PERSONAL DATA PROTECTION IN INDONESIA – BIG CHANGES IN STORE

The Asian Business Law Institute spoke to Danny Kobrata, Partner of K&K Advocates, on the anticipated changes in the landscape of personal data protection in Indonesia where the Internet economy is projected to reach $70 billion in 2021.

 

BY CATHERINE SHEN

According to the 2021 e-Conomy SEA report by Google, Temasek and Bain & Company, Internet economy is projected to reach $70 billion in 2021 in Indonesia, underpinned by 21 million new digital consumers added since the start of the pandemic up to the first half of 2021. Data are the backbone of this booming digital economy. Meanwhile, the country has been mulling significant changes to its regulatory framework for personal data protection for some time now. The Asian Business Law Institute (ABLI) spoke to Danny Kobrata, Partner of K&K Advocates, on these anticipated changes and why those outside of Indonesia need to take note of what lies ahead.

 

ABLI: For starters, what has led you to specialise, among others, in technology, media and telecom (TMT) practices?

Danny Kobrata (DK): I would say there are two main reasons why I am focused on TMT. First, I find this area new and interesting because it is somewhat different from the other more established areas of the law. Technology moves so fast that it is sometimes hard for the law to catch up. Every time a new technology is developed or invented, a new legal question arises which often involves uncertainty because most of the issues have not been properly addressed by law, the court or regulators. So, one needs to be creative and be able to see the issues from more than just the legal perspective. One also needs to understand not only the technologies themselves, but market practices, the government's position on certain issues/technologies and even the degree of cultural acceptance among the public. For me, as a lawyer, this is challenging but also exciting.

Second, I think there are great opportunities for lawyers to specialise in TMT, at least in Indonesia. When I started the TMT practice group at my firm, there were not many lawyers in the country who specialised in this field. Some firms had TMT practice groups, but those groups were mostly part of another larger practice group such as corporate or IP. With this in mind, I foresaw a great demand for TMT lawyers. Now, after some years, this has turned out to be true. The demand for TMT legal services is growing along with the growth of digital economy in Indonesia, and we are starting to see many Indonesian lawyers focusing on this area of the law now.

ABLI: In your opinion, what role does personal data protection legislation, either one omnibus piece of legislation or a bundle of sectoral regulations, play in today's economy worldwide and in Indonesia in particular?

DK: Obviously such legislation plays a very important role. Today's businesses are largely driven by data, and some of those data are personal data. Without proper protection, those personal data may be abused, which may lead to violation of privacy. On the other hand, businesses are also aware of the need to protect personal data. Protecting personal data is now not only a matter of compliance, but also a key factor which differentiates one company from another. Therefore, most businesses do want to ensure that they effectively protect personal data. The lack of personal data protection law or regulation might just create legal uncertainty to businesses.

So, you can see, the existence of personal data protection law or regulation serves dual purposes: to protect individuals/customers and to give legal certainty to businesses.

Specifically for Indonesia, this is absolutely the time to have a personal data protection act. In the past few years, there have been many cases of misuse of personal data and unauthorized data breaches. Most of them are not solved partly due to the lack of regulations. In addition, introducing a personal data protection act is also in line with the government's plan to make Indonesia one of the largest digital economies in Asia. If we were indeed going to be one, we need to be ready with the legal infrastructure to ensure a proper balance between the protection of privacy and the growth of digital economy.

ABLI: Why do you think it is important for parties outside of Indonesia to keep track of data privacy and protection developments in Indonesia?

DK: Indonesia is one of the key markets for many services and products in Asia. In fact, it is the largest economy in Southeast Asia. Many companies outside of Indonesia have a large customer base in the country. Indonesia's personal data protection law or regulation will certainly affect the way a company deals with the personal data of its customers in Indonesia.

For example, not long ago, there was less restriction in processing the personal data of Indonesian citizens. One of the reasons was the lack of regulations. As a result, a company could do many things with the personal data of Indonesians. However, as the laws and regulations on privacy develop, the government started to introduce regulations which restrict or limit the way a company can process such personal data. There are now requirements on data localisation, consent, etc. Companies need to monitor these developments so that they can more swiftly respond every time changes are introduced by new regulations.

ABLI: We understand that the long-anticipated personal data protection act in Indonesia is entering its final leg of finalisation. As we are nearing the end of 2021, what will your "Christmas wish-list" be for this upcoming legislation?

DK: Like everybody else, I wish the personal data protection bill will be finally passed this year. Public pressure has never been greater. Breaches of personal data happen significantly more often today than they did just a few years ago. The government and the parliament are halfway through in finalising the law. So, I think the momentum is definitely there. I also learnt that the two institutions are close to reaching a consensus on the personal data protection act and are committed to passing the law this year. Hopefully this turns out to be the case and we can have our very first personal data protection law soon.

 

Danny will be speaking at a webinar organised by ABLI on 19 January 2022 to discuss the upcoming personal data protection law in Indonesia. Together with his co-speaker Eugene Ho, Partner and Co-Head of Cybersecurity & Data Protection Practice of Allen & Gledhill, Danny will walk the audience through some key provisions and concepts of the proposed new legislation in Indonesia and how the new law may affect businesses. Sign up now. SAL members can redeem their credit dollars for this webinar here.