TheJakartaPost
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Privacy law necessary but critics warn of potential govt overreach
Change Size
Illustration of data protection. (Shutterstock/PopTika)
T
he newly passed privacy law has been widely lauded as a step forward in protecting personal data in a country facing emerging cybersecurity threats. But critics said that a lack of clarity surrounding the institutional design of the oversight agency and vague provisions on what constitutes a crime might lead to government overreach and overcriminalization.
The Personal Data Protection Law gives people the right to know what information data controllers and processors – whether public or private – are collecting about them, why they are collecting that data and with whom they are sharing it. Data handlers must ensure the rights of data subjects and the security of their data, including by setting up firewalls and encryption systems. They will have two years to comply and build the system. And those that breach rules on distributing or gathering personal data may face administrative fines of up to 2 percent of their annual revenue or have their operation suspended by a data protection oversight agency.
The law also regulates criminal penalties, including prison time and fines, for any individuals and companies that are found guilty by a court of collecting, using, selling or publicizing personal data by illegal means.
Experts and activists said that the law was a “necessary” start toward improving cybersecurity in the country, particularly since it covers a wider definition of personal data, the rights of data subjects and obligations of data handlers.
But they also said that there was a potential for government overreach, particularly since the law left the institutional design of the oversight agency to the discretion of the President, including where the institution stands within the executive hierarchy, its structure, who heads it and details of its task.
The law only regulates the general scope of authority of the agency, such as establishing the details of data protection policies, resolving disputes outside the court system and imposing administrative fines and assisting law enforcement bodies in the investigation of criminal cases related to the illegal use of data.
Read also: Data protection bill threatens firms with ‘exorbitant’ fines
