Communication professor of Airlangga University Henri Subiakto testifying as an expert for the Government at the judicial review hearing of Law No. 27 of 2022 on Personal Data Protection, Tuesday (3/21/2023). Photo by MKRI/Bayu.
Tuesday, March 21, 2023 | 23:34 WIB
JAKARTA (MKRI) — On Tuesday, March 21, 2023 in the plenary courtroom, the Constitutional Court (MK) held another judicial review hearing of Law No. 27 of 2022 on Personal Data Protection (PDP Law) for both cases No. 108/PUU-XX/2022, filed by Leonard Siahaan, and No. 110/PUU-XX/2022, filed by Dian Leonaro Benny. At this sixth hearing, the President/Government presented two experts, communication professor of Airlangga University Henri Subiakto and law professor of Padjadjaran University Ahmad M. Ramli.
Subiakto said the development of communication technology had significantly changed social life, resulting in a phenomenon called “sociomateriality,” where humans and technology cannot be separated because they are used for all activities. So, technically, internet has created social, economic, and political connectivity and, thus, the problem of one region may then become a problem for another country, he said. Previously, social, economic, and political activities in the world only occurred physically, but now also in the cyber space.
Along with this, Subiakto said, every activity in the digital space is always related to personal data—from downloading applications, opening links, shopping, to communicating, so these data are collected and processed digitally by digital platform companies.
“The use of personal data requires good and accountable governance, so regulations are needed to ensure adequate protection of personal data as well as to supervise controllers and processors of personal data. These regulations are very important, considering that in the digital era, data is needed to control consumer data, people’s behavior patterns, and their communication. Then, millions or even hundreds of millions of citizens who are controlled become Big Data, which changes the face of capitalism in the digital era,” he explained.
Protecting Citizens’ Dignity
Subiakto views the PDP Law as a legal basis for maintaining the state’s sovereignty and defense as well as for the protection of citizens’ personal data. It regulates data subjects or owners of personal data, data controllers, and processors of personal data, along with their rights and responsibilities.
“Without this law, the state would be letting its citizens not only be monitored, but also exploited their personal data for business, politics, and crimes by those who exploit their personal data. Therefore, the PDP Law serves to protect the personal, family, honor, dignity of all citizens as stated in Article 28G paragraph (1) of the 1945 Constitution,” he explained.
Protecting Privacy
Despite the exception exception in the phrase “personal activities” or “household activities” in Article 2 paragraph (1) of the PDP Law, Subiakto said, both are within the private domain and protected by the state. The phrase refers to private, non-commercial domain and the protection of human rights, especially the right to privacy.
“The article serves not to burden individuals with their private activities. Without it, citizens would be threatened by punishment and their private data would not be protected,” he said before Chief Justice Anwar Usman, Deputy Chief Justice Saldi Isra, and the other constitutional justices.
Boosting Digital Transformation
Meanwhile, Ahmad M. Ramli said the PDP Law was important and strategic in guarding and boosting digital transformation amidst Industry 5.0, as data has now been the new oil. It has regulated protection of personal data in an integrated, comprehensive, and systematic manner. The exception to individuals in “personal activities” or “household activities” in Article 2 paragraph (1) of the PDP Law was not intended to burden subjects of personal data when they qualify as data controllers.
“Therefore, the article is needed because it concerns the exception for personal data controlling and processing, not the protection of personal data subjects in general. Thus, the exception concerns data processing as personal data controllers and processors by corporations or public entities,” he said.
Ahmad argued that if everyone must play a role as a personal data controller or processor just like corporations or public entities, when no commercial activities take place, all individuals in household activities would be required to comply with regulations as personal data controllers and perform their duties as per Chapter VI Articles 20-50 of the PDP Law.
Also read:
Provisions on Personal Data Security for Individuals and Home Businesses Challenged
Petitioner Provides Comparison of Provisions on Personal Data Protection
Personal Data an Exception in Personal Data Processing
Govt: Law on Personal Data Protection Provides Legal Protection
The Petitioner of case No. 108/PUU-XX/2022 challenges Article 1 paragraph (4), Article 2 paragraph (2), and Article 19 of the PDP Law.
Article 1 paragraph (4) reads, “Personal Data Controller shall be any individual, public entity, or international organization who act individually or jointly to determine the purpose and control of Personal Data processing.” Article 2 paragraph (2) reads, “This Law shall not apply for Personal Data processing by individuals in personal or household activities.” Article 19 reads, “Personal Data Controller and Personal Data Processor shall be: a. Any individual; b. Public Entity; and c. International Organization.”
The Petitioner believes the PDP Law has not provided legal protection for personal data users, especially e-commerce home business actors, who are vulnerable to data breaches by hackers when making financial transactions.
The advances of information technology allow personal data to be collected and transferred easily without the knowledge of the subject, thus resulting in threats against the subject’s constitutional rights. Personal data, he asserted, is part of human rights that needs to be protected. Therefore, provisions on personal data is the manifestation of the recognition and protection of basic rights. As such, the PDP Law, he emphasized, has not provided protection for the rights of subjects of personal data.
Meanwhile, the Petitioner of case No. 110/PUU-XX/2022 argues that Article 15 paragraph (1) letter a of the PDP Law (“The rights of Personal Data Subject as referred to in Article 8, Article 9, Article 10 paragraph (1), Article 11, and Article 13 paragraph (1) and paragraph (2) are exempted for: a. The interest of national defense and security.”) was against Article 28D paragraph (1) and Article 28E paragraph (1) of the 1945 Constitution, which treats data as part of personal privacy. He believes privacy is a standalone right that should not depend on other rights, but it could be lost if someone publicize private things.
Losses due to violation of privacy are difficult to assess. They may interfere with personal life, so the victim of such a violation deserves compensation. Article 15 paragraph (1) of the PDP Law does not clearly and accurately explain “the interest of national defense and security,” so could potentially lead to multiple interpretations and problems in the future and is used as justification for excluding the rights of subjects of personal data.
Author : Sri Pujianti
Editor : Nur R.
PR : Fitri Yuliana
Translator : Yuniar Widiastuti (NL)
Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version will prevail.
Tuesday, March 21, 2023 | 23:34 WIB 306