Background

Being dubbed as the biggest digital economy among Southeast Asian countries,[1] Indonesia has shown significant digital economy growth for the past three years, from US$ 40 billion in 2019 to US$ 70 billion in 2021.[2] With the 20% increase of internet penetration in Indonesia since the emergence of the Corona Virus Disease 2019 (COVID-19) pandemic, the Indonesian Government becomes more optimistic that the digital economy might contribute up to US$ 150 billion to Indonesia’s economic growth in 2025.[3]

The growth of Indonesia’s digital economy itself depends on various aspects, including consumer protection. The Indonesian Government has even asserted that the development of the country’s digital economy should always take consumer protection into account.[4] Indeed, consumer protection affects the level of trusts from the consumers in having their transactions.[5]

Consumer protection in the digital economy involves a wide range of issues.[6] Of all, personal data protection is an alarming issue to be solved in Indonesia since the number of cases concerning personal data keeps increasing, while the laws and regulations that address these cases remain scattered in various sectors and fall under various authorities, which leads to confusion and unfocused efforts in providing proper personal data protection for the consumers.[7]

The Indonesian Government has attempted to solve the abovementioned problems by preparing the Draft Bill on Personal Data Protection (Rancangan Undang-Undang Pelindungan Data Pribadi – “RUU PDP”), which was drafted with due reference to European Union’s General Data Protection Regulation (“GDPR”)[8], a legal framework that is considered to be the most modern and comprehensive instrument on personal data protection and has therefore been referred to by many other countries in establishing their own personal-data-protection laws.[9] Indeed, when it’s passed as a law, RUU PDP will become the main regulatory framework which specifically and comprehensively addresses personal data protection in Indonesia hence eliminates the confusion and promotes better supervision and legal enforcement within this field.[10] Ultimately, the promulgation of RUU PDP into law is expected to improve protection towards consumers’ data in the digital economy.[11]

However, at the time this paper is written, the RUU PDP is still being discussed by the Indonesia’s House of Representatives with the aim for it to be promulgated within the second semester of 2022.[12] In the meantime, consumers are still relying on the existing various regulations for their personal data protection, which may possess serious issues due to the factor of uncertainty as to which framework of data protection that can apply. Against this backdrop, this paper is shall be written from the perspective of the consumer with a hope that it could provide the consumers better understanding on the existing regulatory frameworks and best practices to protect their personal data.

Personal Data: Definition and Scope

To be able to protect their personal data, consumers must first understand the definition of personal data as well as the scope of data that is considered as personal data. As mentioned earlier, personal data protection is currently addressed under various laws and regulations on a sectoral basis. The table below elaborates several sectors and the relevant regulations which address the definition and scope of personal data:

Sectors	Regulations	Definition and Scope
Telecommunication and Informatics	Law No. 11 of 2008 on Electronic Information and Transactions and its amendment (collectively referred to as “EIT Law”)	EIT Law does not provide the definition of personal data. However, EIT Law requires the use of any information through electronic media which is related to the personal data of a person to be conducted with consent from the person concerned, unless stipulated otherwise by the laws and regulations.[13]
	Regulation of the Government No. 71 of 2019 on the Organization of Electronic Systems and Transactions (“Regulation 71/2019”)	Personal data is any data of a person which is identified and/or may be identified individually or combined with other information, either directly or indirectly, through an electronic system and non-electronic system.[14]
	Regulation of the Minister of Communication and Informatics No. 20 of 2016 on Personal Data Protection in Electronic Systems (“Regulation 20/2016”)	Personal data is data on certain individual that is retained, that is maintained, that has its accuracy safeguarded, and that has its confidentiality protected.[15] Meanwhile, data on certain individual is any accurate and actual information that is attached and may be identified, either directly or indirectly, to each individual and the utilization of which is in accordance with the provisions of laws and regulations.[16]
	Law No. 14 of 2008 on Public Information Disclosure (“Law 14/2008”)	Law 14/2008 also does not explicitly define what personal data is. However, Law 14/2008 prohibits public agencies (i.e., executive, legislative, and judicative agencies, as well as other agencies whose duties and functions are related to the organization of state affairs) to provide, among others, information that relate to personal rights.[17] Moreover, Law 14/2008 also states that public agencies must provide public information for Indonesian citizens and/or legal entities that request said information, with exception to among others:[18] Public information that, when provided, may disclose the contents of authentic deeds that are personal in nature and testament of a person; and Public information that, when provided, may disclose the following personal information: History and condition of family members; Medical history of a person; Financial condition assets, income and bank-account details of a person; Results from the assessments of a person’s physical capabilities and/or intelligence; and Records relating to a person’s formal or non-formal education.
Financial Services	Law No. 7 of 1992 on Banking, and its amendments[19] (collectively referred to as “Law 7/1992”)	Banks and their affiliated parties are required to maintain the confidentiality of information regarding the depositing customers and their savings, unless said information is required for certain purposes regulated under Law 7/1992 (e.g., taxation; proceedings of crimes or civil lawsuits between banks and the customers).[20]
	Law No. 21 of 2008 on Sharia Banking and its amendment (collectively referred to as “Law 21/2008”)	Sharia banks and their affiliated parties are required to maintain the confidentiality of information regarding the depositing customers and their savings, as well as the investing customers and their investments.[21] However, similar with Law 7/1992, Law 21/2008 also allows said information to be disclosed for certain purposes (e.g., investigation of taxation crimes; proceedings of crimes or civil lawsuits between banks and the customers).[22]
	Regulation of the Financial Services Authority (Otoritas Jasa Keuangan – “OJK”) No. 1/POJK.07/2013 on Consumer Protection within Financial Services Sector (“Regulation 1/2013”) and Circular of the OJK No. 14/SEOJK.07/2014 on Confidentiality and Security of Consumer’s Personal Data and/or Information (“Circular 14/2014”)	Regulation 1/2013 states that consumer protection includes the implementation of consumer’s information/data security and confidentiality principle.[23] Businesses within financial services sector (e.g., banks, securities companies, insurance companies, financing companies, pawnshops)[24] are prohibited from providing their consumer’s data and/or information to the third parties, unless the provision of said data and/or information is based on consumers’ written approval and/or required by the laws and regulations.[25] Written approval is also required if financial-services businesses aim to use personal data and/or information of a person or a group of people which are obtained from other parties.[26] Elaborating the provisions under Regulation 1/2013, Circular 14/2014 specifies that consumer’s personal data and/or information encompass the following:[27] For individuals: a) Name; b) Address; c) Birthday and/or age; d) Phone number; and/or e) Mother’s name; For corporation: a) Name; b) Address; c) Phone number; d) list and identities of directors and commissioners; and/or e) List of shareholders.
	Regulation of the OJK No. 77/POJK.01/2016 on Information Technology-Based Money Lending Services (“Regulation 77/2016”) and Circular of the OJK No. 18/SEOJK.02/2017 on Information Technology Governance and Risk Management on Information Technology-Based Money Lending Services (“Circular 18/2017”)	Providers of information technology-based money lending services are required to maintain the confidentiality, completeness, and availability of personal data, transaction data, and financial data that they manage, since the data are obtained until the data are destroyed.[28] Unless approved by their users in writing form and/or required by laws and regulations, the providers of these services are prohibited from disseminating users’ personal data and information to other parties. Said data and information at least comprise the following:[29] Data and information that are attached and identifiable from: a) Individuals (e.g., name, phone number, e-mail address, mother’s name, birthday/age, account/credit number, education/work history, biometric); or b) Corporations (e.g., name, address, phone number, list of directors/commissioners/shareholders, list of assets and company documents); Material data and information which are non-public in nature (e.g., financial statement, business performance); Data and information that are related to financial transactions and contracts/agreements.
Trade	Regulation of the Government No. 80 of 2019 on Trade Through Electronic Systems (“Regulation 80/2019”)	Any personal data is treated as the personal property of the person or businesses concerned.[30] Furthermore, Regulation 80/2019 also requires businesses to retain personal data in accordance with the applicable standards for personal data protection which encompasses, among others, the following rules:[31] Personal data must be obtained in a truthful and lawful manner; Personal data must be utilized according to the purpose of its collection; Collected personal data must be accurate and up-to-date; Personal data must be processed in accordance with the rights of data owners.
Healthcare Services	Law No. 36 of 2009 on Health and its amendment (collectively referred to as “Law 36/2009”)	Every person is entitled of confidentiality on his/her personal medical conditions which are disclosed to healthcare-services providers.[32]
Healthcare Services	Law No. 29 of 2004 on Medical Practices (“Law 29/2004”)	The contents of patient’s medical record is owned by the patient and the confidentiality of the medical record must be maintained by the doctors, dentists and heads of the healthcare-services facilities.[33]

