Personal data protection within electronic systems

On 1 December 2016, the Minister of Communication and Informatics Regulation No. 20 of 2016 on the Protection of Personal Data Within an Electronic System came into force in Indonesia. Regulation No. 20 legislated against the need to set out the procedure to protect personal data collected into, retained in, and utilized within an electronic system.

Regulation No. 20 defines the relationship between personal data, certain individual data, and the owner of personal data. Clarifying these relationships clarifies an electronic systems provider’s obligation, and is especially significant given that a person is entitled to compensation from another party for unconsented use of his or her data. The relevant provisions are:

Article 1(1) defines personal data as “certain personal data stored, maintained, and whose accuracy is preserved and confidentiality protected”;

Article 1(2) defines certain personal data as “every [piece of] information that is correct and concrete, attached and identifiable, whether direct or indirect, to each individual, the utilization of which is consistent with the applicable law”;

Article 1(3) defines personal data owner as “an individual to whom certain personal data is attached”.

AHMAD JAMAL ASSEGAF is a partner at Lubis Ganie Surowidjojo and INDRA PAMBUDY is an associate at the firm