Allegations Of DPT Data Leakage In The 2024 Election, The Right Time To Accelerate Derivative Rules Of The PDP Law

Data center (photo: dock. Unsplash)

JAKARTA - The case of alleged data leakage of the 2024 Election Fixed Voter List (DPT) in the General Election Commission (KPU) system is a momentum to accelerate the completion of the derivative rules of the Personal Data Protection Law (UU PDP).

"I think this will be used as a momentum for how we further accelerate the derivative rules of the PDP Law, namely PP (Government Regulations) and Presidential Regulations (Presidential Regulations) so that it is more comprehensive and more implemented immediately by the PDP Law," said the Director General of Information and Public Communication of the Ministry of Communication and Information Usman Kansong quoting Antara.

Usman said that if the derivative rules of the PDP Law were issued, enforcement efforts and supervision related to personal data protection could be carried out more comprehensively.

He gave an example, in the PDP Law, electronic system operators (PSE) who are negligent in maintaining personal data can be criminally charged. In addition, the regulation also regulates the establishment of a personal data protection supervisory agency.

For the time being, until the personal data protection supervisory agency is formed, the Ministry of Communication and Informatics carries out this supervisory function.

Usman emphasized that the government is serious in protecting people's personal data. If the derivative rules of the PDP Law have been issued, the government has a strong legal basis for handling cases of data security violations, including allegations of DPT data leaks that have recently surfaced.

"So, I think there is seriousness, yes, if this government is included through regulations, yes. With this regulation there is seriousness for all of us to protect our personal data," said Usman.

Government regulations and presidential regulations regarding the protection of personal data are derivative rules of Law (UU) number 27 of 2022 concerning Personal Data Protection (PDP) that have been prepared since the regulation was passed in 2022.

Currently, the implementation of the PDP Law is in a transition period for two years before the Law is actually implemented and fully enforced in October 2024.

During this transition period, personal data controllers, personal data processors, and other related devices from both the public and private sectors were asked to study to prepare technical implementations in each institution.

In order for the implementation to be smoother, the government has compiled a derivative regulation of the PDP Law which in more detail regulates the mandate of the PDP Law, including provisions regarding personal data processing activities, including the disclosure and analysis of personal data. In its creation, PDP derivative regulations involve many parties including cybersecurity experts to stakeholders from various fields.