News and developments
Indonesia Passes Historic Personal Data Protection Bill
However, while the PDP bill has been approved by both the President and DPR, it has not yet been signed by the President, who is required by law to ratify the PDP Law within 30 days from its date of approval. The PDP bill will become law (the PDP Law) as soon as signed by the President, or 30 days after such date of approval, whichever occurs first.
The PDP Law will be Indonesia’s first comprehensive set of rules relating to personal data protection, covering both electronic and non-electronic personal data forms. This welcome regulatory development will lead to a higher level of personal data protection in Indonesia’s growing digital economy.
The PDP Law is more closely aligned with international data privacy standards. It also introduces new concepts and removes certain restrictive provisions under the previous regime, including the requirement for both prior and post notifications to the regulator on cross-border personal data transfers.
The new law also goes further by introducing criminal sanctions for certain personal data breaches. In this way, the government is sending a strong message to both individuals and corporations that personal data protection is now being taken seriously in Indonesia.
We set out below our initial observations on the key issues we have identified in the PDP Law.
26 September 2022 By Cellia Cognard, Sakurayuki, Brandon Van Slyke and Dessy Arisanti HBT Website Link: https://www.hbtlaw.com/latest-thinking/indonesia-passes-historic-personal-data-protection-bill
EXTRATERRITORIAL REACH
Similar to Law No. 11 of 2008 as amended by Law No. 19 of 2016 on Electronic Information and Transactions (the EIT Law), the PDP Law purports to have extraterritorial reach, which may impact personal data controllers and processors located outside the jurisdiction of Indonesia. Article 2 of the EIT Law had provided that the EIT Law would apply to “any person who commits any legal action as governed under this EIT Law, both within the jurisdiction of Indonesia and outside the jurisdiction of Indonesia, which has legal effect within the jurisdiction of Indonesia and/or outside the jurisdiction of Indonesia and which harms the interest of Indonesia.” The wording “harms the interest of Indonesia” was broadly defined in the EIT Law to include “harming the interests of the national economy, strategic data protection, the nation’s dignity and status, state defence and security, sovereignty, citizens, as well as Indonesian legal entities”. Article 2 of the PDP Law provides a slightly different scope of application compared to the EIT Law since, among other things, it no longer includes the concept of “harming the national interest”. The PDP Law applies to any person, public body or international organisation carrying out a legal action contemplated under the PDP Law, and located:- within the Indonesian jurisdiction; and/or
- outside the Indonesian jurisdiction which has a legal impact (i) in the Indonesian jurisdiction and/or (ii) for personal data subjects who are Indonesian citizens located outside the Indonesian jurisdiction.
GROUNDS FOR PROCESSING PERSONAL DATA
Prior to the enactment of the PDP Law, the prevailing laws, and regulations on personal data protection in Indonesia arguably placed more of an emphasis on obtaining consent from the personal data “owners” when compared to the PDP Law. The PDP Law broadens the accepted grounds for the processing of personal data and appears to be generally more aligned with international practice. The PDP Law requires a personal data controller to have grounds for processing personal data. The accepted grounds for processing personal data under the PDP Law include:- valid and explicit consent from the personal data subject for one or more specific purposes which have been informed by the personal data controller to the personal data subject;
- satisfaction of an obligation in an agreement where the personal data subject is one of the parties, or to satisfy the request of a personal data subject when entering into an agreement;
- satisfaction of a legal obligation of the personal data controller in accordance with laws and regulations;
- satisfaction of protection of personal data subject’s vital interest;
- implementation of tasks for the public interest, public service, or the authorised implementation of the personal data controller based on the laws and regulations; and/or
- satisfaction of other legitimate interests by observing the purpose, needs, and balance of interests between the personal data controller’s interests and the rights of the personal data subject.
APPLICABLE EXEMPTIONS
The PDP Law is not applicable to personal data processing by individuals for personal or household purposes. It also exempts certain data controller obligations for the following interests, in the context of the implementation of laws and regulations.- national defence and security.
- law enforcement.
- public interest for the purpose of state administration; or
- supervision of the financial services sector, monetary and payment systems, and stability of the financial system being undertaken for the purpose of state administration.
INTRODUCTION OF PERSONAL DATA “SUBJECT”
The PDP Law introduces the term “personal data subject”. A personal data subject is defined under the PDP Law as an individual to whom personal data is attached. Under the previous regime, the term “personal data owner” was used, with largely the same definition as for “personal data subject” under the PDP Law. Considering how many parties are involved in the processing of personal data, granting ownership of personal data to a particular individual may not be appropriate, so the introduction of this new term is better aligned with international practice.ROLES OF DATA CONTROLLERS AND DATA PROCESSORS
The PDP Law categorises the key players related to personal data protection as “personal data controllers”, “personal data processors” and “personal data subjects”. We have already touched on the concept of a personal data subject above. The term “personal data controller” is briefly mentioned in Government Regulation No. 71 of 2019 on Administration of Electronic Systems and Transactions, but without elaborating on the role and its responsibilities. In general, the PDP Law better defines and separates the roles of data controllers and data processors than under the prior regulations.ONSHORE AND OFFSHORE PERSONAL DATA TRANSFERS
The PDP Law enables personal data controllers to transfer personal data both domestically and offshore more easily. For domestic transfers, Article 55 of the new law permits personal data controllers to transfer personal data to other data controllers within the Indonesian territory. Both transferor and transferee are required to protect the transferred personal data, as regulated under the PDP Law. Article 56 of the PDP Law permits personal data controllers to transfer personal data to personal data controllers and/or processors located outside the Indonesian territory if:- the country in which the personal data controller and/or processor receiving the personal data transfer is domiciled has a degree of personal data protection equal to or higher than that contemplated under the PDP Law;
- in the event that the provision under (a) above cannot be satisfied, the personal data controller is required to ensure that there is adequate personal data protection and such protection is binding in nature; and/or
- in the event that the provisions under (a) and (b) above cannot be satisfied, the personal data subject’s consent has been obtained.
- processing personal data for the interests of public service;
- the core activity of the personal data controller by its nature, scope, and/or purpose requires the orderly and systematic supervision of personal data on a large scale; and
- the core activity of the personal data controller consists of processing personal data on a large scale for personal data that is specific in nature and/or personal data related to criminal activities.
- unlawfully obtaining or collecting personal data that is not their own with the intention for them or others to personally benefit from the personal data, potentially resulting in damage to the personal data subject;
- unlawfully disclosing personal data that is not their own;
- unlawfully using personal data that is not their own; and/or
- creating fake personal data or falsifying personal data with the intention for themselves or others to personally benefit from such activity and where such activity may result in damage to other persons.
- financial penalties – individuals may face a fine of up to Rp 6 billion (USD 400,000) and corporations a fine of up to Rp 60 billion (USD 4 million);
- imprisonment – individuals may face up to six years of incarceration; or
- “other” potential additional penalties that can be imposed on corporations, including the possible seizure of profits/assets derived from a crime; freezing of all or part of a corporation’s business; permanent prohibition to carry out certain actions; closure of place of business and/or activities of a corporation; having to fulfil obligations that had been neglected; an award of damages; revocation of business licences; and/or dissolution of the corporation.
- a written warning;
- temporary suspension of personal data processing activity;
- deletion or destruction of personal data; and/or
- an administrative fine.
26 September 2022 By Cellia Cognard, Sakurayuki, Brandon Van Slyke and Dessy Arisanti HBT Website Link: https://www.hbtlaw.com/latest-thinking/indonesia-passes-historic-personal-data-protection-bill