Years in the making, Indonesia’s first comprehensive data protection law was approved by lawmakers on Sept. 20 as the COVID-19 pandemic delayed rough negotiations of the bill. Indonesia is the fifth country in Southeast Asia to have a data protection legal framework.
Lawyers say the new law, which had not yet been enacted at press time, would bring Indonesia’s data security controls in line with international standards and ignite its digital economy. But laws need to be updated to facilitate the development of advanced technologies.
WHAT DOES INDONESIA’S NEW DATA LAW MEAN?
The long-awaited Personal Data Protection Act comes amid a rise in data breaches and fraud in Indonesia’s online world in recent years. Although President Joko Widodo’s record on COVID-19 has fallen to shreds, it has prompted authorities to strengthen the country’s fourth-largest country’s data security.
“With the rapid development of technology, the use of personal data has become more widespread and more varied as human interactions have been replaced by automated systems,” said Daniel Pardede, a senior M&A partner at HHP, the Indonesian member firm of Baker McKenzie.
Undoubtedly, this fast-moving trend has led to loopholes that are used by unscrupulous individuals to gain unauthorized access to private information. Last month, the personal data of 105 million Indonesians, among them many citizens, was compromised after the Election Commission was allegedly compromised. Unrelenting breaches that disrupt organizations across the public and private sectors also undermine Indonesia’s digital ambitions.
“This is where we come in and what the new law is trying to fix, that is, to regulate the use of personal data and provide protection for data privacy practices in Indonesia and also consider other jurisdictions already have data privacy laws before Indonesia,” said Pardede.
WHAT REGULATIONS DOES THIS LAW APPLY TO?
As a sign of the government’s efforts to address these issues, the PDP law criminalizes certain data crimes. After two years, the data controllers were sentenced to five years in prison for renting and misusing private information. People who falsify personal data for profit, meanwhile, face up to six years in prison and a fine of up to 6 billion rupiah ($395 million).
In addition, the effect of the PDP law is not limited within the country’s borders, and data processors and processors outside Indonesia will be held responsible as long as it is accepted as a “legal effect”. .
“The law incorporates concepts that have been implemented in other jurisdictions, such as European Union countries through the Data Protection Act,” says Adhika Wiyoso, M&A partner at HHP. “These include the classification of general and specific personal data, the purpose of the data controller and processor, and the requirement to appoint a data protection officer.” Notable changes include the establishment of a separate data protection authority, whose authority will be delegated to the president.
Wiyoso emphasizes the shift of focus on data processing from the consent of the owners to the consented countries. “The old arrangement established a strict standard that everything must be based on consent. There is little room for flexibility, for example, when using personal data for an emergency related purpose. to the substantial interest of the data owner.”
In addition, the introduction of the term “personal data subject” in contrast to “personal data owner” as well as the easy way for cross-border data transfer has indicated the government’s ability to increase more than its data management and global capabilities.
Pardede is confident about the law’s effectiveness, which he believes will provide other regional and global economies with legal clarity and systematic guidance on Indonesia’s data privacy practices. “In the long term, Indonesia will be seen as a country that provides the same or at least a level of data protection compared to other countries that have implemented a stronger data protection mechanism,” he said. he added.
WHAT SHOULD THE FLIGHTS DO IN INDONESIA?
As the largest economy in Southeast Asia, Indonesia is well-positioned to lead its economic recovery from the pandemic with a digital transformation agenda and a growing technology sector. As authorities strive to promote growth, lawyers are aware of the measures that can be taken to support the digital industry in the long term.
“The government should be able to provide more flexible licensing procedures,” said Pradede, adding that laws should keep up with the development of advanced technologies to ensure legal certainty in the digital world. Better infrastructure and expansion of foreign investment, Pradede said, will follow as the Internet industry continues to strengthen.