into data platforms that determine workers’ wages, productivity bonuses, and continued employment on the basis of algorithmic outputs that workers have no capacity to audit or contest (Kaur, 2020; Awal et al., 2020). Workers who dispute algorithmic determinations — for instance, when GPS records them as absent from their work zone due to equipment malfunction, plantation management decisions, or system error — find that the authority of algorithmic output systematically overrides the credibility of worker testimony. Eubanks (2018) identifies this as a defining feature of automated systems applied to structurally disadvantaged populations: they produce discriminatory outcomes not because they are malicious but because they are trained on and evaluated against conditions shaped by structural disadvantage, which they then reproduce and legitimate as objective measurement.

Surveillance as Labor Discipline and Political Control

The disciplinary function of digital labor management extends beyond formal performance management to encompass the broader suppression of collective action and political organization. The knowledge that one is continuously monitored — by GPS, by app-based tracking, by production sensors — operates as a form of preemptive discipline that suppresses informal organizing, collective grievance, and the assertion of workplace rights (Browne, 2015; Zuboff, 2019). Andersen and Spanger (2024) argue that this digital atomization is a structural feature of platform capitalism: algorithmic management substitutes impersonal machine authority for the negotiated human relationships through which collective worker power has historically been built, while spatial and temporal fragmentation prevents the formation of solidary ties.

Browne’s (2015) analysis of surveillance as a technology of racialized control is directly applicable to the Malaysian migrant labor context. The differential intensity of digital monitoring — migrant workers subjected to more comprehensive surveillance than their citizen counterparts in the same workplaces — reflects and reproduces the racial and national hierarchies that structure Malaysian labor markets. Noble’s (2018) demonstration that algorithmic systems encode and amplify historical patterns of discrimination further illuminates why predictive productivity tools applied to migrant workers systematically disadvantage those whose working conditions, cultural practices, and biographical trajectories fall outside the normative profiles on which algorithmic recommendations are trained. Chowdhury (2026c) connects this algorithmic marginalization to the broader epistemological devaluation of non-Western migrant workers’ knowledge and experience within globally dominant digital systems.

The Data Worker Does Not Know

A dimension of migrant workers’ data vulnerability that has received insufficient attention in existing literature is the condition of epistemic opacity: the systematic exclusion of workers from knowledge of the data systems that govern them. Workers governed by biometric systems, productivity platforms, and algorithmic management tools are typically uninformed about what data is collected, who holds it, for what purposes it is used, with whom it is shared, and for how long it is retained. Tenaganita’s (2021) fieldwork with migrant workers in Malaysia confirms that most workers have no understanding of the data ecosystems in which they are embedded — a condition of enforced ignorance that Chowdhury et al. (2024) describe as imposed epistemic opacity: the systematic denial of knowledge that would be necessary for workers to understand, let alone contest, the systems governing them. This opacity is not accidental but structural — it is produced and maintained by the design of data systems that privilege institutional legibility over subject transparency.

5. Cross-Border Data Flows and the Regulatory Vacuum in Transnational Recruitment

The Transnational Data Pipeline

The datafication of migrant labor governance does not begin at Malaysia’s borders — it begins in origin countries, often months before departure, in the offices of recruitment agencies that profile, register, and market prospective workers to Malaysian employers. Digital recruitment platforms — including regional actors such as Jobstreet and sector-specific agencies — collect detailed worker profiles: work history, educational credentials, references, skills assessments, health certifications, criminal background checks, and biometric verification data (World Bank, 2020; Reyes, 2022). These profiles constitute a transnational data pipeline through which personal information flows from workers in Indonesia, Bangladesh, Nepal, and Myanmar to employers and government systems in Malaysia, through the intermediary infrastructure of digital recruitment agencies that operate across jurisdictions without clear legal accountability to either workers or states.

Beduschi (2021) identifies cross-jurisdictional data governance as one of the most acute challenges in the management of AI-driven migration systems, noting that international human rights law has yet to develop adequate accountability mechanisms for the cross-border deployment of data technologies in migration contexts. Malaysia’s PDPA contains provisions on cross-border data transfers, but these provisions are weak in enforcement and explicitly exclude government data systems — meaning that the most sensitive cross-border flows, those involving immigration and labor registries, fall entirely outside the Act’s scope (Dencik et al., 2019). The result is a regulatory vacuum in which migrant worker data circulates across national jurisdictions, available for uses that workers have not authorized and against which they have no effective recourse.

Blacklisting, Profiling, and Algorithmic Gatekeeping

The concrete harms produced by unregulated cross-border data flows in the recruitment context take several forms. Informal blacklisting — the maintenance, by employers and agencies, of records identifying workers deemed troublesome for having filed complaints, organized collectively, or sought early contract termination — is among the most consequential (Awal et al., 2020; Human Rights Watch, 2021). These lists circulate between employers and agencies in Malaysia and across destination countries, effectively barring workers from future employment in a sector or region on the basis of records they cannot access, contest, or seek deletion of. They represent data weaponization: the mobilization of employment history data as an instrument of preemptive labor discipline that extends far beyond any individual employment relationship.