With so many variations on the definitions and scope of personal data, consumers must be aware of the types of data and information which are protected when they engage in activities within certain sectors because what constitutes personal data within one sector might not be the case on another sector. However, despite such differences, all of the abovementioned regulations seem to agree that the personal data protection is a right vested upon each individual which must be safeguarded and maintained properly.

In comparison to the varied definitions and scopes of personal data discussed above, RUU PDP proposes to define personal data as any data of a person which is identified and/or may be identified individually or combined with other information, either directly or indirectly, through an electronic system and non-electronic system. This definition is the same with the definition which is currently set by Regulation 71/2019.[34]

Furthermore, RUU PDP proposes for personal data to be categorized into two groups, namely:[35]

General personal data, which encompass the following: a) full name; b) sex; c) nationality; d) religion; and/or e) other personal data which can be combined to identify a person; and
Specific personal data, which encompass the following: a) health data and information; b) biometric data; c) genetic data; d) sexual life/orientation; e) political views; f) criminal record; g) child data; h) personal financial data; and/or i) other data in accordance with laws and regulations.

These proposed provisions indicate that RUU PDP offers a more comprehensive scope of personal data by accommodating various types of data which are featured under the existing laws and regulations discussed earlier, while also adding some new ones (e.g., sexual life/orientation, political views).

In addition to the above, it is also important to note that personal data protection arrangements proposed by the RUU PDP will also be applicable towards any individuals or corporations, public agencies, and institutions/organizations which carry out any legal actions addressed under RUU PDP, whether they are in Indonesia or overseas, provided that said actions have legal impacts within the Indonesian territory or to Indonesian citizens (as personal data owners) who live abroad.[36] These extraterritorial applicability provisions are similar with the ones currently set by the GDPR, which requires GDPR to also be applicable for the following:[37]

The processing of personal data of data subjects who are in the European Union by controller or processor which is not established in the European Union, provided that the processing activities relate to the offering of goods or services or the monitoring of data subjects’ behavior which takes place within the European Union; and
The processing of personal data in a place where the law of European Union’s member state is applicable, by a controller that is not established in the European Union.

The current personal-data-protection regulatory frameworks in Indonesia, as discussed above, have not addressed these applicability provisions. It is therefore safe to assume that personal data protection for extraterritorial or cross-border transactions that involve Indonesian consumers is still lacking. Consequently, consumers are encouraged to exercise extra cautions when providing any personal data to international parties as there is no control over where the provided data may end up to.

Businesses’ Obligations During the Processing of Consumer’s Personal Data

To understand how personal data is being protected under the Indonesian laws and regulations, it is important to identify the obligations which are attributed to businesses that process personal data. While personal data may be processed through non-electronic systems, the advances of information technology have “forced” businesses to utilize electronic systems in carrying out their activities and these activities may include the processing of personal data of their consumers.

Businesses that provide, manage, and/or operate electronic systems, either individually or jointly, for electronic system users for their interests and/or other parties’ interests can be classified as electronic system providers.[38] In processing personal data, electronic system providers are subject to various obligations addressed under the relevant regulations, specifically Regulation 71/2019 and Regulation 20/2016.

