In an open letter to the Communications and Information Ministry, Indonesia’s representative to the AICHR and 13 organizations urged the government to issue a specific regulation on its contact tracing efforts, including on the data collected and how the data should be treated to protect privacy.

“In April 2020, as COVID-19 spread, Indonesia rolled out the PeduliLindungi app. While other countries have released the source code of their exposure notification apps, the only available information about PeduliLindungi is from the government. The source code of the app has never been released and the privacy policy of the app has never been clearly stated at the iOS and Android app stores,” the letter’s signees said in a statement on Tuesday.

The fact that Indonesia also lacks a robust personal data protection regulation in line with the best practices -- such as that implemented by Europe’s General Data Protection Regulation (GDPR) – raises concerns about privacy protection, they added.

“The data collection process from all contact tracing efforts must be in line with internationally accepted standards and best practices, particularly the World Health Organization’s ‘Ethical considerations to guide the use of digital proximity tracking technologies for COVID-19 contact tracing,” they urged.

In this regard, the parties request that the Indonesian government “release the white paper and the source code of the PeduliLindungi app under an open-source license”, in which all necessary details of the system’s architecture, functions, protocols, data management and security design are placed.

“The source code should be that of the deployed system, complete, up-to-date and buildable so that the system’s security and privacy treatment can be independently verified. The white paper and the source code must be regularly updated along with the app,” they said.

Furthermore, the government should “provide a clear privacy policy for PeduliLindungi at both the App Store and Google Play. All the elements of how the data is collected, processed and stored must be transparent and in line with international standards and best practices for privacy protection. Users’ informed consent must be obtained before the app can be downloaded”.

In addition, the alliance urged the government to issue data privacy regulations that specifically address the PeduliLindungi app and to be transparent about the data breach that occurred in PeduliLindungi’s database.

“The [Communications and Information] ministry should conduct a formal investigation and report on the incident and take steps to harden the system to prevent a reoccurrence.”

“In keeping with its international commitments to protect the fundamental human right to privacy, the Indonesian government must protect the right to privacy of citizens in any upcoming contact tracing efforts,” they concluded, adding that transparency must be provided to the furthest extent possible in relation to how privacy is treated.

The open letter is signed by the various parties advocating human rights issues, including the AICHR – represented by Yuyun Wahyuningrum as the representative of Indonesia, the Southeast Asia Freedom of Expression Network, the Institute for Policy Research and Advocacy, FORUM-ASIA, the Commission for Missing Persons and Victims of Violence, the Indonesia Legal Aid Foundation and the Human Rights Working Group. (asp)