Algorithmic profiling represents an emerging and less visible variant of this harm. As recruitment platforms deploy predictive analytics to match workers with employers, the risk grows that historical patterns of labor market discrimination — by nationality, ethnicity, gender, or religious background — are encoded into algorithmic recommendations, perpetuating and automating discrimination without any transparent mechanism for appeal or review (Eubanks, 2018; Noble, 2018). Viola et al. (2023) observe that datafication has produced new forms of discrimination that are structurally harder to contest than explicit racism precisely because they are mediated by algorithmic systems whose logic is opaque to those they affect. Workers who are algorithmically deprioritized — assigned lower match scores, flagged as higher-risk candidates — have no visibility into the basis of these assessments and no institutional channel through which to challenge them.

The Absent Framework: Bilateral Agreements and International Governance Gaps

Bilateral labor agreements (BLAs) between Malaysia and key origin countries — including Indonesia, Bangladesh, and Nepal — establish the formal framework for the recruitment, employment, and repatriation of migrant workers, but they address data governance in a superficial or absent manner (ILO, 2021). The provisions that do exist concern documentation requirements, fee structures, and employment conditions but do not establish minimum standards for data protection, cross-border data transfer, workers’ rights of access and correction, or remedies for data misuse. This governance absence reflects a structural feature of the political economy of labor migration: destination states prefer operational flexibility, and origin states prioritize the maintenance of remittance flows over the assertion of data rights on behalf of citizens abroad (Yeoh & Lam, 2016; Castles et al., 2020).

At the international level, the Global Compact for Safe, Orderly and Regular Migration (GCM), adopted in 2018, includes Objective 7 on reducing vulnerabilities in migration — provisions that have been interpreted to encompass digital data rights but that are non-binding and lack enforcement mechanisms (United Nations, 2018). Malaysia is not a signatory to the GCM, further limiting its applicability in this context. The ASEAN Consensus on the Protection and Promotion of the Rights of Migrant Workers provides a regional normative foundation, but similarly lacks binding enforcement. The absence of a multilateral framework for migrant worker data governance in ASEAN reflects the broader political economy of regional migration governance, in which destination states consistently resist accountability mechanisms that would constrain their discretion in managing non-citizen labor populations (ILO, 2021; Mezzadra & Neilson, 2013).

6. Law, Enforcement, and the Architecture of Non-Protection

The PDPA and Its Structural Exclusions

Malaysia’s primary data protection legislation, the Personal Data Protection Act 2010 (PDPA), was designed principally to enable Malaysia’s commercial digital economy — not to protect vulnerable populations from state or employer data power. The Act incorporates seven data protection principles broadly aligned with international frameworks derived from the OECD Privacy Guidelines (OECD, 2013), but it explicitly excludes the Federal Government and state governments from its scope (Dencik et al., 2019). This exclusion is not incidental: it means that the immigration databases, foreign worker management systems, and public health surveillance platforms through which the overwhelming majority of migrant workers’ most sensitive data is held and processed are legally ungoverned by any data protection framework. A 2023 amendment introduced mandatory data breach notification and enhanced penalties, but these reforms remained within the existing commercial orientation of the Act and did not address the government exclusion.

Beduschi (2021) observes, in comparative international context, that this pattern — domestic data protection law oriented toward commercial digital economy rather than migrant rights — is characteristic of migration-receiving states across the Global South and reflects a deliberate political choice rather than an inadvertent gap. The design of the PDPA as an instrument of commercial enablement rather than rights protection is consistent with the broader pattern of migrant labor governance in Malaysia, in which legal frameworks are systematically constructed to facilitate the extraction of labor value while minimizing the accountability obligations that extraction would otherwise generate. Chowdhury (2026b) describes this as procedural ethics without reciprocal substance: the formal performance of rights protection in the absence of any genuine commitment to the welfare of those purportedly protected.

Enforcement Gaps and Structural Inaccessibility

Even within the commercial sector, the PDPA’s enforcement record with respect to migrant worker data is effectively absent. The Personal Data Protection Department has focused its regulatory attention on consumer data protection in e-commerce and financial services, leaving data processing by recruitment agencies, labor contractors, and plantation companies — all significant handlers of migrant worker data — entirely unaddressed (Awal et al., 2020; Ng, 2022). The structural barriers to migrant workers’ effective use of existing legal remedies are severe and overlapping: language barriers prevent most workers from navigating Malay-language complaints processes; fear of employer retaliation deters formal complaints; geographic remoteness — particularly for plantation and construction workers — places legal aid centers practically out of reach; and immigration precarity means that any engagement with formal institutions carries the risk of deportation proceedings.