The processing of personal data itself encompasses a wide range of activities. Regulation 71/2019 and Regulation 20/2016 set similar processing activities, with few differences, as demonstrated in the following table:[39]

Regulation 71/2019	Regulation 20/2016
Acquisition and collection
Processing and analysis
Retention
Correction and update	Not regulated
Display, announcement, transfer, dissemination, or disclosure	Display, announcement, transmission, dissemination and/or opening of access
Erasure or destruction	Destruction

Regardless of the activities, Regulation 71/2019 requires the processing of personal data to be based on valid approval from personal data owners upon the objectives of personal data processing which are informed to personal data owners. Furthermore, Regulation 71/2019 requires electronic system providers to undertake the following measures when processing personal data:[40]

implement the following personal data protection principles when they process personal data:[41]

a. Personal data is collected in a limited and specific manner, lawfully, fairly, with consent and approval of the personal data owner;

b. The processing of personal data is in accordance with the objectives;

c. The processing of personal data is carried out by ensuring the rights of the personal data owner;

d. The processing of personal data is carried accurately, completely, not misleading, up-to-date, accountable, and taking the objectives of personal data processing into account;

e. The processing of personal data is carried out by protecting the personal data security from loss, misappropriation, illegal access and disclosure, as well as alteration or destruction of personal data;

f. The processing of personal data is carried out by notifying the purpose of collection, processing activities, and failure in protecting personal data; and

g. Personal data is destroyed and/or erased, unless it’s still on retention period in accordance with the needs that are based on laws and regulations; and

Deliver written notifications to personal data owners concerned if there is any failure upon the protection of personal data that they manage.

Similarly, Regulation 20/2016 also specifies good personal data protection principles, as follows:[42]

Personal data is respected as privacy, in which personal data owners are entitled to classify their personal data as confidential or non-confidential, unless stipulated otherwise by laws and regulations;
Personal data is confidential, in accordance with the approval from personal data owners (as provided after personal data owners confirm the accuracy, confidentiality status and objectives for the management of personal data) and/or based on laws and regulations;
Protection of personal data throughout the processing of personal data is based on approval from personal data owners;
There must be relevance to the objectives of personal data processing activities;
Electronic systems that are used must be feasible;
There must be good faith to deliver written notifications to personal data owners if there is any personal data protection failure;
Internal rules for the management of personal data protection must be available;
Responsibility towards personal data that are controlled by the users of electronic systems;
Ease to access and corrections of personal data by personal data owners; and
Completeness, accuracy, validity and update of personal data.

Now, in addition to the principles, Regulation 20/2016 also specifies electronic system providers’ obligations for each personal data processing activity, as elaborated upon in the following table:

Activities	Obligations
Acquisition and collection[43]	Both of these activities may only be carried out upon obtaining personal data owner’s approval or based on the applicable laws and/regulations and must only cover personal data which are relevant to the acquisition and collection objectives. Electronic system providers must respect personal data owners as regard their private personal data by equipping the electronic systems with options for said owners to determine the confidentiality of their personal data and to change/add/update said data. Any received and collected personal data must be verified, whether they are received and collected directly from personal data owners or indirectly from various other sources. Electronic systems which are used for these activities should satisfy certain interoperability and compatibility levels and should utilize legal software.
Processing and analysis[44]	Personal data can only be processed and analyzed according to the objectives stated by electronic system providers when acquiring and collecting personal data, provided that: The electronic system providers have as also obtained consent from personal data owners as regards the processing and analysis of the data in question, unless these data are already displayed or announced on electronic systems for public-service purposes; and The data have been verified.
Retention[45]	Any personal data which are to be retained must have their accuracy verified and must be retained as encrypted data. Personal data must be retained in the electronic systems for a period set under the applicable laws and regulations issued by the relevant supervisory and regulatory institution, or for at least five years if said laws and regulations are unavailable from the last day upon which the data owner used the data. If personal data owners no longer use the electronic systems, providers of the electronic systems in question must retain the personal data in accordance with the abovementioned periods since the last day that personal data owners use said electronic systems. Providers of electronic systems for public services must establish data centers and disaster recovery centers in Indonesia for the personal data protection purposes. Any retention of personal data in the electronic systems must comply with the provisions on electronic system security facilities and procedures.
Display, announcement, transmission, dissemination and/or opening of access[46]	These activities may be undertaken provided that related parties have already secured the approval from personal data owners and that the data in question have been verified. Any transmission of personal data from a domestic electronic system provider to a foreign country must be coordinated via the Minister of Communication and Informatics and/or other authorized officials and must also implement relevant provisions on cross-border personal data exchange. Electronic system providers must provide personal data contained within their electronic systems to law-enforcement apparatuses if the data are required for law enforcement purposes. Any utilization of personal data which are displayed, announced, received and disseminated by electronic system providers must be based on the approval from personal data owners and in accordance with the objectives of said activities.
Destruction[47]	Personal data may only be destroyed from an electronic system if: 1) The retention period has expired; or 2) Personal data owner requests the destruction, unless stipulated otherwise by the laws and regulations. Upon securing the approval from personal data owners, the destruction can be carried out for a part or the entirety of any personal data managed by electronic system providers, whether the data are in electronic or non-electronic form.

While addressing similar provisions with GDPR, the provisions concerning personal data owner’s approval featured under Regulation 71/2019 and Regulation 20/2016 are not as comprehensive as the ones specified under the GDPR because these regulations set no provisions regarding the lawfulness of the approval given by personal data owners which questions the matters of proper approval declaration form or whether the approval is truly freely-given.[48]

Furthermore, Regulation 71/2019 and Regulation 20/2016 also set no further elaboration on the timeframe for electronic system providers to notify the failure of personal data protection to personal data owners concerns. Later, when RUU PDP is promulgated as law, parties that control personal data are required to provide said notification within 3 x 24 hours.[49]

While RUU PDP seems to put more details on how the obligations should be implemented, the supervision aspect might be lacking as the latest draft of the RUU PDP authorizes the Ministry of Communication and Informatics as the party that is in charge for the realization of personal data protection in Indonesia and for the imposition of sanctions upon violations towards RUU PDP, instead of an independent body.[50] The current arrangement is feared to encourage abuse of power by the appointed government institution which apparently acts as processor/controller of personal data since it is possible for them to manipulate or cover of any failure on the protection of personal data.[51]

Rights of Consumers as Personal Data Owners

In addition to being aware of businesses’ obligations in the processing of personal data, as personal data owners, consumers must also be aware their rights under relevant regulatory frameworks on personal data protection. In the context of digital economy, consumers may refer to the provisions of Regulation 20/2016 which sets out the consumers’ rights as personal data owners in the organization of electronic systems, as follows:[52]

The confidentiality of their personal data;
File complaints to the Minister of Communication and Informatics for the purpose of personal data dispute settlements due to the failure of electronic system providers to protect their personal data;
Gain access or opportunity to alter or update their personal data without disrupting the personal data management system, unless stipulated otherwise by the laws and regulations;
Gain access or opportunity to obtain the historical data of their personal data which have been submitted to electronic system providers as long as this action still conforms with the laws and regulations; and
Request for the destruction of data on certain individual in electronic systems that are organized by electronic system providers, unless stipulated otherwise by the laws and regulations.

