Indonesian People's Personal Data Is Not a Trade Item

Photo by Luthfiah VOI

JAKARTA - The Indonesian government under President Prabowo Subianto should not ignore aspects of digital sovereignty simply for the sake of smooth economic cooperation. Personal data protection is a basic consumer right that is non-negotiable.

The Personal Data Protection Law (PDP Law), which has been officially in effect since 2022, requires every data controller to obtain explicit consent from data subjects before processing or sharing that information.

The commitment to transfer personal data across borders is highly risky. One such risk is the possibility of foreign parties accessing sensitive and personal data of Indonesian citizens, which could be misused for certain interests.

The Chairman of the Indonesia Cyber Security Forum (ICSF), Ardi Sutedja, suspects that the agreement between the United States and Indonesia was made without consultation with competent and experienced parties from industry and government who have worked together for decades to champion Personal Data Protection Law No. 27 of 2022.

"We are very surprised that this could happen when we already have the Personal Data Protection Law and the Consumer Protection Law. So what's the point of existing laws if they are ignored?" he said.

He emphasized how it is possible to hand over the management of Indonesian citizens' personal data to a country that is highly vulnerable to hacking. Tulus Abadi, Chairman of the Indonesian Empowered Consumers Forum (FKBI), emphasized that personal data protection is a basic consumer right that is non-negotiable.

"Personal data protection is a basic consumer right. Cross-border data transfer without guarantees equivalent to the Personal Data Protection Law (PDP) poses a high risk to the security, privacy, and digital sovereignty of our society," Tulus said in an official statement on Tuesday, July 29.

According to Tulus, there are three major risks in the personal data management clause in the agreement. First, there is the emergence of inequalities in Indonesian citizens' data protection standards, especially as it is processed under the US (CCPA, HIPAA), which are not fully aligned with the Indonesian PDP Law. Second, Indonesian Consumers could potentially lose quick access to complaint mechanisms if data is stored on US servers. And third, there is the possibility of data misuse, such as being sold or used for profiling without the data owner's explicit consent.

"Trade agreements must not sacrifice citizens' right to privacy. We urge the government to strengthen data protection clauses before finalizing the agreement," Tulus emphasized.

Tulus believes that international cooperation should not erode basic consumer rights. Without comprehensive protection, the risk to Indonesian citizens' data security will increase drastically.

"Trade agreements must not sacrifice citizens' privacy rights. We urge the government to strengthen data protection clauses before finalizing the agreement," Tulus emphasized.

Telecommunications expert and Executive Director of the Indonesia ICT Institute, Heru Sutadi, in a conversation with Bloomberg Technoz, compared Indonesia to a "greenhouse" for the US once data commitments have been agreed upon by both countries. Even in the context of PDP, each person or institution must still obtain personal consent before data is transferred.

"If consent is obtained, the impact is that the US will have access to Indonesians' personal data. The US can access everything, including data on who works in the military or police, the health history of the President and Vice President, the financial data or accounts of members of the House of Representatives. Ultimately, Indonesia is like a greenhouse for the US."

Government: Only Commercial Data Exchanged

Illustration of a hack resulting in a data leak by hackers. (Pixabay-Innovalabs)

Deputy Minister of Communication and Digital Affairs, Nezar Patria, emphasized that the agreement regarding cross-border data transfers between Indonesia and the United States is not finalized but is still under discussion.

"It's in the coordination stage, and what was conveyed yesterday is not final. So, there are still technical matters being discussed by the US and Indonesian governments, so it's still ongoing," Nezar said on Monday, July 28 in Jakarta.

Nezar also asked the public not to misunderstand this agreement. He stated that this cross-border data transfer process is not carried out haphazardly and complies with applicable regulations, namely Law Number 27 of 2022 concerning Personal Data Protection.

"Please don't misunderstand. This doesn't mean Indonesia can freely transfer all personal data to the US. We still have protocols as stipulated in the Personal Data Protection Law," he said.

Coordinating Ministry for Economic Affairs Spokesperson Haryo Limanseto explained that the data transfer point in the US-Indonesia joint statement only covers commercial data, not personal or individual data.

"In the US-Indonesia Joint Statement, there is an issue of data transfer, where the flexibility granted to the US and other partner countries focuses on commercial data, not personal/individual data," Haryo told VOI on Tuesday, July 29.

Haryo emphasized that the transferred data is strategic data, the provisions of which are stipulated in the Personal Data Protection Law (PDP Law) and other related regulations. "Strategic data, the provisions of which are stipulated in the Law and other related regulations. The leading ministry for this matter is the Ministry of Communication and Digital, for technical data provisions and other matters," he said.

Haryo gave an example of the type of commercial data that can be accessed: sales data from a region used for consumer behavior research.

"So, personal data includes things like names and ages, but commercial data involves processing, like sales in that region. For example, if we collect this data at a bank, they then conduct research on that data, and that's what is meant by commercial data," he concluded.