Leurs and Smets (2018) observe, from within the digital migration studies framework, that the digital governance of migrant populations routinely produces accountability deficits that formal legal frameworks are structurally ill-equipped to address, precisely because those frameworks were not designed with the specific vulnerabilities of non-citizen, linguistically diverse, geographically dispersed, and institutionally precarious populations in mind. Chowdhury’s (2026a, 2026b, 2026c, 2026d) broader argument — that rights which require literacy in dominant languages, familiarity with Western legal concepts, and freedom from coercive relationships to assert are not universal rights but rights for the already-privileged — applies with particular force in this context. A legal framework that formally protects workers while structurally precluding their ability to invoke that protection is not a rights framework but an alibi.

The Regional Comparison: Learning from Within ASEAN

Malaysia’s legal framework compares poorly with ASEAN peers when assessed for applicability to migrant worker data rights. Thailand’s Personal Data Protection Act, fully in force since 2022, extends to government data processing in a broader range of circumstances and contains enhanced provisions for sensitive data categories — including biometric data — with greater relevance to migration governance (World Bank, 2020). The Philippines’ Data Privacy Act applies to both public and private sector data processing and has been invoked in enforcement actions relevant to overseas worker data. At the international level, the ILO’s Fair Recruitment Initiative establishes minimum standards for recruitment practices that have implications for data governance in cross-border labor migration contexts (ILO, 2021). Malaysia’s failure to develop comparable frameworks reflects a governance choice, not a governance incapacity — and it is a choice that systematically favors the data interests of employers, agencies, and the state over the data rights of the workers whose labor sustains the Malaysian economy.

7. Relational Data Sovereignty: A Framework for Reform

Beyond State Sovereignty: The Relational Turn

The concept of data sovereignty, as typically deployed in policy discourse, is a state-centric concept: it refers to the authority of national governments to govern the data flows, digital infrastructure, and cyberspace within their territorial jurisdiction (Datta, 2023; Floridi, 2020). This concept is structurally inadequate for addressing the data vulnerabilities of migrant workers, who are governed simultaneously by the regulatory regimes of origin and destination states, and by the private digital platforms that mediate their recruitment, employment, and remittance pathways — without being meaningfully protected by any of these regimes. A more adequate concept of data sovereignty must be relational rather than territorial: grounded in the rights and interests of data subjects rather than the jurisdictional claims of states, and organized around principles of reciprocal obligation rather than administrative authority.

Relational data sovereignty, as developed in this paper, refers to a governance framework in which the rights and interests of data subjects — including non-citizen migrant workers — are constitutive rather than residual considerations of data governance design. It recognizes that data generated about persons in the course of their labor, their bodies’ biometric capture, and their engagement with digital platforms is, in a morally significant sense, their data — regardless of who technically holds or processes it (Taylor, 2017; Couldry & Mejias, 2019). It draws on Chowdhury and Wahab’s (2022) principle of reciprocity — the argument that governance relationships must be grounded in mutual obligation, transparency, and benefit-sharing rather than extraction — to hold that institutions collecting and benefiting from workers’ data owe those workers commensurate obligations: disclosure, access, correction, redress, and a meaningful share in the governance of the systems that affect their lives. And it draws on Chowdhury’s (2026a) Indigenous Gnoseology to insist that the knowledge and rights claims of non-Western, non-citizen, and non-literate populations are epistemologically valid and politically actionable — regardless of whether they are recognized in currently existing legal frameworks.

Five Institutional Reforms for Malaysia and ASEAN

Based on the analysis developed in this paper, five institutional reforms are proposed for the Malaysian context and, by extension, for the broader ASEAN regional framework.

First, the PDPA must be comprehensively amended to apply to government data processing affecting migrant workers. This amendment should establish rights of access, correction, and deletion in relation to immigration databases, foreign worker management systems, health registries, and other public data systems holding migrant worker data; should categorize biometric data as a special category requiring enhanced protection; should establish cross-border data transfer restrictions with meaningful enforcement; and should create civil and criminal liability for data misuse by state agencies (Dencik et al., 2019; Taylor, 2017; Beduschi, 2021).

Second, bilateral labor agreements between Malaysia and origin countries must be renegotiated to include binding data governance provisions. These provisions should establish minimum standards for the collection, retention, sharing, and deletion of migrant worker data across the entire recruitment supply chain — from origin-country registration through arrival, employment, and departure. They should align with the ILO’s Fair Recruitment Initiative and the UN Guiding Principles on Business and Human Rights, and should be subject to joint monitoring by origin and destination state authorities (ILO, 2021; United Nations, 2018).

