From Brussels: The Islamic Legal Conceptions of Privacy

By: Sonny Zulhuda

IMG_20190130_094243Last week (1st February 2019) I concluded the International Conference on Privacy and Data Protection (CPDP2019) in the heart of Europe, City of Brussels. It is organised by a consortium of primary European universities, supported by global companies, and endorsed by the European Union institutions.

It’s the 12th edition of this annual global event on privacy & data protection. 3 days of fascinating and thought-provoking talks, speeches and discussions. Thank you @CPDPconferences for inviting me as a speaker on privacy in Islam.

Thanks to @darahallinan who initiated this panel for the first time. Entitled “Islamic Legal Conceptions of Privacy.” The idea is to understand how privacy is actually a universal value adopted by wide and global communities and traditions.

Being the first speaker, I first introduced that for every Muslim, Islam is the way of life and provides a comprehensive guidelines for both private and public interactions.

Then I spoke mainly on the evidences from the Quran (as the primary source of Islamic law) which provide basis of privacy right and how to implement it in life, starting from early childhood: they should ask parent’s permission before entering their private rooms at three specific times in a day.

I highlighted how important it is to respect others’ dignity by not transgressing their rights, not spying on them, not backbiting, not ridiculing them, and not calling them by undesired labelling/tagging.

Muslims are told to get mutual consent when affecting others’ rights, to record agreements, to enter their houses upon prior consent, and to leave if asked to. Not less importantly a command to investigate information received (verification and authentication).

Those are exactly the rights pertinent to privacy and data protection nowadays.

At the end, I noted that 1. Islam calls for peace, justice and harmony; 2. Privacy is one of important rights to be preserved; and 3. At all time, Muslims will be accountable to God, Society and oneself.

And not forgetting I also shared some updates on the privacy laws and Personal Data Protection laws in both Indonesia and Malaysia. Some good news here and there.

Thank You Chair, moderator and fellow panelists Prof Andrew Adams (Japan), Prof Elizabeth Coombs (Malta), Nighat Dad (Pakistan), Lahoussine Aniss (Marocco), and Patrick Penninckx (EU) for making it a beautiful panel. Looking forward to connecting further. Thank you @CPDPconferences.

#PrivacyinIslam #CPDP2019 #Brussels #Malaysia #Indonesia #PDPA

Menyoal Tren “10 Years Challenge”

By: Sonny Zulhuda

jpdp

Akhir-akhir ini pengguna media sosial pasti sudah banyak melihat foto-foto transformasi wajah yang dilabel hashtag #10yearschallenge. Tidak kurang, politisi dunia hingga artis dan selebriti pun berpartisipasi dalam trend yang satu ini. Aktivitas ini dimanfaatkan oleh masyarakat media sosial sebagai bahan hiburan dan obrolan yang menarik dan tidak jarang menggelitik.

Namun, mungkin banyak yang sadar bahwa foto-foto yang disebar itu akan memudahkan pihak media sosial atau pihak ketiga untuk melakukan beberapa pekerjaan mereka seperti:

1. Penyempurnaan database wajah individu berikut kronologi tahun dan usia.
2. Penelitian pola transformasi wajah manusia berdasarkan usia, periode, dan demografi lainnya seperti ras, gender, lingkungan, dan lainnya.
3. Pemrograman pada teknologi artificial ingelligence dalam melakukan rekaan wajah secara lebih akurat.
4. Identifikasi dan penyamaran.

Apalagi, dengan label yang sangat indikatif seperti #10yearschallenge akan semakin memudahkan penyaringan dan interpretasi data sehingga memberikan jalan pintas untuk pencarian data itu sendiri. Label hashtag itu sama dengan fungsi metadata. Semakin banyak hashtag, maka akan semakin mudah pencarian data tersebut di domain publik.

