The proposal comes as the government and House remain at loggerheads over the provision to establish a data protection agency to implement the PDP bill, which has effectively stalled the bill’s deliberation.

The government has proposed the agency be placed under the Communications and Information Ministry, while a majority of lawmakers has insisted on the agency’s independence from the government to avoid conflicts of interest.

If approved, the proposal would give additional responsibilities to the BSSN, which was set up in 2017 to formulate government policies on cybersecurity.

Christina Aryani, a member of House Commission I overseeing defense, foreign affairs, information and intelligence, proposed that the BSSN could be given a new mandate to implement the PDP bill.

She, however, pointed out that ideally, the data protection agency should be an independent body and added that the proposal should be first discussed with the government.

“The proposal to empower the BSSN represents the House’s good faith so that the personal data protection bill can be passed, if President Joko ‘Jokowi’ Widodo does not want to establish a new agency [to enforce the bill],” Christina said as quoted by Kompas.id on April 6.

The Golkar Party politician also pointed out that under current arrangements, the BSSN has frequently assisted police investigations into data breaches, making it an ideal institution to oversee the implementation of the bill.

The proposed move is still under discussion and has yet to receive the nod from all Commission I members, Muhammad Farhan, who is also a member of the commission, told The Jakarta Post on Friday.

“Currently, I don’t think the BSSN could be given such a heavy responsibility, considering that its most important responsibility is to ensure that all institutions comply with cybersecurity standards,” Farhan, a member of the NasDem Party, said.

Read also: Passage of PDP Bill essential in achieving Indonesia's digital agenda in G20, experts say

Farhan said the NasDems supported the government’s proposal to establish the data protection agency under the Communications and Information Ministry in a move to ensure the agency’s effectiveness in carrying out its mandate.

In the absence of a strong data protection regulation, Indonesia has recorded several major data breaches affecting millions of people across the country.

In May last year, the personal data of more than 279 million Indonesians were put up for sale on an online hacking forum. The data reportedly belonged to policyholders of the national health insurance (JKN) scheme managed by the Health Care and Social Security Agency (BPJS Kesehatan).

The internal networks of at least 10 government institutions, including the State Intelligence Agency (BIN), were also reportedly breached last year, according to a report from Insikt Group, the research division of threat intelligence company Recorded Future.

Read also: State intelligence hacked in alleged breach of government networks

The BSSN itself has fallen victim to digital attacks, as a website of the national malware center hosted by the agency was defaced on October last year. The BSSN said that no data breach occurred during that incident.

Pratama Persadha, chairman of the Communication and Information System Security Research Center (CISSReC), said that assigning the authority of the personal data protection agency to the BSSN was “unwise”, given that it was not the agency’s original mandate.

“It is unwise to increase the BSSN workload beyond its mandate, namely to personal data [protection],” Pratama said in a statement. “Let the BSSN focus on technical [issues] in cybersecurity.”

He went on to add that the proposed personal data protection agency should be an independent agency in order to ensure maximum protection of internet users’ data.

“The personal data protection commission should be an independent government commission. Its commissioners could be selected from a shortlist proposed by the House and the government, representing bureaucrats, academics and the general public, so that when it carries out its duties, the commission can have a strong bargaining position in the face of other government institutions,” Pratama said.

Communications and Information Ministry Director General for Applications and Informatics Semuel Pangerapan said, as quoted by Kompas.id, that the lawmaker's proposal should be officially submitted in an official working committee meeting between the House and the government before the government could respond to it. (mrc)