While these rights allow consumers to enjoy some degree of privacy and control over their personal data, they are still arguably lacking from the rights proposed under RUU PDP or provided by the GDPR. The following table elaborates the types of rights provided for the personal data owners under the RUU PDP with comparison to provisions of GDPR:

RIGHTS OF PERSONAL SDATA OWNER
No.	RUU PDP	GDPR
1	Right to Request Information: allow personal data owners to request information relating to the identity and underlying purposes behind the acquisition and utilization of their personal data.[53] One main difference with the right to request information as featured under RUU PDP is that the GDPR require for data controller to provide the specified information to data owner when personal data are collected, whereas RUU PDP requires personal data owners to first request information to the data controllers thus require active consideration from personal data owners.	Right to be Informed: allow individual to know what personal data is collected, why and who is collecting data, how long it will be retained, and with whom the data shall be shared.[54] Basically, this right provides the transparency regarding the process of data collection for consumers.
2	Right to Access: allow personal data owners to access their personal data in accordance with the laws and regulations.[55] Unlike the provisions of GDPR, which detailed the data that can be provided, RUU PDP opt for a catch-all formulation which encompass all the scope of personal data provided under RUU PDP.	Right of Access: allow individuals to submit subject access request and attain information from the relevant controllers about whether their personal information is being processed.[56]
3	Right to Data Completion: allow personal data owners to complete their personal data before said data are processed.[57]	Right to Rectification: allow individuals to ask the controller to update any inaccurate or incomplete data they have on them.[58]
3	Right to Rectification: allow data owner to update and/or rectify any mistakes or inaccuracies of their personal data.[59]
4	Rights to Restrict Processing: allow personal data owners to postpone or limit the processing of any personal data.[60]	Right to Restrict Processing: allow individual to request that controllers limit the way they use the personal data if certain situation applies.[61]
5	Right to Withdraw Consent: allow personal data owners to withdraw its consent on the processing of their personal data.[62] Provisions on RUU PDP do not outright provide personal data owners with the right to object to processing of personal data at any time. The withdrawing of consent as specified on RUU PDP does not provide elaboration on how it will stop the processing of personal data which is currently ongoing.	Right to Object to Processing: allows individuals to object to the processing of personal data at any time, in certain situations, which will depend on the purpose of processing.[63]
5		Aside from the rights stipulated under the chapter on data subject’s rights, individuals as data subjects are also allowed to withdraw their provided consents at any time.[64]
6	Right to be Forgotten: allow personal data owners to end the processing, to erase, and/or to destroy their personal data.[65] RUU PDP differentiates between erasing and destroying the data which may add to another layer of consideration for personal data owners.	Right to be Forgotten (or also known as the right to erasure): allow individuals to ask for their personal data to be deleted if the necessary conditions has been met.[66] This right shall be further elaborated in the next section of this paper.
7	Right to Data Portability: allow personal data owners to obtain their personal data from the personal data controller or sent their personal data to other parties.	Right to Data Portability: allow individuals to obtain their own personal data that have been previously provided to the controller in a structured, commonly used, and machine-readable format.[67]
8	Rights to Submit Protest for Automated Decision Making and Profiling: allow personal data owners to submit protest for the process of automated decision making and profiling.[68]	Rights in Relation to Automated Decision Making and Profiling: allow individual to not be subjected to automated decision-making if it is producing a legal effect that significantly affects the related individual.[69]
9	Right to Use Pseudonym: allow personal data owners to choose to or not to process their personal data through pseudonym mechanism.[70]	While the right to use pseudonym is not expressly stated thereunder, GDPR states that personal data which have undergone pseudonymization should be considered to be information on an identifiable natural person.[71] Therefore, said data falls under the same protection of personal data provided under GDPR.
10	Right to File Lawsuit: allow personal data owners to submit lawsuits and receive compensation for the violation of their personal data.[72]	GDPR allows individuals who believe that their rights have be infringed to appoint an organization/non-profit in lodging a complaint on their behalf to supervisory authority and exercise the right to a judicial remedy on behalf of the relevant individuals.[73]

From the elaboration above, it could be surmised that the current rights which are provided to personal data owners only amounts to approximately half of what can be provided, with important rights (e.g. right to request information, which play major role in the transparency of data processing; right to withdraw consent, which governs the availability of consent from personal data owner in having their personal data processed) are not covered under the Regulation 20/2016.

Right to be Forgotten on Indonesian Laws and Regulations

As briefly mentioned above, one of the rights of personal data owners which is guaranteed under both Indonesian laws and regulations as well as the GDPR is the right on the erasure of personal data or also known as the right to be forgotten. This right derives from the idea that an individual should not be perpetually judged or punished from a minor infraction long ago that does not represent who they are today,[74] and gained attention during the 2014 case of Google Spain SL, Google Inc v. Agencia Espanola de Protección de Datos, Mario Costeja González, whereby European Court of Justice ruled that Google should remove a link to a digitized 1998 article in La Vanguardia newspaper about an auction for the foreclosed home of Mr. Mario Consteja González.[75]

As unwanted and inaccurate personal data hosted on the internet may severely harm the personal life of the data owners, better understanding towards the right to be forgotten, as an essential human right related to privacy, becomes more urging. Within the framework of Indonesian laws and regulations itself, the right to be forgotten has been recognized primarily under the EIT Law which allows personal data owners to request the erasure of any irrelevant electronic information and/or electronic documents under the control of electronic system providers by submitting an application to the court.[76] These provisions are further elaborated under Regulation 71/2019 which categorizes the right above into: right to erasure and right to delisting.[77]

The right to erasure can be exercised upon electronic information and/or electronic documents that comprise personal data if:[78]

Personal data in question are acquired and processed without the approvals from the relevant personal data owners;
Personal data owners have revoked their approvals;
The personal data are acquired and processed unlawfully;
The processing of the personal data no longer fits the acquisition objectives, as stated under the relevant agreement and/or laws and regulations;
The utilization period has exceeded the period stipulated under the relevant agreement and/or laws and regulations; and/or
The personal data are disclosed by electronic system providers in a way that disadvantages personal data owners.