Continue reading

“Right to be Forgotten” in Indonesian Data Protection Law (A Focus Group Discussion with BINUS University)

By: Sonny Zulhuda

This report is based on what has been written on BINUS Website in the original Indonesian version. The Focus Group Discussion took place on 11th August 2018 in Kuala Lumpur. The participants were Prof. Dr. Shidarta, Prof. Dr. Bambang Pratama, and Reinhard Christian Surya from BINUS Law School, Jakarta and myself. The main topic was on the the right to be forgotten.

I reckoned in that meeting that the regulation on right to be forgotten as introduced in the latest 2016 amendment to the Indonesian e-transactions laws (namely UU ITE in Indonesian) was a drastic development bearing in mind that there is still no comprehensive legislation in Indonesia dealing with the protection of personal data which is now increasingly becoming a new global norm. In my view, Indonesia should first settle with the currently ongoing debate on the draft bill of the Personal Data Protection law.

Right to be forgotten is indeed a sub-set of many rights relating to personal data processing of an individuals. In many laws, this right to be forgotten is interchangeably discussed with the right to data deletion.

fgd binus 2018

In Malaysia this right is impliedly given because it mandates every data user (those who process personal data of individuals) to ensure data are deleted when they are no longer necessarily required. Similar provisions can be found in the laws of other countries such as UK, Hong Kong and Singapore. In Indonesia, there is still no law (Undang-undang) which defines and lays down similar requirements.

In its Indonesian report, the Website continues to note: Continue reading

Privasi dan Integritas Teknologi

Dr Sonny Zulhuda

This article, in Indonesian, was published in the national daily REPUBLIKA, on 3rd April 2018. This piece highlights the ultimate need to have a privacy-embedded technologies. Respecting privacy is a prerequisite to maintain the integrity in the use of technology. As I concluded, the connectivity that we currently enjoy shall not eliminate the identity and integrity that shape who we are, as individuals and nation.

================

boss-spying-on-youBerbagai isu kebocoran data pribadi seperti yang baru-baru ini berlaku pada data registrasi nomor telpon seluler di Indonesia, dan juga pada data pengguna Facebook di Amerika Serikat (AS), membawa kita kepada pertanyaan yang lebih fundamental, yaitu hak privasi terhadap data. Apakah hak privasi itu sendiri?

Jarang didefinisikan, namun sering diperdebatkan. Misalnya, dalam menyikapi isu penyadapan komunikasi oleh penegak hukum di Indonesia, masyarakat kita berpolemik sejauh mana penyadapan bisa dilakukan, mengingat efeknya yang mengoyak kebebasan dalam berkomunikasi. UUD 1945 menjamin hak kita untuk berkomunikasi dan menyampaikan pemikiran atau pendapat. Jika komunikasi kita disadap, maka hak kita sudah disunat. Dalam konteks inilah Dewan Keamanan Nasional AS dikritik tajam ketika mantan pekerjanya Edward Snowden mengungkap praktik Badan itu dalam mengawasi komunikasi dan data pribadi pengguna Internet AS dan global.

Di Malaysia, pengadilan memvonis salah perbuatan memasang kamera CCTV di pekarangan rumah sendiri namun mengarahkannya ke halaman rumah orang lain karena mengganggu privasi tetangganya. Di Afganistan, orang dilarang memanjat genteng rumahnya sendiri sebelum memberitahukan tetangganya agar si jiran tidak terlihat dalam kondisi yang memalukan. Di Korea, kamera telpon seluler harus disetting dengan suara yang cukup nyaring sehingga orang tahu jika ia difoto di kawasan publik. Semua contoh diatas muaranya sama, yaitu melindungi privasi orang.

Kita tidak ingin teknologi modern yang nisbi menggerus sisi kemanusiaan yang universal dan hakiki. Teknologi informasi kita di negeri ini tidak boleh bebas nilai, dan tidak boleh pula miskin nilai. Koneksitas dan mobilitas yang semakin baik merupakan anugerah yang harus kita syukuri. Namun perlu diingat, koneksitas tidak dapat menghapus identitas, dan mobilitas tidak bisa meminggirkan integritas. Majulah TI di Indonesia.

