Petitioners Eric Cihanes and Garin Arian Reswara attending the material judicial review hearing of Law No. 27 of 2022 on Personal Data Protection, Tuesday (20/5). Photo by MKRI/Ifa.

---

Jakarta (MKRI) – The Constitutional Court held another hearing on Case No. 151/PUU-XXII/2024 on the judicial review of Article 53 paragraph (1) of Law No. 27 of 2022 on Personal Data Protection (PDP Law) against the 1945 Constitution of the Republic of Indonesia. The President was supposed to present an expert, Wicipto Setiadi, but he could not attend the hearing. Hence, he submitted a written testimony.

“[The testimony] was submitted in writing, Your Honor,” Director of Litigation and Non-litigation of Directorate General of Legislation of the Ministry of Law, Rudy Hendra Pakpahan, stated on Tuesday (20/5) at the Plenary Courtroom, Jakarta.

Meanwhile, Chief Justice Suhartoyo stated that a written testimony may be submitted to the Court along with a conclusion from the President. Each of the parties—the Petitioners, the President, and the House of Representatives—may submit a conclusion to the Court by Wednesday, May 28, 2025, at the latest.

Before closing the hearing, Chief Justice Suhartoyo stated that the hearing was the last one for the case. All parties may await further information from the Registrar’s Office regarding the case's decision.

“The case has reached its last hearing, and the Petitioners may await the information from the Registrar’s Office on the case's decision,” Chief Justice Suhartoyo explained.

Also read:

Personal Data Protection Law Challenged

Petitioners of Personal Data Protection Law Compare Regulations in Other Countries

Controller Must Protect Personal Data

The Petitioners explained their petition that questioned the phrase “and” at the end of the sentence of letter b in Article 53 paragraph (1) of the PDP Law related to the provision on the obligation of the personal data controller and processor in assigning an official or officer who performs the function of personal data protection. Article 53 paragraph (1) of the PDP Law reads Personal Data Controller and Personal Data Processor shall appoint an official or officer who performs the function of Personal Data Protection in the case of (a) processing of Personal Data for the benefit of public services; (b) the core activities of the Personal Data Controller have the nature, scope, and/or purpose that require regular and systematic monitoring of large-scale Personal Data; and (c) the core activities of the Personal Data Controller consist of large-scale processing of Personal Data for specific Personal Data and/or Personal Data related to criminal offenses.” 

To the Petitioners, the cumulatively formulated criteria for assigning PPDP have narrowed the scope of the data controller and data processor organization, which is obligated to assign PPDP. In this case, the Petitioners argued, the data controller and data processor organization that only satisfy one or two criteria of the requirements provided in Article 53 paragraph (1) of the PDP Law are not obligated to assign PPDP. It is despite each criterion in each item in the article a quo is a criterion for personal data processing activities categorized as personal data processing that has a high potential risk to personal data subjects, which is also emphasized in Article 34 paragraph (2) of the PDP Law.

In their petitum, the Petitioners request the Court to declare Article 53 paragraph (1) of the PDP Law contrary to the 1945 Constitution and has no binding legal force as long as the phrase “and” is not interpreted with “and/or”.

Penulis: Mimi Kartika
Editor: Lulu Anjarsari P.
Humas: Fauzan Febriyan

Translator: Rizky Kurnia Chaesario

Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version will prevail.

---