This post was written by Dinita Putri, Project Manager, Open Data Lab Jakarta.
Indonesia is one of the countries in Asia with an inadequate legal framework on personal data protection despite the fact that nearly 65% of Indonesians are online.
Research conducted by the Open Data Lab Jakarta examines the existing personal data protection legal framework in Indonesia, identifies the challenges in providing a comprehensive legal framework, and explores the strategies of government, the business sector, as well as of civil society to comply with the regulations.
The research explored the implementation of the existing law and the challenges and opportunities for the implementation of the future data protection law.
This research found that despite the existing regulations on personal data protection, implementation is still somewhat toothless. Further, there are three main challenges in the implementation of a personal data protection legal framework in Indonesia:
- First, the regulatory challenges. The existing regulations do not explain the principles upon which privacy and data protection rules are based. There is a lack of information on how to process personal data and what are the purpose limitations of using personal data. The lack of principles has made the business sector refer more to the European Union’s General Data Protection Regulations (GDPR) and Personal Data Protection Act (PDPA) rather than existing regulations.
- Second are the institutional challenges. There is no single institution or agency that regulates or is in charge of personal data protection governance. The settlement of cases and complaints on personal data breaches and misuse are spread across various government institutions. The existence of an institution in charge could help in the monitoring of the implementation of personal data protection regulations as well as providing assistance for cases and complaints related to data breaches and misuse.
- The third challenge is cultural. There is an urgent need to increase the awareness around the importance of personal data to citizens. Many citizens still do not see personal data and privacy as an inherent part of their citizens’ rights. This has normalized cases on personal data misuse, which are in turn often under-reported. Understanding the cultural characteristics of citizens is important to help construct culture-sensitive implementation strategies for a personal data protection legal framework.
To complement the existing legal framework, governments must provide clear guidelines on personal data collection and use. Since the government is actively engaged with stakeholders of personal data protection, a regulatory sandbox model could be implemented to examine and provide solutions to the enforcement of the regulations, whilst maintaining the growing innovative digital ecosystem.
Read the final report including the opportunities and recommendations on how best to implement a personal data protection legal framework in Indonesia.
Read the report (English | Bahasa Indonesia).
For more updates, follow us on Twitter at @webfoundation and sign up to receive our newsletter. Follow the Lab at @ODLabJkt. To receive a weekly news brief on the most important stories in tech, subscribe to The Web This Week.