Berasal dari bahasa Inggris, “privacy” berarti hak untuk bersendirian dan untuk tidak diawasi oleh orang lain. Padanannya dalam bahasa Arab adalah “huquq fardiyyah” (hak-hak pribadi) atau “huquq al-hurmah” (dignity atau maruah).

Dalam dialektika Alquran, Continue reading

Data Breach a Test to Our Digital Resilience

By: Sonny Zulhuda
DSC_0025
Malaysian public has recently been perturbed by a series of personal data breach one after another. While the investigation is taking place, one can only expect that what has surfaced may only be a tip of an iceberg.
As the country embraces digital economy and aims at a cashless society by 2020, this data security crisis becomes a part of the equation. More digitised information and more synchronised data mean a bigger risk of data breach calamities. As a country, there is no backing out from this equation even though that means we have to learn it hard.
As a consequence, a data breach is not a matter of ‘whether’ but is a matter of ‘when’ it will happen. This requires us to adopt a risk management approach. Failure of managing the risks can be increasingly costly. The problem is, it is too often when we realise there is a data, it may be already too late. The alleged leak and illegal sale of Malaysian telecommunications data are said to have happened years ago. By now, we are already five years too late!
Time is of the essence here. As we start to learn about the breaches that took place, swift actions are warranted. There are few points to consider by all the stakeholders.
Firstly, data users can do the least by keeping the public informed about what is going on.
Even though our PDP law does not oblige data users to notify data subjects about any breach, this is warranted for transparency and trust preservation, and hence their business continuity plan.
Secondly, we should treat this as an issue of national security.
Not only because massive data of the majority of the public is affected, but also because those data come from the telecommunications and financial industries which are deemed among the ten critical national information infrastructures (CNII) as outlined by the Malaysian National Cyber Security Policy (NCSP) 2006. So, data security under this CNII must be given utmost priority. Both public and private sectors must cooperate in dealing with the crises.
Thirdly, it is time to test the mechanism of our law.
These incidents of a personal data breach either maliciously or negligently occurred, will need to be tested against the Personal Data Protection principles enshrined in the Act. The authority needs to speed up the activation of the Personal Data Protection Act (PDPA) 2010 after some “day-nap”. Other agencies need to help in accordance with the statutory powers granted to each of them.

7E3A8212

The year 2017 is notably the beginning of some successful prosecutions under the Act, which is a crucial milestone in itself. On a positive note, we should take this crisis as an opportunity to also prove our legal mechanism. 

On top of that, what we are facing now is something bigger: it is testing our resilience as a nation. The challenge is more than a damage control: it is to deal efficiently with the massive data crisis like what is happening now.

This is not a one-off duty as data security is a process rather than a result. As Vince Lombardi was once famously quoted, it is not so much about how we fall down, but rather on how to raise back. And by “we” I mentioned in this last paragraph, it is you and me and every one of us the individuals to whom the personal data actually belong to.

Personal Data Protection Law in Indonesia: The Law No. 11/2008 (“UU-ITE”) and its Amendment in 2016

By: Sonny Zulhuda

wonderful indonesiaIndonesia slowly emerges to put some regulations in place pertaining to the cyberspace activities. Few laws and regulations now come up that address personal data protection (PDP). In this first post, I would like to highlight some rules of personal data protection law as found in the first Indonesian cyberlaw, i.e. Law on e-Information and e-Transaction.

Law No. 11/2008 (“UU-ITE”)

First is the “Undang-undang Nomor 11 Tahun 2008 tentang Informasi dan Transaksi Elektronik” (popularly known as UU-ITE in Indonesian) or the Law No. 11 Year 2008 on the Electronic Information and Electronic Transaction (“Law No. 11/2008”).

