Examining the Role of the PDP Law in Data Security Issues in Indonesia

The issue of data security is not new in Indonesian society. Ranging from technology companies to internal government agencies have been criticized failed to protect data its users. This led to the formulation of a draft of the Personal Data Protection Law in 2015.

Exactly on September 20, 2022, through the Plenary Meeting of the Indonesian Parliament in Jakarta, the Bill on the Protection of Personal Data (RUU PDP) was finally passed into law. Final draft of the PDP Law which has been discussed since 2016 consists of 16 chapters and 76 articles. This number increased by 4 articles from the government's initial proposal at the end of 2019, which was 72 articles.

Even so, many questions are raised in the community regarding the effectiveness of this PDP Law in ensuring the security of their data. To find out more about this new law and its use in society, DailySocial.id invited an expert and founder of a technology company that focuses on issues related to data security, PT Indo CISC, Budi Rahardjo, in a #TuesdayStartup discussion.

Budi himself has been actively overseeing this data security issue since 12 years ago. According to him personally, this is something good in terms of legal certainty. He said that the PDP Law is generally needed as a legal guide for the community in the future.

One of the highlights in the ratification of the PDP Law is the sanctions imposed for companies that access and leak personal data illegally and are negligent in maintaining or managing customer personal data. Sanctions range from large fines to deprivation of profits.

Apart from that, there is the greatest power that can be done to a company that collects a person's data and an obligation to them if a user asks to delete it. Behind that, the biggest -- or perhaps most contested -- right is the ability to stop companies from selling data to other parties, such as advertisers.

Why does data need to be protected?

According to the book Surveillance Capitalism, which was read by Budi Rahardjo, he revealed that personal data collection is actually aimed at providing better services. However, when the personal data is used for purposes other than its initial interest, then there has been an abuse.

Personal data protection regulations refer to the binding practices, safeguards and rules put in place to protect personal information and ensure that data subjects remain in control of their information. In short, data owners must be able to decide whether or not to share some information, who has access, for how long, for what reasons, and be able to modify some of this information.

This kind of policy does not only exist in Indonesia, but also in many other countries. However, Budi also touched on the cultural differences that exist in Indonesia and other countries. Indonesian people tend to like to share and interact so that sometimes they forget that there are people who have the potential to take advantage of our personal data.

Then, what can we do? In fact, the protection of personal data can also start from oneself. Like many social media applications, there are already two-step verification features, backup codes, and e-mail notifications if other parties access our social media. Previously, DailySocial.id has also written an article related to recommendations for individuals to be able to maintain security personal data they.

Especially in the digital era, weak data protection in Indonesia has resulted in widespread data leakage. It is proven by the frequent occurrence of cyber crime cases, such as: hacking (hacking) and cracking (piracy) of social media which leads to personal data theft, extortion to online fraud. The ratification of the PDP Law is said to be able to provide a bright spot for the dark world of cyberspace in Indonesia.

Impact on business people

In an official release announced by Kominfo, the Minister of Communication and Information, Johnny G. Plate revealed that the enactment of the PDP Law is a momentum for history in the management of personal data in Indonesia in the digital sphere. Furthermore, he said that the PDP Law will prioritize the perspective of protecting personal data in every new technology development, so that it will encourage ethical innovation and respect human rights.

This is done as an effort to anticipate technological advances and digital culture, the existence of the PDP Law is also expected to encourage new habits in the community to better implement personal data protection. That way, according to Minister Johnny, the regulation will encourage the growth of a digital ecosystem in order to increase new talents in the field of personal data protection, whether in government, private or public institutions.

The PDP Law itself was designed because there was a desire from the public to protect their data. However, from the side of business people, there are also many rules that must be obeyed. Budi Rahardjo also expressed his concerns regarding the rules in the PDP Law for business people, especially those that are still in the early stages.

"If I'm a new entrepreneur, and I'm still starting a business, but I have to follow a lot of rules, it's going to be tougher," said Budi in the #TuesdayStartup session. Therefore, the government is also expected to be able to provide guidance for business people so that later they do not consider this PDP Law as a stumbling block.

Regarding large projects involving data from the Indonesian people, many still doubt the capabilities of our government. However, Budi responded to this with optimism. Initiatives to integrate data are good and can make things more efficient.

"Although sometimes there is fear because there is only one data source, it's like if one is destroyed, everything is destroyed. If you can't afford it, you have to be able to. We must also be able to jointly monitor the government and monitor its execution," he concluded.