Meanwhile, right to delisting requires personal data owners to first secure court stipulation, as a prerequisite in filing the request to electronic system providers concern to delist the irrelevant personal data.[79]

Personal Data Violations: Case Studies from Indonesia

Despite the efforts from all the relevant stakeholders in ensuring the protection of consumer’s personal data, violations in the forms of data breach, data leakage, and data mismanagement still occur in Indonesia. In 2021 alone, the Ministry of Communication and Informatics handled 43 cases of data leakage,[80] which excludes the cases that might not have been handled by said Ministry. Furthermore, report by Polisi Siber also signifies exponential increase of annual cases, with only 20 cases in 2016 to 182 cases in 2020.[81]

In order to illustrate the range of personal data violation cases in Indonesia, below are the details of several major cases which happened in Indonesia:

Involved Parties	Leaked Data	Case Elaboration	Actions Taken/Aftermath
Tokopedia-Minister of Communication and Informatics	The leaked personal data include the following: a) name; b) email; c) phone number; d) date of birth; and e) gender. Despite the claim by the hacker that other data also included, Tokopedia announced that payment data and passwords were not among the hacked data.	Around 91 million user data and 7 million merchant data were leaked and sold by the hacker for the amount of Rp. 74 million on the darkweb forum “EmpireMarket”.[82]	In 2020, group of consumers under the Komunitas Konsumen Indonesia has submitted a lawsuit against Minister of Communication and Informatics and Tokopedia to the Central Jakarta District Court with following case number: 235/Pdt.G/ 2020/PN.Jkt.Pst. However, the court ruled in favor of the defendants as the court considered the case to be administrative in nature and should have been submitted to the administrative court.
Health BPJS- Minister of Communication and Informatics	The leaked personal data include the following: a) Citizen Identification Number (NIK); b) Identity Card (KTP); c) phone number; d) email; e) full name; f) address; and g) wages. The leaked data also showed the number of dependents of the person.	in May 2021, the personal data of approximately 279 million Indonesian citizens which were retained by Health BPJS was stolen and sold on the dark web raid forum for the price of 0.15 bitcoin (around Rp. 86 million). The leak was reported to have caused the state a loss of approximately Rp. 600 trillion.[83]	Following the leak, Health BPJS and Ministry of Communication and Informatics has conducted an investigation regarding the source of the leak. However, there is yet a definitive result of this investigation at the time of this paper is written.[84]In 2021, there was a plan to submit an administrative lawsuit against Health BPJS by the team of Periksa Data, a website managed by cybersecurity researchers. It also urged the public to participate.[85] However, there has not been any update on the media regarding the process of lawsuit submission.
Ministry of Health – E-HAC app	The leak unveils all the infrastructure regarding the e-HAC app which includes personal notes from various hospitals.[86] It also shows the user data relating to the COVID-19 tests which include, among others: a) Traveler's ID card; b) Hospital ID; c) Queue number; d) Reference number; e) Address; f) Covid test type (PCR, rapid antigen, others), date and location; g) Covid test results and release date; and h) eHAC document identity.	In 2021, it is estimated that around 1.44 million user data of e-HAC app were leaked. According to the research team of vpnMentor, they have detected a leak of e-HAC data since July 2021 and has reported the leakage to the Ministry of Health twice but met with no response. It was until their third report that BSSN determine to shut-down the outdated e-HAC app[87].	Following the leak, the Minister of Health elaborate on the possibility of leak with its third-party partner to the e-HAC app and also immediately shut down the app. The Minister of Health also urged the public to uninstall the old e-HAC app. No further action is being taken which relates to this particular personal data leak.
Facebook-Cambridge Analytica	The collected data include: a) public’s profile; b) page likes; c) birthday and current city; d) access to timeline and private messages.[88] The collected data was detailed enough to create psychographic profile of the subject data.[89]	Although the disputing parties are foreign parties, part of the leaked data in this scandal involved the data from around 1 million Indonesian users, which were being sold to Cambridge Analytica by Facebook app developer. The data were predominantly used for political advertising, such as for Donald Trump’s campaign and Brexit Campaign.	In Indonesia, group of consumers banded under the LPPMII and Indonesia ICT Institute to file a class action lawsuit against Facebook in the South Jakarta District Court with case number of 396/Pdt.G/2018/PN. Jkt.Sel.[90] This case is seemingly on progress without any update on the media as of today.

Based on the cases, it could be surmised that the violations of consumer’s personal data do not exclusively occur to private organizations but could also be experienced by the public/government organizations. The violations could also have far-reaching consequences not only for personal data owners (e.g., risks of privacy violation, identity theft,) but also for private organizations (e.g., financial loss caused by reputational damage, operation downtime, or payment of penalties) and government institutions (e.g., loss of trust, compensation payment).

Right to be Forgotten on Indonesian Laws and Regulations

Therefore, in order to reduce or mitigate the abovementioned risks, there are several recommended course of actions which may be taken by each stakeholder above, as elaborated below:

A. Government Institutions

In a manner similar with private organizations, public/government institutions also undergo digital transformation as every service provided to the public is slowly, but surely, conducted on a digital platform or app. Therefore, the government, as the forefront protector of citizen’s personal data should have implemented a higher standard of cybersecurity measures and infrastructure. Unfortunately, this might not be the case in Indonesia since there have been reports on the weak implementation of cybersecurity infrastructure which leads to the data breach of citizen’s personal data.[91] Moving forward, the government must ensure that each of its institutions has implemented the most optimal cybersecurity infrastructure and practices the best cybersecurity measures.

