Personal Data Protection Law in Indonesia: The Law No. 11/2008 (“UU-ITE”) and its Amendment in 2016

By: Sonny Zulhuda

wonderful indonesiaIndonesia slowly emerges to put some regulations in place pertaining to the cyberspace activities. Few laws and regulations now come up that address personal data protection (PDP). In this first post, I would like to highlight some rules of personal data protection law as found in the first Indonesian cyberlaw, i.e. Law on e-Information and e-Transaction.

Law No. 11/2008 (“UU-ITE”)

First is the “Undang-undang Nomor 11 Tahun 2008 tentang Informasi dan Transaksi Elektronik” (popularly known as UU-ITE in Indonesian) or the Law No. 11 Year 2008 on the Electronic Information and Electronic Transaction (“Law No. 11/2008”).

This Law only has one section that addresses the issues of informational privacy or personal data protection, namely section 26. I had written some comments on this provision in my previous blog. In sum, section 26(1) provides for a general rule that consent is required whenever personal data is being electronically “used” (instead of “processed” – see my comments below). Section 26(2) provides that any breach or infringement of section 26(1) can be a basis for remedies.

Article 26 of the Law No. 11/2008 on the Electronic Information and Electronic Transaction (UU-ITE) stipulates that:

(1) Otherwise stipulated by the laws and regulations, the use of any information by means of electronic media relating to someone’s personal data shall be carried out with the approval from the person concerned.

(2) Every person whose privacy right is infringed upon as referred to in clause(1), may file a law-suit [action-added] for the loss incurred based on this Law. (As translated by the Ministry of Communication and Information Technology).

Meanwhile the statutory elucidation of the Act explains that this provision is an acknowledgement of the privacy right protection. It goes on explaining that, the meaning of privacy right includes the following:

  1. A right to enjoy a private life free from interference;
  2. A right to communicate with other persons free from spying/surveillance;
  3. A right to access to information about his private life and private information.

What we can draw from this provision is as follows:

First, that the recognition of the right to privacy as far as this law is concerned is only limited to that of data/informational privacy, i.e. the right of every person to control what kind of information about him should belong to public domain. (Other aspects of privacy rights include right of anonymity, right of solitude and much more).

Second, be that as it may, the right to information privacy here is further restricted to the ‘use’ of such data. This is overwhelmingly restrictive bearing in mind that the international standard of data privacy covers so many dimension including the collection, processing, use, retention and disclosure of personal data. Here, on the other hand, restricts the matter only to the ‘use’ of personal information.

Third, more restriction was put in place that such rule on the use of personal data is only applicable as long as it is a use ‘by means of electronic media’. Therefore, any use of people’s personal data by which are documented not in electronic media, such as the usual paper archives, will not be subject to this law.

Fourth, the law mentions the need to get the approval of a person whose personal data was to be used (by means of electronic media). This is never explained as to how such approval can be obtained. Is it sufficient to have it on the basis of ‘opt-out’ principle, or does it require a more protective ”opt-in’ principle? There is a big gap between the two in terms of requirements, efforts and consequences. The more protective it is (i.e. with ‘opt-in’ principle), the better for the data subjects, i.e. people whose data is being used.

Fifth, with all these exceptions (a ‘data privacy’ in ‘electronic media’ to be ‘used’ with an ‘approval’).. it is found that the legal redress is also not very attractive. It allows civil suit for damages but is silent about criminal penalties. Thus, while compensation might be aimed at, a deterrence could be significantly absent.

Based on my notes above, it is argued therefore, that this Law (UU-ITE) with due respect, is not the best answer for protecting people’s privacy right be it in electronic and conventional media. Nevertheless, this law is perhaps a little solution for a huge problem. Do we require further law?

Amendment by Law No. 19/2016: Right to be Forgotten

Eight years after the enactment, in 2016, this law was amended to introduce more sub-sections were inserted under section 26, which made it to five sub-sections in total. This amendment is popularly known as “The Right to be Forgotten” rule. Section 26(3)

The Law No. 19 Year 2016 on the Amendment to Law No. 11 Year 2008 introduces section 26(3) which says that (I quoted the original words):

“Setiap Penyelenggara Sistem Elektronik wajib menghapus Informasi Elektronik dan/atau Dokumen Elektronik yang tidak relevan yang berada di bawah kendalinya atas permintaan Orang yang bersangkutan berdasarkan penetapan pengadilan.

