TheJakartaPost
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Measuring state’s commitment to implementing PDP Law
It is clear that conflicts of interest could emerge, especially where complaints against state-linked institutions must be made to a regulator whose neutrality is contested.
Change Size
A screen shows a message reading "Hacking detected" in this illustration image. (Shutterstock/File photo)
O
n Oct. 17, the President signed the long-awaited Personal Data Protection (PDP) Law No. 27/2022, which formalizes long-held expectations around data protection.
Modelled on the European Union’s General Data Protection Regulation (GDPR), the new law establishes responsibilities for the processing of personal data and rights, stipulating penalties for violations and importantly mandating the President to appoint an Indonesian Data Protection Authority (DPA).
Entities, those who own or process the data, whether public or private, are given a grace period of two years to prepare the mandatory data protection officers (DPOs) and other requirements set by the law. In the interim, the law provides the President with the authority to appoint a DPA that would be perceived as a neutral and trusted agency.
The authority will be responsible for supervising compliance of data controllers, receiving complaints and imposing sanctions for violations committed by data controllers and/or data processors as well as for resolving alleged cross-border violations by collaborating with foreign DPAs, as stipulated in Article 60.
How can this agency be independent in dealing with data protection conflicts, which may involve one of the government agencies therefore falling under the President’s auspices?
Until today, the government is still preparing a presidential decree on the new DPA, yet it remains unclear who the President will appoint as the head of the agency and whether or not the specialized independent DPA will be having strong enforcement powers.
Within the two-year grace period, the government should prioritize the establishment of the DPA along with a clearly defined structure and responsibilities. This is especially important because an independent DPA is a precondition for legal certainty. With this, there are several points that are worth considering.
