Legal Updates on Indonesia Electronic Systems and Transactions

On 10 October 2019, Indonesian government has issued Government Regulation No. 71 of 2019 ("GR 71/19") which revokes Government Regulation No. 82 of 2012 ("GR 82/12") on Organization of Electronic Systems and Transactions.

Main Keys of GR 71/19: We note some important stipulations on GR 71/19 are as follows:

New Categorization of Electronic Service Operator (“ESO”):  We note that the GR 82/12 previously set out a categorization based on the underlying purposes for the organization of electronic systems i.e. public services and non-public services. Meanwhile, the GR 71/19 classifies ESO into two categories as follows:

a. State sector ESO (“Public ESO”) is a state institution and other agencies designated by a government institution that operates an electronic system, with the exception of state institutions that are responsible for regulating and supervising the financial sector e.g. Indonesia Central Bank (BI) and Financial Services Authority (OJK) (Art. 2 (4) of GR 71/19).

b. Private sector ESO (“Private ESO”) is Individuals (Indonesian or foreign citizens), business entities (incorporated or unincorporated) as well as members of the general public which organize electronic systems that meet the following criteria:

  1. An ESO that is regulated or supervised by a state ministry or institution in accordance with law; and
  2. An ESO that operates a portal, site or online application for the following purposes:
  1. Offering, maintaining, and/or trading of goods and/or services;
  2. Providing financial transaction services;
  3. Transmission of paid digital material or content through a data network, whether downloadable via a portal or site, email transmission, or other applications to the user’s device;
  4. Providing communications services, such as short messaging, voice calls, video calls, email, online chat on a digital platform, networking services, and social media;
  5. search engine services, and the provision of electronic information in the form of text, voice, image, animation, music, video, film or games, or a combination of parts of these; and/or
  6. processing personal data for operations involving the provision of electronic transaction-related services to the public. (Art. 2 (5) of GR 71/19)

Mandatory Registration of ESO: We note that under the GR 82/12, registration to Minister of Communication and Informatics (“MoCI”) was mandatory for only Public ESOs. Meanwhile, the Private ESOs were to be undertaken on voluntary basis. After the GR 71/19, both Public and Private ESOs are obligated to register as an ESO (Art. 6 (1) of GR 71/19).

For your further reference, the ESO registration procedures are currently covered under MoCI Regulation No. 36 of 2014 on the Registration Procedure for Electronic System Providers (MoCI Regulation No 36/14). Hence, the MoCI is would likely to issue an amendment or a new regulation in the near future pursuant to the various provisions which are set under GR 71/2019.

Location of Data Management, Processing and/or Storage: We note that the GR 71/19 require the location of data management, processing, and/or storage as follows: 

ESO Location
Public Must be within Indonesia, unless the relevant storage technology is unavailable domestically (Art. 20 (2) of GR 71/19)
Private

Must be within Indonesia and/or overseas;

The relevant Private ESO must provide access to their overseas electronic systems and electronic data for the purposes of supervision and law enforcement.

Personal Data Protection: The GR 71/19 acknowledges the personal data protection principle by protecting the security of personal data from any loss, misuse, unauthorized access, and disclosure. We note that any personal data may only be processed based on the legitimate consent of the data subject for one or more specific purposes that have been informed to the data subject (Art. 14 (3) GR 71/19).

In addition, personal data may be processed for the purposes of:

  1. fulfillment of a contract to which the data subject is party or in order to fulfill a request of the data subject prior to entering into the contract;
  2. completion of data controller’s obligation that is imposed by law;
  3. implementation of the vital interests of the data subject;
  4. for the exercise of authority vested in the data controller by law;
  5. for the realization of a public service obligation to which the data controller is subject in the public interest; and/or
  6. for the attainment of other legitimate interests of the data controller and/or the data subject. (Art. 14 (4) GR 71/19)

Right to Be Forgotten: The GR 71/19 endorsed the right to be forgotten concept as first introduced through the Law No. 19 of 2016 concerning The Amendment of Law No. 11 of 2008 on Electronic Information and Transactions by (collectively referred to as the “ITE Law”). 

The GR 71/2019 now sets out further details regarding the implementation of the right to be forgotten as follows:

Measure

Detail

Deletion

(right to erasure)

Personal data may be deleted if:

  1. It is acquired and processed without the prior consent of the relevant data owner;
  2. The consent relating to said data has been revoked by the data owner;
  3. The data is acquired and processed unlawfully;
  4. It is no longer in accordance with its initial purposes, as stated under the relevant agreement and/or laws and regulations;
  5. Its utilization period has exceeded the period stipulated under the relevant agreement and/or laws and regulations; and/or
  6. It is disclosed by ESO in a way that disadvantages the data owner. (Art. 16 (1) of GR 71/2019)

Removal

(right to delisting)

Personal data may be removed from search engines based on a court decision by submitting an application for removal to the relevant local district court. Such application includes the following information:

  1. Identity of data owners;
  2. Identity of ESO and/or addresses of the relevant electronic systems;
  3. Irrelevant personal data which is under the control of the ESO; and
  4. Reasons of the removal request. (Art. 17 (3) of GR 71/2019)

Feasibility Assessments: Both Public ESO and Private ESO are required to undergo a feasibility test in order to assess whether their electronic systems has meet the obligatory protection requirements and strategic characteristics. (Art 34 of GR 71/19).

Nevertheless, GR 71/19 does not specify the outputs of the feasibility test, unlike the GR 82/12 which requires MoCI to issue the feasibility certificates after the completion of such assessment. 

Grace Period: We note that all existing ESOs must comply with this obligation in accordance with the provisions of GR of 71/19 within one year period. (Art 102 (1) of GR 71/19).

The article above was prepared by Marshall S. Situmorang (Partner) and Aniendita Rahmawati (Associate).

Disclaimer: The information herein is of general nature and should not be treated as legal advice, nor shall it be relied upon by any party for any circumstance. Specific legal advice should be sought by interested parties to address their particular circumstances. For more information, please contact us at mail@nusantaralegal.com.