Third, Malaysia should establish an independent Migrant Worker Data Ombudsperson — an institution with the mandate and capacity to receive complaints from migrant workers about data-related harms, investigate them impartially, and order remedies including data correction, deletion, and compensation. The Ombudsperson should be resourced to operate in multiple languages, to receive complaints through civil society intermediaries, and to conduct proactive investigations without requiring individual workers to initiate formal proceedings (Chowdhury et al., 2024; Dencik et al., 2019).

Fourth, platform companies and recruitment agencies operating in Malaysia should be subject to mandatory worker-facing data protection impact assessments — required disclosures of what data is collected about workers, for what purposes, with whom it is shared, and for how long it is retained. These assessments should be published in workers’ languages, reviewed by an independent regulatory authority, and subject to civil liability for non-compliance (Zuboff, 2019; Srnicek, 2017; Beduschi, 2021).

Fifth, digital literacy and data rights education — conceived not merely as technical training but as rights awareness grounded in workers’ own knowledge and experience — should be integrated into pre-departure orientation programs in origin countries and in-country programs conducted by civil society organizations and labor unions in Malaysia. This education should be designed in partnership with worker communities, reflecting Chowdhury’s (2022) principle that knowledge production in service of marginal populations must itself be reciprocal and participatory (Leurs & Smets, 2018; Chowdhury, 2026b).

The Epistemological Dimension of Reform

These five institutional reforms address the legal and regulatory dimensions of migrant worker data governance. But this paper’s decolonial framework insists that institutional reform alone is insufficient without accompanying epistemological transformation: a shift in the foundational assumptions about who counts as a legitimate data subject with actionable rights, whose knowledge about their own conditions is valid input into governance design, and whose interests are constitutive — rather than residual — of digital governance frameworks. Chowdhury’s (2026a) Indigenous Gnoseology and Chowdhury et al.’s (2023) Ubuntu philosophy jointly articulate the normative content of this epistemological shift: governance frameworks that recognize the relational, non-textual, and collectively grounded knowledge of migrant communities as epistemic resources rather than data points to be captured and managed. Viola et al. (2023) argue that digital migration studies must move beyond documenting the harms of datafication to actively theorizing alternative governance frameworks — a call that the relational data sovereignty concept developed here attempts to answer.

8. Conclusion: Dignity as the Foundation of Digital Governance

What Has Been Argued

This paper has argued that the datafication of migrant labor governance in Malaysia constitutes a regime of digital dispossession — a condition in which workers are rendered exhaustively visible to the state and capital through data, while remaining structurally invisible to the law that purports to protect them.

The conceptual framework developed across this paper — drawing on data colonialism (Couldry & Mejias, 2019), convoluted mobility (Spanger & Andersen, 2023), digital migration studies (Leurs & Smets, 2018; Viola et al., 2023), Ubuntu ethics (Chowdhury et al., 2023), Indigenous Gnoseology (Chowdhury, 2026a), and reciprocal methodology (Chowdhury et al., 2022; Chowdhury, 2026b) — demonstrates that the problem of migrant worker data governance cannot be adequately addressed within the state-centric framework of digital sovereignty, the consent-based framework of commercial data protection law, or the procedural framework of bilateral labor agreements. It requires a relational framework grounded in the rights, knowledge, and agency of those most governed by data and least protected by law.

Implications for ASEAN and the Global South

The analysis developed in this paper has implications that extend beyond Malaysia. Across ASEAN and the broader Global South, migrant-receiving states are deepening their digital governance of labor migration at a pace that systematically outstrips the development of legal frameworks adequate to protect affected workers (Reyes, 2022; Datta, 2023; Beduschi, 2021). The Philippines, Thailand, Singapore, and the Gulf Cooperation Council states — all significant destinations for migrant labor — exhibit versions of the data governance gaps documented here, in configurations shaped by their specific political economies but sharing the structural features of extraction without accountability. The platform capitalism that Srnicek (2017) identifies as the dominant organizational form of the contemporary digital economy produces, in the migrant labor context, a compounding of the precarity and dispossession that are already structural features of migration governance — making the development of regional governance frameworks for migrant worker data rights an urgent regional priority.

The development of such frameworks — building on the ASEAN Consensus and the GCM — represents an important political opportunity, but one that will be captured only if civil society organizations, origin-country governments, and international institutions including the ILO and UNHCR invest in sustained advocacy for binding standards (ILO, 2021; United Nations, 2018). Chowdhury’s (2026a) insistence that genuine governance reform requires epistemological transformation — a recognition that the knowledge and rights claims of governed populations are legitimate inputs into the design of the systems that govern them — points toward the deeper condition of possibility for this political work. Viola et al. (2023) identify this transformation as the defining challenge for digital migration studies in the decade ahead: the shift from migrants as objects of datafication to migrants as agents of digital governance.