Personal Data Protection Law in Indonesia: The Law No. 11/2008 (“UU-ITE”) and its Amendment in 2016

By: Sonny Zulhuda

wonderful indonesiaIndonesia slowly emerges to put some regulations in place pertaining to the cyberspace activities. Few laws and regulations now come up that address personal data protection (PDP). In this first post, I would like to highlight some rules of personal data protection law as found in the first Indonesian cyberlaw, i.e. Law on e-Information and e-Transaction.

Law No. 11/2008 (“UU-ITE”)

First is the “Undang-undang Nomor 11 Tahun 2008 tentang Informasi dan Transaksi Elektronik” (popularly known as UU-ITE in Indonesian) or the Law No. 11 Year 2008 on the Electronic Information and Electronic Transaction (“Law No. 11/2008”).

This Law only has one section that addresses the issues of informational privacy or personal data protection, namely section 26. I had written some comments on this provision in my previous blog. In sum, section 26(1) provides for a general rule that consent is required whenever personal data is being electronically “used” (instead of “processed” – see my comments below). Section 26(2) provides that any breach or infringement of section 26(1) can be a basis for remedies.

Article 26 of the Law No. 11/2008 on the Electronic Information and Electronic Transaction (UU-ITE) stipulates that:

(1) Otherwise stipulated by the laws and regulations, the use of any information by means of electronic media relating to someone’s personal data shall be carried out with the approval from the person concerned.

(2) Every person whose privacy right is infringed upon as referred to in clause(1), may file a law-suit [action-added] for the loss incurred based on this Law. (As translated by the Ministry of Communication and Information Technology).

Meanwhile the statutory elucidation of the Act explains that this provision is an acknowledgement of the privacy right protection. It goes on explaining that, the meaning of privacy right includes the following:

  1. A right to enjoy a private life free from interference;
  2. A right to communicate with other persons free from spying/surveillance;
  3. A right to access to information about his private life and private information.

What we can draw from this provision is as follows:

First, that the recognition of the right to privacy as far as this law is concerned is only limited to that of data/informational privacy, i.e. the right of every person to control what kind of information about him should belong to public domain. (Other aspects of privacy rights include right of anonymity, right of solitude and much more).

Second, be that as it may, the right to information privacy here is further restricted to the ‘use’ of such data. This is overwhelmingly restrictive bearing in mind that the international standard of data privacy covers so many dimension including the collection, processing, use, retention and disclosure of personal data. Here, on the other hand, restricts the matter only to the ‘use’ of personal information.

Third, more restriction was put in place that such rule on the use of personal data is only applicable as long as it is a use ‘by means of electronic media’. Therefore, any use of people’s personal data by which are documented not in electronic media, such as the usual paper archives, will not be subject to this law.

Fourth, the law mentions the need to get the approval of a person whose personal data was to be used (by means of electronic media). This is never explained as to how such approval can be obtained. Is it sufficient to have it on the basis of ‘opt-out’ principle, or does it require a more protective ”opt-in’ principle? There is a big gap between the two in terms of requirements, efforts and consequences. The more protective it is (i.e. with ‘opt-in’ principle), the better for the data subjects, i.e. people whose data is being used.

Fifth, with all these exceptions (a ‘data privacy’ in ‘electronic media’ to be ‘used’ with an ‘approval’).. it is found that the legal redress is also not very attractive. It allows civil suit for damages but is silent about criminal penalties. Thus, while compensation might be aimed at, a deterrence could be significantly absent.

Based on my notes above, it is argued therefore, that this Law (UU-ITE) with due respect, is not the best answer for protecting people’s privacy right be it in electronic and conventional media. Nevertheless, this law is perhaps a little solution for a huge problem. Do we require further law?

Amendment by Law No. 19/2016: Right to be Forgotten

Eight years after the enactment, in 2016, this law was amended to introduce more sub-sections were inserted under section 26, which made it to five sub-sections in total. This amendment is popularly known as “The Right to be Forgotten” rule. Section 26(3)

The Law No. 19 Year 2016 on the Amendment to Law No. 11 Year 2008 introduces section 26(3) which says that (I quoted the original words):

“Setiap Penyelenggara Sistem Elektronik wajib menghapus Informasi Elektronik dan/atau Dokumen Elektronik yang tidak relevan yang berada di bawah kendalinya atas permintaan Orang yang bersangkutan berdasarkan penetapan pengadilan.

It says, “A controller of an electronic system must delete an electronic information and/or electronic document under his control which is no longer relevant if that deletion is requested by a related person through a decision of a court.”

So, this is, in other words, a right to be forgotten. A person is given a right to compel an electronic system controller in whose system his personal data is retained, to ensure that such personal data under his control be disposed of. However, two things are required. First, that the personal data is no longer relevant. And, secondly, that such obligation only applies if it is already upheld by a court of law.