It says, “A controller of an electronic system must delete an electronic information and/or electronic document under his control which is no longer relevant if that deletion is requested by a related person through a decision of a court.”

So, this is, in other words, a right to be forgotten. A person is given a right to compel an electronic system controller in whose system his personal data is retained, to ensure that such personal data under his control be disposed of. However, two things are required. First, that the personal data is no longer relevant. And, secondly, that such obligation only applies if it is already upheld by a court of law.

In sub-section (4) it says that “Setiap Penyelenggara Sistem Elektronik wajib menyediakan mekanisme penghapusan Informasi Elektronik dan/ atau Dokumen Elektronik yang sudah tidak relevan sesuai dengan ketentuan peraturan perundang-undangan.”

This sub-section requires that for the disposal/deletion of such irrelevant electronic information and/or electronic document, the controller of an electronic system has to provide a specific mechanism that would be prescribed by law. To the best of my knowledge, there is no specific by-law or regulation as yet that prescribes this deletion mechanism to abide by.

Having said that, the additional rule found in Law No. 19/2016 can bring some fresh air that the Parliament has shown “some further interest” on the issue of personal data protection. Also, it seems that they are also trying to catch up with one of the few development on the matter, i.e. pertaining to the right to be forgotten, although it would seem a little “too soon” for the Indonesians. Ideally, we need to be first introduced and educated on the general principles of personal data and its protection, only then we embrace this specific issue later.

As a matter of fact, a right to be forgotten can be dealt with under the principle of data retention. Under such principle, data users must put in place mechanism to dispose of personal data when they are no longer in use. Alternatively, under consent and choice principles, a data user or data controller is obliged to data subjects’ request to delete data if they do not wish such data  to be processed any more by the data user/controller.

More comments will come later.

Speak Privacy an Asian Way — at Asia Privacy Bridge Forum in Korea

By: Sonny Zulhuda


Last week I received this invitation letter to speak at the Third Asia Privacy Bridge Forum, hosted by Barun ICT Research Centre, Yonsei University, Seoul, South Korea towards the end of June 2017. The Director of the Centre, Dr. Beomsoo Kim noted that this Forum is supported also by KISA (Korea Internet and Security Agency) and the Korean Ministry of Interior. I am asked to speak about the development of the data protection laws in two countries Malaysia and Indonesia.

This is an exciting surprise. Not only because it would be my first visit to Korea, but also because I will have an invaluable opportunity to mingle with the Asia Pacific and international network on privacy and data protection; and to share with them what is up in Malaysia and Indonesia on this subject. There are other speakers who are expected to speak from different jurisdictions: Korea, Japan, Singapore and China. After all, the event sets as an ultimate aim a common desire to move forward collectively and globally in addressing the challenges of enforcing data privacy laws.

From the Malaysian perspective, this is the time to showcase what it has done or set to do beyond the initial period of public education on the law. What has been done towards enforcement? That is specifically questions that I would like to share during the Conference. Besides, the fact that the industries have moved further to issue self-regulatory Codes of Practice is also a stimulating development.

From the Indonesian perspective, there is quite a few development to share. In the past year, it is noteworthy that the 2008 Law on Information and E-Transaction (“UU-ITE”) was amended by the  Parliament to strengthen some aspects of the law, including on the “Right to be Forgotten”. Then, still in 2016, the Information Minister issued a new Ministerial Regulation on the Protection of Personal Data Processed Electronically. This regulatory piece is indeed a milestone to the data privacy law in Indonesia, albeit that it is a subsidiary legislation, rather than a parliamentary statute. Beyond this, there is this Bill draft of the Personal Data Protection Act that has been consolidated in early 2017.

With all these development, I hope I can portray insightful updates to the Forum and ultimately to everyone who shares the interest on this subject. But first, let’s hope my visa is ready on time.

Ransomware Attack: How a PDP law compliance can be of any help

By: Sonny Zulhuda


No! We are not talking about how to cure a ransomware attack such as “WannaCry” after it happens. That is not going to happen. Legal compliance is, from the perspective of business continuity and data disaster management, always at the “preventive” side rather than “curative” or “recovery” domain. Just like how technically a data backup is more preventive rather than reactive.

