“The Ministry of Communication and Information issued Government Regulation No. 71 of 2019 on Electronic System and Transaction Operation (“PP 71/2019”) which made some crucial changes regarding the mandatory registration for both public and private sector, data centre, and right to be forgotten.
PSE (Penyelenggara Sistem Elektronik) or Electronic System Provider refers to every person, state agency, business entity, and public in general which provide, manage and/or operate electronic system either individually or in cooperation together with other Electronic System Provider for the interest of themselves or other people. Recently, the Ministry of Communication and Information reinforced the regulation even more by issuing Government Regulation No. 71 of 2019 on Electronic System and Transaction Operation (“PP 71/2019”) which effectively revoked Government Regulation No. 82 of 2012 on Electronic System and Transaction Operation (“PP 82/2012”). One of the crucial changes in the newest Government Regulation is that now PSE registration is mandatory for both public and private sectors.
Obligation to Register PSE for both Public and Private PSE
Based on the coverage, Electronic System Provider can be divided into two. Electronic System Provider in Public Sector and Electronic System Provider in Private Sector. Previously, PP 82/2012 describes Electronic System Provider in Public Sector as Electronic System Provider which operates public services. Regarding the scope of “public services” itself refers to the Law No. 25 of 2009 on Public Services (“UU 25/2009”), which stipulates that Public services activities contains public goods and services and administrative services that are governed by law, such as: education, teaching, employment and business, housing, communication and information, environment, health, social securities, energy, banking, transportation, natural resources, tourism, and other related sectors. However, In PP 71/2019, the description of Electronic System Provider in Public Sector is changed into Electronic System Provider by state agency or other institution appointed by state agency.
Thus, such state agency/institution would be considered as Electronic System Provider in Public Sector regardless of whether their activity is in the scope of public services as stipulated in UU 25/2009 or not. However, PP 71/2019 does include additional details regarding this matter, which, Electronic System Provider in Public Sector does not include Electronic System Provider which functions as regulatory authority and supervisor in financial sector (such as Bank of Indonesia and OJK).
On the other hand, Electronic System Provider in Private Sector in PP 71/2019 is described as Electronic System Provider by individual, business entity, and public. The scope of Electronic System Provider in Private Sector includes:
a. Electronic System Provider regulated under Ministry or Government Institution;
b. Electronic System Provider which has portal, website, or application which utilizes internet for the following purposes:
1. Provide, manage, and/or operate trade of goods;
2. Provide, manage, and/or operate financial transaction service;
3. Premium based digital content deliverance via internet, either via portal/websites, via email, or via application;
4. Provide, manage, and/or operate communication services;
5. Web search engine, electronic information provider in the form of words, sound, picture, animation, music, video, movie, and game or combination of such;
6. Personal data processing for operational activity relating to electronic transaction activity.
Unlike in the previous PP 82/2012 which only imposed Electronic System Provider in Public Sector to register PSE while leaving it as optional for Private Sector, PP 71/2019 stipulates that both Electronic System Provider in Public Sector and Private Sector must register as PSE. Such registration must be done before the electronic system can be used.
Registering as PSE
With the launch of OSS system, PSE registration is now half integrated at OSS. PSE is listed as one of the operational permits that can be processed via OSS, however, technically speaking, the process is done in both OSS and Aptika (Aplikasi Informatika-Application of Informatics), which is the Ministry of Communication and Information’s own website. In OSS, the applicant can submit their application to process PSE which will then redirect them to Aptika website to continue the process using the same integrated account as their OSS account. In Aptika, the applicant will need to submit the required documents. According to the regulation of the Minister of Communication and Information No. 7 of 2019 on the amendment of the regulation of the Minister of Communication and Information No. 7 of 2018 on Online Integrated Electronic Licensing System in Communication and Information Fields (“Perkominfo 7/2019”), the requirements for PSE registration are:
a. General description of the electronic system operation, which at least include:
a. Name of the electronic system;
b. Sector of the electronic system;
c. Website URL;
d. Domain name of the system and/or Sever IP address;
e. Short description on the electronic system’s function and the business model;
f. Explanation on the usage of hosting;
g.Willingness to enforce the protection of private data.
b. certificate of information securities with Electronic System categorization based on information securities management system or letter of commitment fulfilment to acquire certificate of information securities if the applicant does not yet have such certificate.
The ministry of Communication and Information will verify the submitted application in no longer than ten working days and then will issue the certificate of registration in longer than three working days. The certificate of registration will remain valid for five years. Additionally, the applicant will also be listed in the list of Electronic System Provider.
Data Centre
Based on Article 20 PP 71/2019, Electronic System Provider in Public Sector obliged to manage, process, and/or or storage of Electronic Systems and Electronic Data in the territory of Indonesia. However, they can do those abroad in the event of the technology of the data storage is not available in Indonesia.
As for the Electronic System Provider in Private Sector, article 21 PP 71/2019 stated that they can manage, process, and/or or storage of Electronic Systems and Electronic Data in the territory of Indonesia and/or outside of Indonesia.
It different from the previous regulation, article 17 paragraph (2) PP 82/2012, mentioned that mentioned Electronic System Provider obliged to put data centre and disaster recovery in the territory of Indonesia concerning to the law enforcement, protection, and enforcement of the country’s sovereignty over the data of its citizens.
Obligation to Report in PSE
The obligation of Electronic System Provider does not stop with the acquirement of certificate of registration. After the registration, there is still an obligation to submit report on every updates of the Electronic System to the Ministry of Communication and Information. According to the regulation of the Minister of Communication and Information No. 36 of 2014 on Electronic System Provider Registration Procedures (“Perkominfo 36/2014”), the kind of updates that would need to be reported are as follows:
a. change of person in charge of the PSE;
b. change of PSE profile related to the name and/or domicile;
c. change of the scope of services for PSE in Public Sector.
Incompliance could result in revocation of certificate of registration.
Right to be Forgotten
Compared to its predecessor, PP 71/2019 also introduce a new concept, which is the right to be forgotten. In line with Law No. 19 of 2016 on Information and Electronic Transaction, according to PP 71/2019 Electronic System Provider is obligated to erase electronic information under their control that is no longer relevant based on request of the owner of the information. Electronic information that could be subjected to erasure are electronic information regarding private information which:
a. was acquired and processed without consent of the owner;
b. the consent had been revoked by the owner;
c. was acquired and processed illegally;
d. is no longer relevant with the given consent or the prevailing law;
e. usage has exceeded the allowed period of time as according to the given consent or prevailing law;
f. was displayed by the Electronic System Provider and resulted in the owner to suffer some losses.
The erasure of the abovementioned information is exempted if the information is required to be stored by the prevailing law. On the other hand, it is also possible to request for such electronic information to be delisted from search engine instead, however such delisting would require a court decree.
Author: Benedictus Giovanni / Latifah Kusumawardani
Gaffar & Co., Indonesian Boutique Law Firm which specializing and focus on commercial law areas e.g. Information & Technology.
For further queries and information, contact us:
+62 21 5080 6536 | info@gaffarcolaw.com | www.gaffarcolaw.com
