Two students, Eric Cihanes and Garin Arian Reswara, during the judicial review hearing of Article 53 paragraph (1) of Law Number 27 of 2022 on Personal Data Protection, Wednesday (30/10). Photo by MKRI/Bayu.

---

Jakarta, MKRI – Eric Cihanes (Petitioner I) and Garin Arian Reswara (Petitioner II), who are students, submitted a judicial review petition of Article 53 paragraph (1) of Law Number 27 of 2022 on Personal Data Protection (PDP Law) against Article 28G paragraph (1) of the 1945 Constitution of the Republic of Indonesia. The Petitioners questioned the phrase “and” at the end of the sentence of letter b of the article related to the provision on the obligation of the personal data controller and processor in assigning an official or officer who performs the function of personal data protection.

“It means that the criteria to assign Personal Data Protection (PPDP) which are formulated with the word “and” are cumulative criteria, which means that the Data Controllers and Processors are obligated to assign PPDP if they fulfill all or three of the criteria in letter a, b, and c of the Article 53 paragraph (1) of the PDP Law simultaneously or as a whole,” Eric said during the preliminary hearing of Case Number 151/PUU-XXII/2024 on Wednesday, October 30, 2024 in the panel courtroom.

Article 53 paragraph (1) of the PDP Law reads Personal Data Controller and Personal Data Processor shall appoint an official or officer who performs the function of Personal Data Protection in the case of (a) processing of Personal Data for the benefit of public services; (b) the core activities of the Personal Data Controller have the nature, scope, and/or purpose that require regular and systematic monitoring of large-scale Personal Data; and (c) the core activities of the Personal Data Controller consist of large-scale processing of Personal Data for specific Personal Data and/or Personal Data related to criminal offenses.” The criteria for assigning PPDP formulated cumulatively, have narrowed the scope of the data controller and data processor organization, which is obligated to assign PPDP.

In this case, the Petitioners argued, the data controller and data processor organization that only satisfy one or two criteria of the requirements provided in Article 53 paragraph (1) of the PDP Law are not obligated to assign PPDP. It is despite each criterion in each item in the article a quo is a criterion for personal data processing activities categorized as personal data processing that has a high potential risk to personal data subjects, which is also emphasized in Article 34 paragraph (2) of the PDP Law.

Garin continued that the presence of PPDP plays an essential role in ensuring the implementation of personal data protection; PPDP is present to supervise the compliance of a Data Controller and/or Data Processor organization in relation to personal data protection under the PDP Law, especially in terms of compliance with its obligations. In addition, the rules of obligation are, of course, followed by the regulation of sanctions that can be imposed on parties who do not carry out these obligations, the sanction instrument which in this case is used to encourage compliance with the obligation to appoint a PPDP in the norms of the article a quo.

"Thus, the use of the word “and” in formulating the details of the requirements in Article 53 paragraph (1) of the PDP Law has limited the obligation to assign PPDP only to Data Controller and Data Processor organizations that meet all criteria cumulatively simultaneously. Thus, this reduces the usefulness of the Article, which contains the norm of obligation, and also the connection with Article 57 of the PDP Law, which is the norm of sanctions for violating the norm of obligation in Article 53 paragraph (1) of the PDP Law,” Garin said.

In their petitum, the Petitioners request the Court to declare Article 53 paragraph (1) of the PDP Law contrary to the 1945 Constitution and has no binding legal force as long as the phrase “and” is not interpreted with “and/or”.

Case Number 151/PUU-XXII/2024 was heard by the Panel of Justices led by Justice Arief Hidayat, accompanied by Justice Daniel Yusmic P Foekh and Justice Arsul Sani. In his advice, Justice Daniel questioned the state's loss due to the enactment of the norms being tested in addition to the loss of the Petitioners.

“Is there any state loss and what is the impact? The Petitioners are still describing from the perspective of the Petitioners, but what if from the perspective of the state, for example, what is the impact, there is no state loss and so on so that the Petitioners can see more comprehensively, not talking about their own interests,” Daniel said.

Before closing the hearing, Justice Arief said that the Petitioners had 14 days to revise the petition. The petition must be received by the Court no later than November 12, 2024 during the Court's working hours. (*)

Penulis: Mimi Kartika
Editor: Lulu Anjarsari P.
Humas: Fauzan Febriyan

Translator: Rizky Kurnia Chaesario (NL)

Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version will prevail.

---