Then, are we saying that complying with Personal Data Protection law is going to prevent incidents like ransomware attack? Not necessarily true. But obviously, by keeping yourself updated about legal requirements pertaining to personal data protection, you will activate a “standby” mode.

Complying with the legal requirements on data protection such as Data Security and Data Retention standards, for example, people in your organisation are made aware that some security measures had to be put in place to protect the personal data system, which often overlaps with other database or information systems in your organisation: payroll system, human resources system, financial system, CRM system, and so on, because in each of those there are personal data of data subjects that you or your organisation process/processes.

That is why, a compliance with PDP law such as the Malaysian Personal Data Protection Act 2010, can be a gateway to better data protection in your organisation from unwanted attacks or other risks to the data integrity and security. In fact, the PDPA 2010 hints that a data due diligence

In fact, the PDPA 2010 hints that a data due diligence such as your data risk management that you conduct in your organisation will not only mitigate the risk to data attack but also will be your “legal defence” in case such attack takes place despite your mitigating measures. This is what transpires from the provisions of the PDPA 2010.

So, the equation is not complicated:

Data due diligence = legal compliance + risk management = legal defence

Good luck! 🙂

When Ransomware “WannaCry” Attacks

By: Sonny Zulhuda 

Alkisah aplikasi tebusan (Ransomware) “WannaCry” melanda dunia cyber global…

150 negara dilanda ributnya, ribuan dolar uang tebusan diminta, ratusan ribu komputer terinfeksi, jutaan data terancam musnah, dan pastinya kesusahan yang tiada ternilai menghantui para korbannya.. “princeless” – istilah sebuah iklan komersial.

Apa yang harus dilakukan? 

Menghadapi bencana digital seperti ini, berlakulah prinsip yang sama upaya “Penanggulangan Bencana” yang baru-baru ini saya pelajari dalam kursus Disaster Management bersama MDMC. Penanggulangan bencana dibagi kepada tiga fase:

  1. Fase pra-bencana
  2. Fase saat bencana
  3. Fase pasca bencana.

Ketika seseorang atau sebuah instansi sudah menjadi korban malware WannaCry ini, maka hal pertama adalah penanggulangan saat bencana.

Langkah-langkah yang diambil harus cepat, tepat dan bertujuan menghentikan bencana atau meminimalisirnya baik dengan cara teknis seperti menghentikan koneksi Internet sementara, menyetop aplikasi perkongsian data, atau mengoreksi setting sistem informatika sebuah organisasi. Selain itu, langkah non-teknis harus segera dibuat: notifikasi kepada segenap jaringan tentang masalah ini, dan mereduksi aktivitas yang memerlukan aplikasi jaringan. Kalau perlu bekerjalah menggunakan laptop lain yang tidak terinfeksi. Jangan lupa sampaikan ke jaringan kerja atau teman-teman di media sosial bahwa anda sedang menghadapi masalah ini sehingga komunikasi kemungkinan menjadi terhambat.

Saya jadi teringat adagium klasik “sebaik-baik obat adalah dengan menjaga kesehatan” yang sangat relevan dalam dalam dunia teknologi informasi. Dari segi teknis, langkah-langkah preventif seperti penggunaan aplikasi yg standard, anti-virus yang selalu ter-update, dan penyediaan back-up data menjadi keharusan. Karena jika piranti kita sudah diserang dengan berbagai “unsur jahat”, maka kadang-kadang upaya kuratif yang reaktif menjadi tidak bermakna.

Dalam perspektif hukum dan kebijakan, upaya preventif juga menjadi sebuah keharusan. Jika tidak ingin terjerat masalah cybercrime, misalnya.. maka jangan bermain dengan apinya. Jangan terpancing dengan rekayasa sosial (social engineering) yang menawarkan hadiah, romantika cyber, teman virtual atau sekedar promosi-promosi yang menggiurkan.

Jika sudah terpedaya dengan pancingan itu, jika sudah terkontaminasi komputer kita oleh virusnya, jika sudah diambil data-data penting kita.. maka langkah reaktif menjadi tidak berguna.

Masih inget Bang Napi? “Waspadalah!!”

