TheJakartaPost
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search results
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search resultsAnalysis: US-Indonesia trade deal concerns, private data commercialization
Change text size
Gift Premium Articles
to Anyone
Share the best of The Jakarta Post with friends, family, or colleagues. As a subscriber, you can gift 3 to 5 articles each month that anyone can read—no subscription needed!
Indonesia has yet to join the club of nations from Brazil to China and India that have issued stringent regulations on personal data protection, modeled on the European Union General Data Protection Regulation (GDPR), which protects citizens from privacy and data breaches regardless of where the data is processed and which recognizes citizens’ “right to be forgotten”, so users can ask for data erasure and delisting from digital platforms and search engines. (Shutterstock/PopTika)
T
hrough a recent reciprocal trade agreement between the United States and Indonesia, the Indonesian government has officially recognized the US as a jurisdiction with “adequate data protection.” This designation creates a legal pathway for the transfer of personal data from Indonesia to the US, effectively sidestepping existing data localization requirements by treating US-based entities, including data brokers, as equivalent to Indonesian data operators. As the US remains the global center for data brokerage, experts warn that this move could legitimize the large-scale commercialization of Indonesian personal data.
In the US, data brokers under relatively lax federal oversight. As long as user consent is technically granted, often through vague or bundled terms of service, companies can collect, analyze and resell consumer data in states that lack strong privacy laws. While certain federal laws like the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA) do restrict how medical and financial data is handled, no comprehensive framework exists to protect general behavioral or preference-based data.
Economic Affairs Coordinating Minister Airlangga Hartarto has sought to reassure the public that US data centers managing Indonesian data are subject to Indonesia’s Law No. 27/2022 on Personal Data Protection (PDP) and Government Regulation No. 82/2012 on electronic system operators (PSE). Under the PDP Law, personal data, including usage patterns and behavior, cannot be sold to third parties, regardless of whether the user has given consent.
The unanswered question, however, is how this would be enforced. The government claims that Indonesia’s PDP Law has extraterritorial applicability. This would imply that there is a binding mechanism that forces US data operators to uphold Indonesian privacy rules. However, this has not been included in any of the documentation as part of the US-Indonesia trade agreement.
Once a data center or data operator is registered as a PSE, Indonesian authorities would theoretically have the right to perform audits. Yet, even before the signing of this trade agreement, Indonesia had not yet formed the Personal Data Protection Authority (PDPA) as mandated by the PDP Law. Without this regulatory body in place, the data protection compliance mechanism is incomplete, both at home and abroad.
The US does, to a degree, regulate the buying and selling of consumer data. A number of states, including California, Colorado and Virginia, have enacted consumer privacy laws that require transparency, opt-out rights or even outright bans on certain forms of data sales. Additionally, the Federal Trade Commission (FTC) has broad authority to prosecute companies engaging in unfair or deceptive data practices.
However, despite these protections, the US continues to experience significant privacy scandals even after the high-profile Cambridge Analytica incident in 2018. Data breaches, unauthorized profiling and opaque third-party sharing agreements remain relatively common in the US, partially due to how significantly it supports the country’s digital economy. Recent examples include the ongoing Clearview AI scandal, whereby the US based company scraped billions of images from public websites without user consent to build a facial recognition database.
