[PRESS RELEASE] The Challenges of Implementing Personal Data Protection in Indonesia | Digital Expert Talks #5 with Meta

November 16, 2021 1:14 pm || By

Yogyakarta, 11 November 2021 – A year has passed, but the Personal Data Protection Bill (RUU PDP) is still in the process of being discussed at the DPR level. The PDP Bill, later expected to become an umbrella law that harmonizes sectoral regulations, does not escape challenges. Not only are challenges related to regulations, but also challenges in implementing this regulation. Responding to this phenomenon, CfDS collaborated with Meta to hold Digital Expert Talks #5 with the theme Challenges of Implementing Personal Data Protection in Indonesia, with speakers Bobby Adhityo Rizaldi (Member of the Indonesian House of Representatives Commission), Tuaman Manurung (Sub Coordinator of Governance for PDP Kominfo RI), Noudhy Valdryno ( Facebook Indonesia & Timor Leste Public Policy Manager), Dr. Novi Kurnia (JAPELIDI Coordinator & Lecturer of the Dept. of Communication, FISIPOL UGM). This activity is broadcast live on Facebook (http://ugm.id/liveDET5FB) and Youtube (http://ugm.id/liveDET5)

Constraints and Strategies for Drafting the PDP Bill

According to Tuaman, the PDP Bill had been drafted since 2018, but there were many obstacles in practice. The PDP Bill is considered quite complicated due to the condition and lack of public literacy. However, even though the law that will soon be ratified is still general, it is hoped that by 2024 the PDP Law will be mature and applied in Indonesia. Therefore, the strategy taken by Kominfo is:

  • Pushing the PDP Bill to be enacted
  • Develop procedures or standards that can be used by Electronic System Operators (PSE)
  • Prepare the concept of institutional procedures (SOP) and human resources
  • Develop a grand design of the DPO ecosystem (Certification and standardization) and the curriculum that will be used
  • Assessing the readiness of electronic system operators and certification bodies
  • Carry out national cooperation for the private and public spheres
  • Education, socialization, and promotion related to PDP

Tuaman also added that “the PDP Law will be able to guarantee the protection of personal data because in this PDP Bill it is already regulated on how the controller or processor fulfills its obligations to carry out or apply the principles of data protection and respect the rights of data subjects.”

Dynamics of Determination of PDP Authority Institutions

One of the challenges that still hinders the passage of the PDP law is the agency of authority that will oversee the law’s implementation. According to Bobby, this institution will not only have the authority to investigate but also to correct and recommend sanctions in the future. So that in the future, all problems related to PDP will go to the supervisory agency first and not only into the criminal realm. Therefore, the Panja tries to formulate a professional, accountable, independent authority institution, and most importantly, has representatives from not only the government but also industry and society. He also added, “If the institution that handles the PDP wants to be under a ministry or government, it is better to change the law, and there is no need to regulate personal data held by the state and leave it a state secret.”

The Role of the Platform in the Implementation of Personal Data Protection

As a platform, Meta strives to promote public awareness of the importance of protecting personal data. According to Ryno, previously, Meta in the Facebook application already had a “Control Privacy” campaign because many Indonesians did not realize the importance of the PDP and realized that they were data subjects. Not only that, realizing that currently the PDP Bill is still changing and has not been enacted, Ryno as a representative of Meta, hopes that the development of this law can be accelerated. However, not only related to regulations but how to educate and introduce the law to the public must also be considered carefully. He also added that “education related to privacy is quite difficult and takes a long time, both in terms of the platform to the people who are the data subjects.”

PDP Bill Implementation Strategy

In her presentation, Novi emphasized that for the implementation of the PDP Bill, all stakeholders must move because PDP is a joint work of the government, industry, universities, literacy activists, and the general public. The number of stakeholders also needs to be prepared both on a small and large scale, considering that data is on digital platforms and on sectors that can store many data. Not only that, there needs to be readiness and awareness for each individual as a data subject because they are the ones who have the initial data. Finally, Novi advised maximizing the implementation of the PDP Bill “The law is indeed used to protect, but how we as digital users must also be able to protect our data.”

Author: Firya Q. Abisono
Editor: Ruth T. Simanjuntak