Indonesia passes long-awaited data protection bill after string of leaks, including of Jokowi’s vaccine records
- The bill’s passage came after a series of alleged breaches, including of a contact-tracing app that revealed President Joko Widodo’s vaccine records
- The legislation stipulates that individuals can be jailed for up to six years for falsifying data, or up to five years for gathering data illegally
Lawmakers overwhelmingly approved the bill, which authorises the president to form an oversight body to fine data handlers for breaching rules on distributing or gathering personal data.
The biggest fine is 2 per cent of a corporation’s annual revenue and could see their assets confiscated or auctioned off. The law includes a two-year “adjustment” period, but does not specify how violations would be addressed during that phase.
The legislation stipulates individuals can be jailed for up to six years for falsifying personal data for personal gain or up to five years for gathering personal data illegally.
Users are entitled to compensation for data breaches and can withdraw consent to use their data.
Why data leaks in Malaysia are on the rise – and what’s being done about it
Communications minister, Johnny G. Plate, said the bill’s passage “marks a new era in the management of personal data in Indonesia, especially on the digital front.”
Abdul Kharis Almasyhari, a member of the commission overseeing the law, said it would mean the state was ensuring protection of the personal data of its people.
The law has been in the works since 2016 and was held up by debate about financial penalties and control of the oversight body, lawmakers said. Authorities have said the law was based on the European Union legislation.
Malaysian PM’s messaging accounts hacked as officials deny data breach crisis
Satriyo Wibowo, a data protection expert who was consulted during its drafting, said it would force companies to improve their data protection.
However, Wahyudi Djafar, who researches data protection for the Institute for Policy Research and Advocacy, questioned whether the penalties were strict enough to force government bodies to improve their data handling.
