TheJakartaPost
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
House drops fast-tracking of data protection bill
Change Size
T
he House of Representatives is running behind schedule to conclude deliberations on a much-anticipated bill on personal data protection this month, despite growing concerns of online vulnerabilities and a self-made promise to speed up passage of the legislation.
Lawmakers have given up on fast-tracking the legislation process during the current House sitting session that began on Nov. 9 and ends on Dec. 15.
Up until the second week of November, legislators had only been able to go through 12 of the 180 points flagged in the inventory of concerns (DIM), said Abdul Kharis Almasyhari, chairman of House Commission I overseeing defense and information.
Progress became even more sluggish due to the House recess period between Oct. 6 and Nov. 8.
“Looking at the progress, we think it’s impossible for us to conclude the deliberation of the bill with the government this month,” Abdul told The Jakarta Post recently.
Lawmakers first submitted the DIM – that is, a list of inputs from all nine political party factions at the House for drafting the bill – to the government in early February. It adopted and included principles laid out in the European Union’s General Data Protection Regulation (GDPR) in five key areas, including data security and data breaches.
The GDPR is considered a golden standard for personal data protection worldwide, although other standards are also referenced in the legislation drafting process.
Abdul said the commission had just finished deliberating a dozen inputs in a coordination meeting with the state on Wednesday. At the time, both sides agreed to tweak the wording of Article 1 of the initial draft, which lays out the definitions of personal data, personal data managers and personal data processors.
In future deliberations, the Prosperous Justice Party (PKS) politician said that both sides would discuss more “heavy and crucial” concerns, which includes lawmakers’ request to add details on how information and technology firms manage personal data from their users.
However, Abdul said he expected both sides to take so much time due to the complexity of the issues, especially when coupled with the fact that lawmakers are only allowed a maximum of 2.5 hours per hearing session to deliberate, as part of House COVID-19 health protocols.
“It’s going to be difficult for us and the government to deliberate all 180 points from the DIM until the end of the year,” he said. “Hopefully, we can conclude the process next year so we can pass it into law immediately.”
Abdul refused to detail the sticking points in the bill’s deliberations, saying only that the House hoped the bill would guarantee the safety of personal data in the future.
Among the known issues on the inventory of problems, lawmakers and government officials are still undecided about setting up a data protection oversight committee.
Bobby Adhitya Rizaldi, a Commission I lawmaker who sits on the Personal Data Protection Bill working committee, said there was bound to be more discussions on the topic.
“The government is sending signals that there aren’t any plans to set up a new agency, whereas public opinion dictates that there should be an independent committee,” the Golkar Party lawmaker told the Post on Monday.
Bobby said that unlike intellectual property rights like patents, the right to personal data cannot be transferred to other people, and lasts for as long as a person lives.
“The urgency here is that private data cannot be detached from the individual; the public must be represented on matters of data protection and use by data controllers or processors, whether in the private or public sector,” he said. “This will all be discussed at a later date.”
Currently, Indonesia has the Central Information Commission (KIP) as a supervisory authority for public information.
In recent years, civil groups have been pushing the House to pass the Personal Data Protection Bill into law after a string of data breaches occurred among local tech firms.
Most recently, the personal data of nearly 3 million users of fintech aggregator platform Cermati.com was leaked and sold online for US$2,000 late last month. The breach included the names, addresses and bank details of its users.
In March, one of the darlings of the local media scene, Tokopedia, had the personal information of 15 million users stolen. Last year, another online marketplace platform, Bukalapak, was compromised. Personal data from 13 million users were stolen.
Civil groups have criticized the slow deliberation of the bill, which was first proposed by the communications ministry in 2014. It was finally earmarked as a priority legislation this year, with House Speaker Puan Maharani calling on her fellow lawmakers to conclude deliberations during the current sitting period.
Once passed into law, the bill would not only prevent future data breaches but also provide guidelines for law enforcement agencies to impose stern penalties against illegal use of personal data, as stipulated in articles 61 through 69 of the initial draft bill.
Wahyudi Djafar, the deputy director of the Institute for Public Policy Research and Advocacy (ELSAM), said he was hoping that an independent data supervisory body would be set up to monitor, investigate and impose sanctions on data breach cases and that such measures would be enforced effectively.
Ardi Sutedja from the Indonesia Cyber Security Forum (ICSF) agreed that lawmakers and government officials should concentrate heavily on putting in place legal consequences for perpetrators of personal data breaches.
“Now, the government and the House should focus on drafting sanctions and punishment that can give the maximum deterrent effect for wrongdoers,” he said.