In sub-section (4) it says that “Setiap Penyelenggara Sistem Elektronik wajib menyediakan mekanisme penghapusan Informasi Elektronik dan/ atau Dokumen Elektronik yang sudah tidak relevan sesuai dengan ketentuan peraturan perundang-undangan.”

This sub-section requires that for the disposal/deletion of such irrelevant electronic information and/or electronic document, the controller of an electronic system has to provide a specific mechanism that would be prescribed by law. To the best of my knowledge, there is no specific by-law or regulation as yet that prescribes this deletion mechanism to abide by.

Having said that, the additional rule found in Law No. 19/2016 can bring some fresh air that the Parliament has shown “some further interest” on the issue of personal data protection. Also, it seems that they are also trying to catch up with one of the few development on the matter, i.e. pertaining to the right to be forgotten, although it would seem a little “too soon” for the Indonesians. Ideally, we need to be first introduced and educated on the general principles of personal data and its protection, only then we embrace this specific issue later.

As a matter of fact, a right to be forgotten can be dealt with under the principle of data retention. Under such principle, data users must put in place mechanism to dispose of personal data when they are no longer in use. Alternatively, under consent and choice principles, a data user or data controller is obliged to data subjects’ request to delete data if they do not wish such data  to be processed any more by the data user/controller.

More comments will come later.

Speak Privacy an Asian Way — at Asia Privacy Bridge Forum in Korea

By: Sonny Zulhuda

seoul.jpg

Last week I received this invitation letter to speak at the Third Asia Privacy Bridge Forum, hosted by Barun ICT Research Centre, Yonsei University, Seoul, South Korea towards the end of June 2017. The Director of the Centre, Dr. Beomsoo Kim noted that this Forum is supported also by KISA (Korea Internet and Security Agency) and the Korean Ministry of Interior. I am asked to speak about the development of the data protection laws in two countries Malaysia and Indonesia.

This is an exciting surprise. Not only because it would be my first visit to Korea, but also because I will have an invaluable opportunity to mingle with the Asia Pacific and international network on privacy and data protection; and to share with them what is up in Malaysia and Indonesia on this subject. There are other speakers who are expected to speak from different jurisdictions: Korea, Japan, Singapore and China. After all, the event sets as an ultimate aim a common desire to move forward collectively and globally in addressing the challenges of enforcing data privacy laws.

From the Malaysian perspective, this is the time to showcase what it has done or set to do beyond the initial period of public education on the law. What has been done towards enforcement? That is specifically questions that I would like to share during the Conference. Besides, the fact that the industries have moved further to issue self-regulatory Codes of Practice is also a stimulating development.

From the Indonesian perspective, there is quite a few development to share. In the past year, it is noteworthy that the 2008 Law on Information and E-Transaction (“UU-ITE”) was amended by the  Parliament to strengthen some aspects of the law, including on the “Right to be Forgotten”. Then, still in 2016, the Information Minister issued a new Ministerial Regulation on the Protection of Personal Data Processed Electronically. This regulatory piece is indeed a milestone to the data privacy law in Indonesia, albeit that it is a subsidiary legislation, rather than a parliamentary statute. Beyond this, there is this Bill draft of the Personal Data Protection Act that has been consolidated in early 2017.

With all these development, I hope I can portray insightful updates to the Forum and ultimately to everyone who shares the interest on this subject. But first, let’s hope my visa is ready on time.

Personal Data Governance from A Cyber Security Perspective

By: Sonny Zulhuda

Data privacy and data security are two sides of a coin – unseparable. Despite efforts by experts to explain this, yet the misunderstanding that they defeat each other is still widely looming.  In this APAC Cyber Security Summit held in on 3rd June 2016 in Kuala Lumpur and attended by more than two-hundred regional participants, I took another attempt to explain this: How protecting one’s data privacy can contribute to a larger information security practices. Not coincidentally, one can see it from the other side: In order to afford maximum protection of one’s privacy, efforts must be taken to secure his data. Thus, data security is part of a bigger personal data privacy protection. Confused? Don’t be.

APAC Cyber Summit 2016_1The truth is, personal data management does include protecting its confidentiality, integrity and availablity. And doing so, it means one must ensure the privacy and security of personal data goes side by side.

In a report released by the PriceWaterhouseCoopers (PWC) in 2016 on Personal Data Use Governance – Mitigate Risk while Unlocking Business Value, there is a sfift (or more sutiably, an expansion) of personal data risks landscape from merely a security and regulatory issue, to an intersection of issues of ethical, regulatory, litigation, security and serivce quality.

At this Conference, I highlighted the latest status and implementation of the Malaysian Personal Data Protection Act 2010 and tried to show how the new regulatory framework reshape the landscape of information security in Malaysia.