Another aspect which must be considered by the government to improve the protection of personal data in Indonesia is the improvement of digital literacy in Indonesia so that the public can identify personal data security measures which in turn will help providers in protecting said data. The need for digital literacy education is now more important as ever since despite the unprecedented increase of technology use, the Digital Literacy Index of Indonesia in 2022 is still at the rate of 3.49, which places Indonesia in the medium digital literacy category.[92] This can result in the situation where many more citizens being put at risk since they can access the technology but do not have complete understanding on how to use it properly. Government may continue to conduct trainings, courses, webinars, or publications which highlight the importance of personal data protections measures which could be taken by the public.

Ultimately, one of the most important things that could be conducted by the government to improve the condition of personal data protection in Indonesia is the completion and promulgation of RUU PDP into law as soon as possible.[93] As extensively discussed above, the regulatory frameworks on personal data protection in Indonesia are currently lacking and scattered on various laws and regulations. Therefore, an integrated and comprehensive Personal Data Protection Law should, in theory, be able to provide wider protection in a uniform manner without the risk of multi-interpretation.

B. Private Organizations

In business, there is an old saying that the consumer is a king. In this digital era, this saying can be interpreted to mean that the businesses are expected to provide their best efforts in ensuring that the personal data of their customers is optimally protected, or they might risk the very survival of the businesses. In ensuring the optimal protection of consumer’s personal data, there are two aspects which must be taken into consideration. The first one is the legal aspect, in which businesses must satisfy and comply with all requirements and obligations specified under the relevant regulatory frameworks. By doing so, businesses can also prevent or mitigate any damages/liabilities which might occur from the personal data leaks/violations. The second aspect is the technical aspect, in which businesses are expected to implement best practices for the protection of personal data. Those best practices include, among others:

Assess, Categorize, and prioritize data risks: The first step towards preventing data leakage is to identify the sensitive data and where it is residing in the systems. Once the data have been identified, it could be categorized in order based on the indicator of what requires the most amount of protection;
Implement multi-factor authentication: In addition to the usual username and password combination, user is required to provide a single-use authentication code that can be sent via text message to an authorized number or through an authorized device;
Encrypt all data: While not fully impenetrable, encrypting important data remains one of the best ways to keep data secure. Once encryption and key management process are taken, then any data that is stolen or leaked will be unreadable;
Update software regularly: it is recommended to keep all app softwares and operating systems updated regularly and install patches whenever available because the networks become vulnerable when programs aren’t patched and updated regularly;
Storage limitations and data minimization: Storage must be limited and personal data must not be stored if they are no longer needed. Similarly, it is recommended to only gather and keep the exact amount of data that is needed;
Appointing data protection officer: Data protection officer (“DPO”) is essential to ensure that the businesses, as processors and/or controllers of consumer’s personal data, have complied with the applicable data protection law. The appointment of DPO is especially important for Indonesian businesses as there are various legislations containing the legal frameworks of personal data protection and it might be challenging to remain updated, let alone understand them all for compliance purposes.

C. Consumers

In the cases of personal data violations, consumers are usually unaware with the behind-the-curtain process and become last to be informed that there are breach/leak of personal data within certain parties that control their personal data. At that point, the consumers hold the biggest risk of personal data misuse as the data could be used for various purposes such as identity theft, unauthorized access to debit/credit card, online scam, or even act of harassment. Therefore, it is imperative for consumers to be aware of any measures or actions which could be taken to mitigate the risk arising from violation of personal data, among others:

Immediately change the passwords: Upon receiving news of any personal data breach/leak, it is imperative for consumers to immediately change their passwords to the relevant websites/apps in order to block the access of anyone who have the information of the previous password. Consumers are also encouraged to ensure that the new password is unique to prevent from being easily-guessed;
Check transaction history or total balance: Upon regaining control over the accounts, consumers must check signs of tampering to their profiles or any attempt to conduct frauds. Moreover, it is also recommended for consumers to continuously check their transaction histories and total balance to confirm a recent transaction is authorized or not and then request unauthorized purchases to be cancelled or refunded;
Add another layer of security: After regaining control to the account, it is advisable to add another layer of security aside from passwords, such as two-factor authentication or one time password, which could discourage the hacker in cracking the accounts;
Activate automatic update of the app: While ensuring that an app has been updated to its latest version, automatic updates help consumers to obtain the highest level of security provided by the updated app;
Avoid storing credit/debit card details on application: While slowing the process to use a credit/debit card, this measure may help consumers to keep their banking details secured from data leak/breach;
Utilize supporting apps: Several apps (e.g., true caller or password manager) can help consumers in identifying risks and manage their personal data with more efficient manner;
Be aware of any permission provided to apps: Consumers must always pay attention to all forms of permissions which are required by an app at the beginning of its operation by the consumers, as well as understand the relevance of the given permissions.
Avoid using public computer or public connection: Consumers must avoid using public computer or public connection, especially when accessing websites or apps which collect sensitive information such as e-banking or e-commerce apps. If consumers are forced to use such public computer or connection, consumers must ensure that their accounts have been properly logged out, to the extent possible.
Report to aduankonten.id: Consumers can opt to report any violations on digital content, apps, sites, etc., including personal data protection and illegal online investments/loans that will be processed by the Ministry of Communication and Informatics.

D. Non-Government Organizations

As the digital literacy rate in Indonesia strives for improvement, the role of various non-government organizations (“NGO”) which operate on information-technology sector, or specifically cyber security sector, becomes more essential. Such NGOs may provide direct or indirect education to public regarding the importance of personal data, steps that must be taken to ensure the security of personal account and emails, as well as assisting consumers whose personal data protection being compromised to pursue possible redress or compensation from the related parties.

On the other hand, NGOs role is also crucial in assisting businesses to understand how they could effectively comply with the applicable laws and regulations on personal data protection while also seeking the most optimal methods in garnering profits from its business. Furthermore, NGOs may also assist businesses in improving their digital security measures to prevent potential risk of data breach/hacking. One of the examples of such venture is the partnership of Indonesian government with the financial service company (PT Mastercard) and an NGO known as Mercy Corps Indonesia, which provides mentoring program on cyber security for 40,000 micro- and small-scale enterprises across 18 provinces nationwide.[94]

Ultimately, with the expertise on information technology and cyber security that the NGOs bring to the table, it is possible for them to assist the government in ushering a more secured digital environment for Indonesia.

