Because of Government concern about breaches of personal data privacy in Indonesia and to mitigate violations of data privacy in the future, the Government of Indonesia (the "GOI"), through the Ministry of Communication and Information, has requested the Indonesian Parliament (Dewan Perwakilan Rakyat – "DPR") to pass a new data protection law by submitting a bill of personal data protection (the "Bill of Data Protection") in January 2020. At this stage the bill is exactly what it is – a bill – and may be subject to further amendments. It will also, as is typical in Indonesia, be subject to elaboration by implementing regulation(s). So this alert is merely to warn clients it is coming. We are happy to provide full details of the contents of the bill as it stands now on request.
The main thrust of the Bill of Data Protection is that protection of personal data privacy is a human right like other rights to personal protection which should enjoy the full protection of the law.
Currently personal data related provisions are spread across various laws and regulations, such as those regarding electronic information and consumer protection.
The new bill will apply very broadly to all people and types of entities, including government bodies. It will also apply to all forms of personal data and gives the data owner new rights to control personal data collection and use. It establishes a new regime of responsibility for the data controllers and data processors, which all companies will have to implement. It also contains onerous obligations on such data controllers and data processors, or those who seek to share the data offshore which are likely to impact all multinational companies.
Although it is still in the discussion stage within the DPR and the GOI, the Bill of Data Protection in its final form will clearly include various provisions which ensure the rights of personal data owners and result in stricter regulation of data collection and data protection, as well as protection for the data owners, and which will impose obligations with which all companies will need to comply and restrictions and prohibitions on sharing data abroad in certain circumstances. The Bill will also include various sanctions (not only in the form of civil or administrative sanctions, but also in the form of criminal sanctions) for violation of these new rules. From a company's perspective, numerous obligations will be introduced by the Bill which will entail burdens on operations and require investment in IT infrastructure to ensure greater protection for the privacy of the personal data of employees and customers.
It will be important to note when the Bill of Data Protection has been finally discussed and approved by the Parliament; and accordingly becomes a binding Law in Indonesia. It will also be necessary to track when the implementing regulations of the Law are issued, since some very important concepts in the Bill will still need elaboration by implementing regulations, particularly for our international clients those regarding the transfer of Personal Data outside Indonesian territory. We will assist clients with this, including by providing further alerts.
This Client Alert is a publication prepared by Oentoeng Suria & Partners in association with Ashurst). It is only intended to inform generally on the topics covered and should not be treated as legal advice or relied upon when making investment or business decisions.
Authors: Ratih Nawangsari, Managing Partner; Rudy Kusmanto, Senior Counsel; and Made Aryasana, Associate.
