COVID-19 Pandemic: FAQs on Personal Data Protection based on Indonesia Prevailing Laws and Regulations
We have managed to provide the following FAQs regarding the Personal Data Protection during the COVID-19 pandemic based on Indonesia prevailing laws and regulations for your reference:
1. Has government issued any guidance or legal reasons for personal data processing for the purpose of protecting public health within the scope of measures taken to prevent the COVID-19 pandemic in Indonesia?
Based on Indonesian prevailing laws and regulations, Personal Data defines as every valid and factual information that is inherent and can be identified, whether directly or indirectly, with each individual. (Art. 1 point 1 jo. Point 2 of Ministry of Communications and Informatics (“MoCI”) Regulation No. 20 of 2016 on Personal Data Protection in Electronic System (“MoCI Regulation 20/2016”). The scope of employees personal data includes: a) their identity such as name, address, gender, and so forth; b) other information such as one’s health-related data, travel history, and their recent close contact.
In regards with the current COVID-19 situation, we also refer to the Minister of Health Regulation No. 45 of 2014 on Implementation of Health Surveillance (“MoH Regulation 45/2014”), the implementation of health surveillance of infectious disease should be held in an integrated manner through data collection, data processing, analysis, and dissemination to produce objective and measurable information for decision-making purposes. (Art. 5 jo. Art. 6 (1) of MoH Regulation 45/2014).
Furthermore, On 26 March 2020 MoCI has issued Ministerial Decree No. 159 of 2020 on Efforts to Curb the Spread of Corona Virus Disease (COVID-19) through the Support of the Post and Information Sector which enable government agencies i.e. Ministry of Health, Ministry of State-owned Enterprises, Head of National Agency for Disaster Management, and Indonesian telecommunication operators to conduct health surveillance in an integrated manner to trace and track COVID-19 through a digital application called “Peduli Lindungi” as developed by PT Telekomunikasi Indonesia.
2. Can an Employer lawfully conduct temperature check, process travel history, and health status (together referred to as “Assessment”) of its employees or visitors?
Yes, an Employer can require its employees or visitors to conduct the Assessment with certain conditions, as Employers are obliged to take precautions in preventing the COVID-19 spreading in the workplace, even more, to protect its employees as well as public health.
We are in the view that such Assessment would be considered as a collection of personal data under the Indonesian prevailing data privacy laws. As such, valid consent of its employee and visitors is compulsory. An Employer is obligated to obtain explicit consent from the data subject before performing data processing activities or at the time when personal data are obtained.
Furthermore, it is important to note that the Assessment form should include the consent from its employees and visitors, which should clearly define the purposes of data collecting, in this instance preventing further spreading of COVID-19, and provide the possibility of further processing.
3. How an Employer should treat the collected Personal Data?
We note that an Employer as data collector should treat the collected Personal data in the following manners:
a. Assurance on the accuracy of Personal Data collected from the employees: An Employer is required to ask its employees and visitors to provide accurate and valid information (such as recent travel history and health condition) about themselves. Subsequently, disciplinary actions may be imposed on the employees who provide false information as appropriate under the prevailing laws and regulations and company regulations.
b. Maintain updated records of Personal Data processing: An Employer is required to keep the record of all Personal Data processing up-to-date to assure adequate precautions to prevent the spreading of COVID-19 within its area.
c. Preservation on the security and confidentiality of the Personal Data: According to Indonesian prevailing laws and regulations, any collected Personal Data should always be processed and maintained with appropriate technical measures. An internal guideline that governs how Personal Data should be handled is also necessary to prevent any leakage, data breach, and/or data theft.
Furthermore, an Employer should strive to fulfill the subject’s Personal Data rights as much and as appropriate as it can. Employees and visitors as data subjects are authorized for the confidentiality of their personal data, to file a complaint, to obtain access to amend the data and its historical records, and to request the deletion of data under certain circumstances (Art. 26 of MoCI Regulation 20/2016).
4. Can an Employer share the collected Personal Data with third parties?
Personal Data sharing with the purpose of ensuring public safety and health is allowed by the Indonesian prevailing laws and regulations. The legal basis of such action may refer to several laws and regulations relating to the prevention of infectious disease and epidemic, among others Law No. 6 of 2018 on Health Quarantine, Government Regulation No. 40 of 1991 on Countermeasure of Infectious Disease, and MoH Regulation 45/2014, as the COVID-19 is acknowledged as infectious disease and has been declared as a pandemic by World Health Organization (WHO) on 11 March 2020.
We also note that the Indonesia prevailing laws and regulations authorized the Health Authority to collect, gather, and process the Personal Data to manage the outbreak of an infectious disease (Art. 5 jo. Art. 6 (1) of MoH Regulation 45/2014). Further, an Employer is obliged to report the occurrence of an identified or suspected case of infectious disease within its authority in a timely manner to the relevant Health Authority. Nonetheless, we are in the view that it is relevant to disclose such information with other third parties, such as building management, clients, and vendors who have recent close contact with the suspect so such third parties can take necessary precaution measures and manage its risk to protect its safety immediately. Nevertheless, it is important to note that the disclosure of such personal data should be under a strict necessity and proportionality basis.
5. What are further necessary actions with the collected Personal Data after the COVID-19 Pandemic has ended?
We note that the collected Personal Data should only be used for informed purposes and retained for a limited period to achieve distinct purposes. The Indonesian prevailing laws and regulations provide a minimum retention period of 5 years after the purposes have been achieved (Art. 15 (3) point B of MoCI Regulation 20/2016). Nonetheless, it is safer to store the data in a certain format that does not allow direct identification during the retention period to avoid any data mistreat or leakage. Lastly, the collected personal data should be erased after such period passes.
The article above was prepared by Marshall S. Situmorang (Partner) and Aniendita Rahmawati (Associate).