Personal Data Violations: Redress and Compensations

As RUU PDP is still in the process of deliberation, there are not many avenues which could be taken by consumers to receive compensation for violations against their personal data. Aside from submitting reports to the aduankonten.id, as specified on the previous sub-section, consumers can attempt to file a complaint with the Ministry of Communication and Informatics as specified under Regulation 20/2016.[95] Such complaints are to be settled amicably or through alternative-dispute-settlement measures, and may be submitted upon the following conditions:[96]

Electronic system providers fail to deliver written notification regarding any such failures to personal data owners or other electronic system providers; or
Personal data owners or other electronic system providers have sustained damage or have been placed at a disadvantage resulting from such failures.

Any such complaints should be submitted in writing within 30 business days since any of the abovementioned conditions occurring, along with relevant supporting evidences.[97] Any such complaint will then be processed in accordance with the mechanism specified under Regulation 20/2016.[98]

If the complaint is not ultimately settled through an amicable procedure or other alternative dispute-resolution mechanism, then personal data owners or other electronic system providers concerned may file a civil lawsuit to the district court.[99] If this is the case, the basis for the lawsuit is article 1365 of Indonesian Civil Code which states that every act that violates the law and causes loss to another person, obliges the person who causes the loss, because of his mistake, to compensate for the loss. With this, it is possible for consumers as personal data owners to pursue compensations from any party which causes loss to them, including the electronic system providers that fail to protect their personal data. However, it is also important to note that the litigation process may take a long process to finish with no guarantee that the consumers shall receive compensations for their losses.

Conclusion

Although there have been various laws and regulations governing personal data protection in Indonesia, it seems that none of them have been able to provide overall protection for the rights and interests of consumers regarding their privacy and personal data. The absence of a comprehensive regulation, coupled with the lack of technical preventive measures, make the consumers in Indonesia vulnerable to personal data violations, such as data leakage and misuse of personal data.

The expected solution in sight is the promulgation of RUU PDP. However, as stakeholders continue to keep the hope that there will be no further delay in the promulgation of RUU PDP, they may currently resort to the existing regulations, albeit scattered, and several other strategies outlined in this paper.(ss)

Reference

[1] Policy Paper No. 27 titled “Protecting People: Promoting Digital Consumer Rights” by Center for Indonesian Policy Studies (“Protecting People: Promoting Digital Consumer Rights”), p. 8.

[2] Pingkan Audrine, “Menagih Perlindungan Konsumen Digital Indonesia,” as accessed through https://katadata.co.id/muchamadnafi/indepth/61fcf3a2d4cf7/menagih-perlindungan-konsumen-digital-indonesia on 17 February 2022.

[3] IDX Channel, “2025, Ekonomi Digital Makin Vital Perannya Bagi Ekonomi RI” as accessed through https://www.idxchannel.com/economics/2025-ekonomi-digital-makin-vital-perannya-bai-ekonomi-ri on 17 February 2022.

[4] Ministry of Communication and Informatics of the Republic of Indonesia, “Pertumbuhan Ekonomi Digital Tak Abaikan Perlindungan Konsumen” as accessed through https://kominfo.go.id/content/detail/14883/pertumbuhan-ekonomi-digital-tak-abaikan-perlindungan-konsumen/0/sorotan_media on 17 February 2022.

[5] Hukumonline, “Perlindungan Konsumen di Era Digital Masih Mengkhawatirkan” as accessed through https://m.hukumonline.com/berita/a/perlindungan-konsumen-di-era-digital-masih-mengkhawatirkan-lt5e562be8e79f3 on 17 February 2022.

[6] Protecting People, Promoting Digital Consumer Rights, p. 10.

[7] Center for Indonesian Policy Studies, “Digital Week 2020: Perlindungan Konsumen & Data dalam Ekonomi Digital Perlu Libatkan Banyak Pihak” as accessed through https://www.cips-indonesia.org/post/digital-week-2020-perlindungan-konsumen-data-dalam-ekonomi-digital-perlu-libatkan-banyak-pihak on 17 February 2022.

[8] Bisnis.com, “RUU Perlindungan Data Pribadi Gunakan GDPR Uni Eropa Sebagai Acuan” as accessed through https://teknologi.bisnis.com/read/20191202/282/1176768/ruu-perlindungan-data-pribadi-gunakan-gdpr-uni-eropa-sebagai-acuan on 17 February 2022.

[9] Lembaga Studi & Advokasi Masyarakat (ELSAM), “Tantangan Tiga Tahun Implementasi EU GDPR: Pembelajaran bagi RUU Pelindungan Data Pribadi” as accessed through https://elsam.or.id/tantangan-tiga-tahun-implementasi-eu-gdpr-pembelajaran-bagi-ruu-pelindungan-data-pribadi/ on 17 February 2022.

[10] Antaranews, “RUU PDP upaya pemerintah ciptakan aturan komprehensif di era digital” as accessed through https://www.antaranews.com/berita/2216266/ruu-pdp-upaya-pemerintah-ciptakan-aturan-komprehensif-di-era-digital on 17 February 2022.

[11] Center for Indonesian Policy Studies, “Perlindungan Data Pribadi Dorong Pertumbuhan Ekonomi Digital” as accessed through https://id.cips-indonesia.org/post/siaran-pers-perlindungan-data-pribadi-dorong-pertumbuhan-ekonomi-digital-1 on 17 February 2022.

[12] Suara.com, “Kominfo Targetkan RUU PDP Selesai Semester Kedua 2020”, as accessed through https://www.suara.com/tekno/2022/01/27/185137/kominfo-targetkan-ruu-pdp-selesai-semester-kedua-2022 on 17 February 2022.

[13] Art. 26 (1), EIT Law.

[14] Art. 1 (29), Regulation 71/2019.

[15] Art. 1 (1), Regulation 20/2016.

[16] Art. 1 (2), Regulation 20/2016.

[17] Arts. 1 (2) and 6 (3), Law 14/2008.

[18] Arts. 1 (2) and 17, parts (g) and (h), Law 14/2008.

[19] The amendments refer to: Law No. 10 of 1998 and Law No. 11 of 2020.

[20] Art. 40, Law 7/1992.

[21] Art. 41, Law 21/2008.