This Law only has one section that addresses the issues of informational privacy or personal data protection, namely section 26. I had written some comments on this provision in my previous blog. In sum, section 26(1) provides for a general rule that consent is required whenever personal data is being electronically “used” (instead of “processed” – see my comments below). Section 26(2) provides that any breach or infringement of section 26(1) can be a basis for remedies.

Article 26 of the Law No. 11/2008 on the Electronic Information and Electronic Transaction (UU-ITE) stipulates that:

(1) Otherwise stipulated by the laws and regulations, the use of any information by means of electronic media relating to someone’s personal data shall be carried out with the approval from the person concerned.

(2) Every person whose privacy right is infringed upon as referred to in clause(1), may file a law-suit [action-added] for the loss incurred based on this Law. (As translated by the Ministry of Communication and Information Technology).

Meanwhile, the statutory elucidation of the Act explains that this provision is an acknowledgement of the privacy right protection. It goes on explaining that, the meaning of privacy right includes the following:

  1. A right to enjoy a private life free from interference;
  2. A right to communicate with other persons free from spying/surveillance;
  3. A right to access to information about his private life and private information.

Continue reading

Speak Privacy an Asian Way — at Asia Privacy Bridge Forum in Korea

By: Sonny Zulhuda

seoul.jpg

Last week I received this invitation letter to speak at the Third Asia Privacy Bridge Forum, hosted by Barun ICT Research Centre, Yonsei University, Seoul, South Korea towards the end of June 2017. The Director of the Centre, Dr. Beomsoo Kim noted that this Forum is supported also by KISA (Korea Internet and Security Agency) and the Korean Ministry of Interior. I am asked to speak about the development of the data protection laws in two countries Malaysia and Indonesia.

This is an exciting surprise. Not only because it would be my first visit to Korea, but also because I will have an invaluable opportunity to mingle with the Asia Pacific and international network on privacy and data protection; and to share with them what is up in Malaysia and Indonesia on this subject.

There are other speakers who are expected to speak from different jurisdictions: Korea, Japan, Singapore and China including: 1. Dr. Beomsoo Kim (Yonsei University, South Korea); 2. Jongsoo Yoon (Lee & Ko, South Korea); 3. Dr. Kaorii Ishii (University of Tsukuba, Japan); 4. Dr. Warren B. Chick (Singapore Management University); 5. Dr. Sonny Zulhuda (International Islamic University Malaysia); 6. Mr. Eunsil Lee (Seoul Metropolitan Police Agency); and Rona Morgan, Singapore-based IAPP Asia Director.

After all, the event sets as an ultimate aim a common desire to move forward collectively and globally in addressing the challenges of enforcing data privacy laws.

From the Malaysian perspective, this is the time to showcase what it has done or set to do beyond the initial period of public education on the law. What has been done towards enforcement? That is specifically questions that I would like to share during the Conference. Besides, the fact that the industries have moved further to issue self-regulatory Codes of Practice is also a stimulating development.

From the Indonesian perspective, there is quite a few development to share. In the past year, it is noteworthy that the 2008 Law on Information and E-Transaction (“UU-ITE”) was amended by the  Parliament to strengthen some aspects of the law, including on the “Right to be Forgotten”. Then, still in 2016, the Information Minister issued a new Ministerial Regulation on the Protection of Personal Data Processed Electronically. This regulatory piece is indeed a milestone to the data privacy law in Indonesia, albeit that it is a subsidiary legislation, rather than a parliamentary statute. Beyond this, there is this Bill draft of the Personal Data Protection Act that has been consolidated in early 2017.

With all these development, I hope I can portray insightful updates to the Forum and ultimately to everyone who shares the interest on this subject. But first, let’s hope my visa is ready on time.

UPDATE: the visa was ready on 23rd June, and I’m scheduled to fly on Sunday night.

  • November 2019
    M T W T F S S
    « Oct    
     123
    45678910
    11121314151617
    18192021222324
    252627282930  
  • Visitor

    free counters

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,630 other followers