The points can be summarised as follows:

  1. Perspective #1. PDPA 2010 creates data management principles
  2. Perspective #2. PDPA 2010 spells out the duties throughout data lifecycle
  3. Perspective #3. PDPA 2010 identifies data risks
  4. Perspective #4. PDPA 2010 creates new data offences
  5. Perspective #5. PDPA 2010 creates duty of data due diligence

Privacy – How to be Assured in Cyberspace

By: Sonny Zulhuda

This year’s ISACA Malaysia’s Conference is renamed a CyberSecurity, IT Assurance & Governance (CIAG) Conference 2016, held on 30th May 2016, in Le Méridien hotel, Kuala Lumpur. My friends and colleagues in ISACA Malaysia are kind enough to invite me for the fourth time in their annual national conference. Last year, I was invited to speak about the pros and cons of Internet of Things (IoT) in the form of a debate, together with a representative from the Malaysian Digital Economy Corporation (MDec).

 

In this year’s edition, I was seated in a panel discussion to speak about the protection (or  Assurance) of privacy in the cyberspace. With me as panelists are Mr. Retnendran Subramaniam CISA, CRISC (former ISACA Malaysia chairman) and Mr. Victor Lo, the Head of Information Security, InfoTech Division, MDeC. The panel was moderated by Mr. Jason Yuen from the Ernst & Young Malaysia. Continue reading

Making sense of Dark Data

By: Sonny Zulhuda

BIG-DATAWhile big data is by now a commonly heard term, dark data is not. Some participants in the recently-held Singapore Symposium whispered to me that they had never heard about the term – so you can say they were in dark about Dark Data.

The term is new to me as well! Except that I have had a little earlier opportunity than those guys to read about it and to finally make sense of it.

It all rooted from the fact that we have had an abundance of data around us, and how much those abundant data are capable of being sourced as information. Yes, it is about Big Data. As we know, Big Data is about quantifying everything possible to be a data. A person’s identity is no longer depending on what is printed on documents (ID, passport, certificates) about him. A person is now identifiable from his mumbling words, his movement, his location, his mood and even the pattern of what he will do every day. All those data are being quantified and measured due to their availability from myriads of media, devices, and interactions (both human and artificial). What makes it possible? You name it: Mobile gadgets, Social media, CCTVs and commercial transactions you have been making, to name a few.

In organisational life, the same is happening. More and more data are collected and stored by organisations, manually and electronically. Data of employees (and their mumbling words, movements, location, mood, etc.), of visitors, of business transactions, of internal meetings, of vendor’s works, of all reports, records and repositories, etc. are increasingly collected, stored…. but not necessarily used. In many occasions those data are no longer usable after their first collection, and yet they still fill up the organisation’s storage (recent research indicates that these unusable data may stack up to 70% of oganisations’ data).

Those are dark data. Untapped, untagged and sometimes unknown data.

Now is this: the fact that they remain unused does not mean they are valueless. You can run this simple test: Should you dump all these data to your competitor or any third party, would there be a loss to suffer? What about a competitive loss, breach of secrets, infringement of privacy, reputation loss, legal liability? If yes, then such Dark Data should be urgently managed.

That is the first message that I delivered in my 1-hour talk in Singapore yesterday.

Data Protection in the Era of Big Data, the Internet of Things (IoT) & Cloud Computing

By: Sonny Zulhuda

ALB Conference 2015This is the second such conference being organised by ALB/Thomson Reuters on Data Protection following the successful event a year ago. I spoke in a panel session last year, and will be speaking again this time. The conference will be on Thursday, 7th May 2015 at the JW Marriott Kuala Lumpur.

Keynotes will be delivered by Trevor Hughes, President of the International Association of Privacy Professionals (IAPP); Dr. Zainal Abidin Sait, Deputy Director-General of the Personal Data Protection Malaysia Department (PDPD); and Prof. Abu Bakar Munir, who was the Data Protection Consultant to the Malaysian Government.

My panel session is the one slotted at 16:10, focusing on “Data protection in the era of Big Data, the Internet of Things (IoT) & cloud computing,” covering the Jurisdiction and marketplace: Asia Pacific, EU and US.

Continue reading

PDP Law Compliance for Educational Institution

By: Sonny Zulhuda

Educational institutions -universities, colleges, schools, etc.- are among those who are regulated by the Personal Data Protection Act (PDPA) 2010. The data subjects include: students (obviously the main object here), staffs or employees, vendors, alumni, sponsors, as well as those applicants who have yet join the universities/schools.

The amount of personal data are potentially bulky: personal details, medical records, financial and scholarship records, academic records, student societies records, disciplinary records and even post-study information about the students. Given this situation, people who deal with students’ data in the educational institutions would need to ensure their handling of personal data is in line with the demands of the Act.

In introducing the subject matter to the community in the University, I will be speaking in this following workshop, together with my friend Noriswadi Ismail from Quotient Consulting Sdn Bhd and PDP Academy LLP, and Dr. Federico Feretti from Brunel Law School, London, UK.

Banner PDP Workshop AIKOL 28052014 (4)

  • June 2017
    M T W T F S S
    « May    
     1234
    567891011
    12131415161718
    19202122232425
    2627282930  
  • Visitor

    free counters

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,573 other followers