TheJakartaPost
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search results
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search resultsGovernment does about-face on onshore data storage plan
The government has canceled its plan to force private sector actors to store data onshore so as to ensure a favorable business climate for the burgeoning digital economy but is still looking at measures to ensure Indonesians’ data is secure
Change text size
Gift Premium Articles
to Anyone
Share the best of The Jakarta Post with friends, family, or colleagues. As a subscriber, you can gift 3 to 5 articles each month that anyone can read—no subscription needed!
The government has canceled its plan to force private sector actors to store data onshore so as to ensure a favorable business climate for the burgeoning digital economy but is still looking at measures to ensure Indonesians’ data is secure.
Only public institutions will be required to store data onshore, while private firms like Google and Facebook can store their data overseas with an obligation to register their business with the Communications and Information Ministry, according to a ministry document seen by The Jakarta Post.
The ministry’s Information Applications Director General Semuel Abrijani Pangerapan said requiring tech companies to store their data in Indonesia was much the same as preventing them from doing business in the country.
“We [the government] cannot oblige them to localize their data, but we can require them to ensure that our [Indonesians’] data is protected and secured,” Semuel told the Post at his office in Jakarta recently. “I come from the private sector. So I know how complicated it will be if the government makes many interventions into businesses.”
Strategic data managed by private sector actors will also be required to be connected to the National Data Center run by the National Cyber and Encryption Agency (BSSN). In the event of a national security breach, companies managing the data will need to grant access to the government.
The stipulations will be part of the latest draft revision of Government Regulation (PP) No. 82/2012 on electronic system and transaction management, which is considered important among businesspeople in the tech sphere. As the digital economy grows, the use of data has spiked but many companies continue to use overseas data centers as local infrastructure is considered insufficient.
The draft revision will also require certain content moderation and right to be forgotten procedures to be adopted by electronic system providers. It is currently under final review by the Office of the Coordinating Economic Minister and the Office of the Coordinating Political, Legal and Security Affairs Minister prior to being signed by President Joko “Jokowi” Widodo.
Semuel said the use of Gmail for email correspondence by several government institutions and civil servants contravened the existing PP, which requires public data to be stored onshore. The Communications and Information Ministry will monitor the implementation of the policy, he added.
In 2016, the government proposed a draft revision that would have required both public and private sector actors to store their data onshore depending on the data classification — strategic, high-risk and low-risk — which Semuel said was difficult to implement.
“How can we easily categorize their [private sector] data into strategic, high-risk or low-risk classifications?” added Semuel, who was previously the chairman of the Indonesian Internet Service Providers Association (APJII) before taking up the director general post in 2016.
“Data should come closer to the users. Therefore, Indonesia needs to create a supportive ecosystem to encourage companies to place their data centers closer to Indonesian users,” said Semuel. “We are seeing that several companies are now developing content delivery networks. We will provide ease in developing data centers.”
Tech giants from Google Cloud, Amazon Web Services (AWS), Alibaba Cloud to Microsoft have expressed commitments to invest in cloud regions and data centers in Indonesia, he added.
Once the data ecosystem has been built, the government hopes to invite more investors to develop data services providers in Indonesia without being forced to by any regulations. “If we force them, they will go to other countries,” Semuel said.
American Chamber of Commerce (AmCham) Indonesia managing director Lin Neumann said that companies did not want to be forced to make investments that might be unnecessary as long as the data could be accessed as needed.
“However, the planned revision will relax private companies as they will be able to make decisions on the basis of cost and efficiency,” Neumann said.
Centre for Strategic and International Studies (CSIS) economist Fajar B. Irawan said the government’s decision to allow private companies to store their data abroad could be "shock therapy" for local data center providers to enhance their competitiveness and efficiency in order to encourage an inflow of investment.
“As long as only private companies can store their data abroad, it will not be a problem because strategic public data is stored in the country,” said Fajar.
Apart from the placement of data centers, the PP revision will require tech companies to accommodate users’ requests to delete irrelevant data, a provision introduced in the European Union’s General Data Protection Regulation as the “right to be forgotten”.
“The right to erasure [of electronic information or data] will not require a court process, but a right to delisting [on search engines] will require a court process,” explained Semuel. (asp/awa)
Esther Samboh contributed to this story
___________________________
Key points
• Public data will be required to be stored onshore. Public data is that managed by public institutions, excluding the Financial Services Authority (OJK) and Bank Indonesia (BI).
• Private sector data can be stored offshore. However, all private sector companies that handle Indonesians’ data will have to register with the Communications and Information Ministry, and will therefore be subject to this regulation.
• Strategic data will have to be backed up and connected to the National Data Center run by the National Cyber and Encryption Agency (BSSN). The sectors that handle data that fall under this classification include government administration, energy and mineral resources, transportation, finance, health, IT and communications, food, defense and other sectors deemed important by the president.
• Electronic system providers are required to delete irrelevant data or information under their management upon the request of users. This includes the “right to erasure”, which will not require a court process, and the “right to delisting” from search engines, which will require a court process.
• Electronic system providers are required to implement certain content moderation procedures so as to avoid publishing and facilitating the spread of negative content on their platforms that goes against existing laws and regulations, creates public concern or disrupts general security. Noncompliance will result in the government cutting public access to the platform.
Source: Communications and Information Ministry
