“Personal Data Protection is aimed to ensure the right of citizens to personal protection and raise public awareness as well as ensuring recognition and respect for the importance of personal data protection”
Previously, we have summarized the general information regarding the Subject, Types of Personal Data, Rights of Personal Data, Personal Data Controller and also Personal Data Processor that are regulated under the Law Number 27 of 2022 on Personal Data Protection (“UU PDP”) (https://gaffarcolaw.com/news-insights/personal-data-protection-law/). Besides the above, UU PDP also still covers wide various subjects regarding the Personal Data. The following article will discuss other key subjects under the UU PDP.
Transfer of Personal Data
Processing of Personal Data includes the activity of transferring Personal Data. The Elucidation of Article 16 paragraph (1) letter (e) of UU PDP described the word “transfer” as the transfer, delivery, and/or duplication of Personal Data both electronically or non-electronically from a Personal Data Controller to another party.
A. Transfer of Personal Data within the Jurisdiction of Indonesia
Based on Article 55 paragraph (1) of UU PDP, A Personal Data Controller may transfer Personal Data to other Personal Data Controller within the jurisdiction of Indonesia. The Personal Data Controller who transfers Personal Data and who receives the transfer of Personal Data must carry out Personal Data Protection as referred to in UU PDP.
B. Transfer of Personal Data Outside of the Jurisdiction of Indonesia
According to Article 56 paragraph (1) of UU PDP, a Personal Data Controller may transfer Personal Data to other Personal Data Controllers and/or Personal Data Processors outside the jurisdiction of the Republic of Indonesia in accordance with the provisions stipulated under UU PDP.
In order to do so, the Personal Data Controller must ensure that the country of domicile of the Personal Data Controller and/or the Personal Data Processor that receives the transfer of Personal Data has a Personal Data Protection level that is equal to or higher than those that are regulated under UU PDP. If such requirements fail to be fulfilled, the Personal Data Controller must ensure that there is adequate and binding Personal Data Protection (Article 56 paragraph (2) and (3) of UU PDP).
If such requirements that are mentioned in Article 56 paragraph (2) and (3) of UU PDP fail to be fulfilled, the Personal Data Controller must obtain approval of the Personal Data Subject (Article 56 paragraph (4) of UU PDP).
Prohibition in the Use of Personal Data
UU PDP also regulates the prohibition in the use of Personal Data. The prohibition is done in order to eliminate the unlawful usage, obtain and collecting of Personal Data which later can be misused and could harm the Personal Data Subject.
In accordance with Article 65 of UU PDP, every person is prohibited from:
- Unlawfully obtaining or collecting Personal Data that do not belong to them with the intention to benefit themselves or other persons which may result in the loss of the Personal Data Subject (Article 65 paragraph (1) of UU PDP).
- Unlawfully disclosing Personal Data that do not belong to them (Article 65 paragraph (2) of UU PDP).
- Unlawfully using Personal Data that do not belong to them (Article 65 paragraph (3) of UU PDP).
While the unlawful use of Personal Data is prohibited, UU PDP also regulates the prohibition of creation of false Personal Data. Based on Article 66 of UU PDP, every person is prohibited from creating false Personal Data or falsifying Personal Data with the intention to benefit themselves or other persons which may result in the loss of other persons.
Dispute Settlement and Procedural Law
UU PDP recognizes several dispute settlements methods in the event dispute arises between parties.
According to the Article 64 paragraph (1) of UU PDP, the settlement of a Personal Data Protection dispute shall be conducted through arbitration, court or other alternative dispute resolution agencies in accordance with provisions of laws and regulations.
The procedural law that applies to the settlement of a Personal Data Protection dispute and/or process shall be implemented based on applicable procedural law that is in accordance with provisions of laws and regulations.
During the dispute settlement procedure, UU PDP recognize valid evidence, as follows:
a. Evidence as referred to in the procedural law; and
b. Other evidence in the form of electronic information and/or electronic documents in accordance with provisions of laws and regulations.
This implies that UU PDP abides to the criminal and/or civil procedural law regarding valid evidence while recognizing other form of evidence which is electronic information and/or electronic documents.
Sanctions
Sanctions under UU PDP is divided into two forms, namely:
a. Administration sanctions; and
b. Criminal sanctions.
The administrative sanctions shall be in form of:
a. written notice;
b. temporary suspension of Personal Data processing activities;
c. erasure or removal of Personal Data and/or administrative fines.
Article 57 paragraph (3) of UU PDP further regulates that the administrative sanctions in the form of administrative fines is 2% (two percent) of the annual income or annual revenue at the maximum.
The administrative sanctions under UU PDP will be imposed under the authority of agency. The further regulation regarding the agency and administrative sanctions shall be regulated in Regulation of the Governments.
Other form of sanctions under the UU PDP is the criminal sanctions. The criminal sanctions in UU PDP refer to criminal provisions in accordance with Article 67 of UU PDP. There are several Criminal Provisions under the Articles 67 and 68 of UU PDP in which the criminal sentence varies from imprisonment and/or fine.
In addition to fines, Corporation may also be imposed with additional sanctions in the form of:
a. confiscation of profits and/or assets obtained or proceeds from crimes;
b. suspension of the entire or part of the Corporation’s business;
c. permanent prohibition of doing certain actions;
d. shutdown of the entire or part of the Corporation’s place of business and/or activities;
e. fulfil the obligations that have been neglected;
f. payment of compensation;
g. revocation of license; and/or
h. dissolution of the Corporation
Author: Krisna Murti Ardianto
Gaffar & Co., an Indonesian Boutique Law Firm specializing and focusing on commercial law areas e.g. Information Technology, Capital Market & Financial Services, Corporate Secretarial.
For further queries and information, contact us:
+62 811 877 216 | info@gaffarcolaw.com | www.gaffarcolaw.com