Ketahanan Digital

By: Sonny Zulhuda


Jika ingin sukses di era digital ini, Indonesia mesti memiliki ketahanan digital yang kuat. Apa maksudnya? Artinya ruang cyber kita harus memiliki resistensi yang cukup terhadapa potensi serangan cyber yang bisa melumpuhkan integritas bangsa.

Ya, integritas bangsa Indonesia tidak bisa hanya dipertahankan melalui pengamanan darat, laut dan udara. Namun juga pengamanan ruang cybernya! Saya kasih contoh diantaranya sebagai berikut:

1. Tentang keamanan piranti (lunak dan keras) dari ancaman pengrusakan: Apakah sistem komputerisasi yang digunakan oleh berbagai sektor publik dan swasta dilengkapi dengan standardisasi pengamanan? Apakah sudah cukup SOP bagi individu yang terlibat dalam penggunaan piranti tersebut?

2. Tentang integritas sistem komunikasi kita dari ancaman penyusupan; Apakah sistem telekomunikasi kita aman dari penyadapan pihak-pihak yang tidak bertanggungjawab?

3. Tentang ketahanan data publik dan privat dari ancaman pembocoran; apakah kita memiliki sistem teknologis dan perundangan yang cukup untuk mencegah pencurian data, pembobolan rahasia negara dan pembajakan rahasia dagang kita?

4. Tentang keamanan dan integritas data pribadi warga Indonesia dari ancaman penyalahgunaan; apakah sistem data e-KTP kita aman dan baik-baik saja? Siapakah yang menyimpan data serta mengontrol server back-upnya?

Tak ayal, insiden aplikasi jahat “WannaCry” baru-baru ini menjadi cambuk pedih yang mengingatkan kita, bahwa ketahanan digital menjadi sebuah keniscayaan.

Mari berbenah!

“Can my lecturer access my personal information?” – And Other Issues of Data Protection at the Higher Learning Institutions 

By: Sonny Zulhuda 

In the past week alone, I spoke about the personal data protection law at two Malaysian public universities; Universiti Sultan Zainal Abidin (UniSZA) Kuala Terengganu and Universiti Malaysia Pahang (UMP) Pekan. While the former was an internal programme, the latter talk was attended by other public universities’representatives who were members of Majlis Tatatertib dan Disiplin Universiti-universiti Awam Malaysia (MATDUM).

In this post, I would like to note some discussions we had on the implementation of the Personal Data Protection Act 2010 at the University environment.


The education industry is indeed among those where personal information is highly processed. The data subjects include students (prospective, actual and graduates), university’s employees, as well as any individuals involved in the data processing.

Continue reading

Data Sovereignty vs Data Localisation Law

By: Sonny Zulhuda

Transferring personal data beyond national boundaries has been a point of contention under many data protection laws across the globe. The European Union adopts this restriction that such transfer beyond EU boundaries cannot be done unless to the countries or places which have adequate protection on personal data of individuals.

Cloud-Data-SecurityThis rule is associated with the concept of “Data Sovereignty” which says that a country shall not lose a control or sovereignty over the processing of personal data pertaining to data subjects from that country. It also imposes that information which has been stored in digital form is subject to the laws of the country in which it is located. Therefore, a control over trans-border data flow is a form of upholding data sovereignty.

The concept of Data Sovereignty is reflected in the EU Data Protection Directives 1995 recitals whereas:

  • cross-border flows of personal data are necessary to the expansion of international trade;
  • the protection of individuals guaranteed in the Community by this Directive does not stand in the way of transfers of personal data to third countries which ensure an adequate level of protection;
  • the transfer of personal data to a third country which does not ensure an adequate level of protection must be prohibited.

As much as we are concerned with personal data transferred beyond our border, we also appreciate that personal data is inherently needed for the International trade and International cooperation. Hence, when a personal data is subject to trans-border flow, there shall be no discriminatory treatment to the citizen’s personal data despite where it is processed.

Data Localisation Law

This data sovereignty is sometimes confused with the rules of “Data Localisation”, which is totally a different thing. Data localisation laws set forth requirements to keep and store data “locally” (i.e., within national or regional borders), and thus not allowing data users to transfer data beyond borders. Consequently, any foreign party who wishes to collect or process personal data of individuals will be required to establish a local data storage facilities in the country of those individuals. Continue reading

  • June 2017
    M T W T F S S
    « May    
  • Visitor

    free counters

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,573 other followers