The Personal Data Protection Department (PDPD) under the communications and multimedia ministry said it had received an explanation from the company on a media report on the matter.

“There is no issue of leakage and sale of personal data, and we are satisfied with the explanation given by AirAsia,” it said in a statement today.

“We would like to stress that the sale of personal data is a crime under Section 130 of the Personal Data Protection Act, and if charged, can be punished with a maximum fine of RM500,000 or three years in prison, or both.”

AirAsia CEO Tony Fernandes was reported as saying there was an American lender who was offering loans of up to US$1 billion for the low-cost carrier’s digital assets obtained over the years.

This raised concerns among customers that their personal data would be shared with parties they did not consent to, questioning whether this was breaching their privacy.