[22]Section II, Chapter VII, Law 21/2008.

[23] Art. 2, part (d), Regulation 1/2013.

[24] Art. 1 (1), Regulation 1/2013.

[25] Art. 31 (1-2), Regulation 1/2013.

[26] Art. 31 (3), Regulation 1/2013.

[27]Point 1, Circular 14/2014.

[28] Art. 26 (1), Regulation 77/2016.

[29] Points (1 -3), Section VI, Circular 18/2017.

[30] Art. 58 (1), Regulation 80/2019.

[31] Art. 59, Regulation 80/2019.

[32] Art. 57 (1), Law 36/2009.

[33] Art. 47 (1-2), Law 29/2004.

[34] Compare: Art. 1 (1), RUU PDP with Art. 1 (29), Regulation 71/2019.

[35] Arts. 1 (1) and 3, RUU PDP.

[36] Art. 2, RUU PDP.

[37] Art. 3 (1-2), GDPR.

[38] Art. 1 (6a), EIT Law.

[39] Compare: Art. 14 (2), Regulation 71/2019 with Art. 3, Regulation 20/2016.

[40] Art. 14 (1), (3), (5), Regulation 71/2019.

[41] Art. 14 (1), Regulation 71/2019.

[42] Art. 2 (2-4), Regulation 71/2019.

[43] Arts. 7 (1), 9 (1), 8 (1-2), 10 (1-2) and 11 (1), Regulation 20/2016.

[44]Arts. 12-14, Regulation 20/2016.

[45] Arts. 15, 16, 17 and 19, Regulation 20/2016.

[46] Arts. 21, 22 (1) and 23 (1), Regulation 20/2016.

[47] Art. 25, Regulation 20/2016.

[48] Art. 7, GDPR.

[49] Art. 40 (1), RUU PDP.

[50] Art. 58, RUU PDP.

[51] Kumparan.com, “Pengamat Minta RUU PDP Diperbaiki: Multitafsir hingga Diskriminasi Sanksi”, can be accessed here.

[52] Art. 26, Regulation 20/2016.

[53] Art. 4, RUU PDP.

[54] Art. 12, GDPR.

[55] Art. 6, RUU PDP

[56] Arts. 13-15, GDPR.

[57] Art. 5, RUU PDP.

[58] Art. 16, GDPR.

[59] Art. 7, RUU PDP.

[60] Art, 12, RUU PDP.

[61] Art. 18, GDPR.

[62] Art. 9, RUU PDP.

[63] Art. 21, GDPR.

[64] Art. 7 (3), GDPR.

[65] Art. 8, RUU PDP.

[66] Art. 17, GDPR.

[67] Art. 20, GDPR.

[68] Art. 10, RUU PDP.

[69] Art. 22, GDPR.

[70] Art. 12, RUU PDP.

[71] Recital No. 26 & 28, GDPR.

[72] Art. 13, RUU PDP.

[73] Recital No. 142, GDPR.

[74] Joseph Steinberg, “Why Americans Need and Deserve the Right to be Forgotten”, inc.com, can be accessed here.

[75] Julia Powels, “What we Can Salvage from ‘right to be forgotten’ ruling”, wired.co.uk, can be accessed here; and BBC, “EU Court Backs ‘right to be forgotten’ in Google case”, can be accessed here.

[76] Art. 26 (3), EIT Law.

[77] Art. 15 (2), Regulation 71/2019.

[78] Art. 16 (1), Regulation 71/2019.

[79] Art. 17 (1) and (5), Regulation 71/2019.

[80] Intan Rakhmayanti Dewi, “Sepanjang 2021, Kominfo Tindak 43 Kasus Kebocoran Data Pribadi”, published on inews.id. Can be accessed here.

[81] Databoks, “Pencurian Data Pribadi Makin Marak Kala Pandemi”, published on katadata.co.id. Can be accessed here.

[82] CNN Indonesia, “Kronologi Lengkap 91 Juta Akun Tokopedia Bocor Dijual”, can be accessed here.

[83] Fahmi Ahmad Burhan, “Kebocoran Data BPJK Kesehatan Disebut Bikin Rugi Negara Rp. 600 Triliun”, Katadata.co.id, can be accessed here.

[84] Suara.com, “Tujuh Bulan Berlalu, Kominfo Masih Investigasi Kasus Kebocoran Data BPJS Kesehatan”, can be accessed here.

[85] Kompas.com, “Kasus Kebocoran Data 279 Juta WNI, BPJS Kesehatan Akan Digugat lewat PTUN”, can be accessed here.

[86] Kompas.com, “Deretan Kasus Kebocoran Data Pribadi dalam Dua Tahun Terakhir”, can be accessed here.

[87] CNN Indonesia, “Kronologi Dugaan Kebocoran Data eHAC Kemenkes”, can be accessed here.

[88] Martin Coulter, “Find Out if your Facebook data was shared with Cambridge Analytica”, Evening Standard, can be accessed here; and Issie Lapowsky, “Cambridge Analytica Could Also Access Private Facebook Messages”, Wired. Can be accessed here.

[89] Matthew Rosenberg, et al, “How Trump Consultants Exploited the Facebook Data of Millions”, The New York Times. Can be accessed here.

[90] Kontan.co.id, “Gugatan class action kepada Facebook resmi dilayangkan”, can be accessed here.

[91] BBC.com, “Data eHAC bocor, pakar siber sebut ‘Infrastruktur keamanan digital pemerintah Indonesia sangat buruk’”, can be accessed here.

[92] Norman Harsono, “Despite Improvements, Indonesia’s Digital Literacy remains low”, The Jakarta Post. Can be accessed here.

[93] Ahmad Thovan Sugandi, “Menanti UU Perlindungan Data Pribadi, Penangkal Kejahatan Siber”, bisnis,com, can be accessed here.

[94] The Jakarta Post, “Govt partners with Mastercard, NGO to launch business, cybersecurity mentoring for MSMEs” can be accessed here.

[95] Art. 29 (1), Regulation 20/2016.

[96] Art. 29 (2-3), Regulation 20/2016.

[97] Art. 31 (a), Regulation 20/2016.

[98] Art. 31 (h), Regulation 20/2016.

[99] Art. 32, Regulation 20/2016.