Rega Felix conveying revisions to petition for case No. 137/PUU-XXIII/2025 at a judicial review hearing of the Personal Data Protection Law, Tuesday (8/26/2025). Photo by MKRI/Fauzan.

---

JAKARTA (MKRI) — The Petitioner of case No. 137/PUU-XXIII/2025, lawyer and law lecturer Rega Felix, delivered the revisions to his material judicial review petition of Article 56 paragraphs (1), (2, (3) and (4) of Law No. 27 of 2022 on Personal Data Protection (PDP Law). He contends that an agreement between the Government of Indonesia and the United States concerning the transfer of citizens’ personal data without public consent could result in significant constitutional harm to the Indonesian people, in violation of Article 28G paragraph (1) of the 1945 Constitution.

“I believe that even the protection of personal data stored in domestic data centers remains vulnerable, and therefore placing such data abroad carries an even greater risk,” he said at the petition revision hearing on Tuesday, August 26, 2025.

The Petitioner argued that the Indonesia-US agreement has led to highly critical interpretation of Article 56 of the PDP Law on the transfer of citizens’ personal data out of the republic’s territory, which is regulated under Article 56 paragraphs (1) through (4) of the PDP Law. Erroneous interpretation of the norm could significantly harm his constitutional rights protected under Article 28G paragraph (1) of the 1945 Constitution, he said.

He emphasized that even personal data already controlled by the Government within Indonesia, such as population and civil registry data, has been subject to leaks and even hacking. Meanwhile, the Government plans to transfer personal data abroad, including to the United States. His concerns are heightened by the fact that the United States is a leading developer of artificial intelligence (AI).

The Petitioner further argued that once personal data is leaked, the risk to the data subjects increases significantly. Personal data belongs to the people; if such data were to fall under the control of another state as a result of unilateral action by the President, this would constitute a violation of popular sovereignty as enshrined in Article 1 paragraph (2) of the 1945 Constitution.

Article 56 paragraph (1) reads: “A Personal Data Controller may transfer Personal Data to another Personal Data Controller and/or Personal Data Processor outside the jurisdiction of the Republic of Indonesia in accordance with the provisions of this Law.” Article 56 paragraph (2) reads: “In conducting the transfer of Personal Data as referred to in paragraph (1), the Personal Data Controller shall ensure that the state in which the Personal Data Controller and/or Personal Data Processor receiving the transfer is domiciled possesses a level of Personal Data Protection equivalent to or higher than that provided under this Law.” Article 56 paragraph (3) reads: “In the event that the requirements as referred to in paragraph (2) are not fulfilled, the Personal Data Controller shall ensure the existence of adequate and binding Personal Data Protection.” Article 56 paragraph (4) states: “In the event that the provisions referred to in paragraphs (2) and (3) are not met, the Personal Data Controller shall obtain the consent of the Personal Data Subject.”

However, in his petitums, the Petitioner requests the Court to interpret the following articles of the PDP Law: for Article 56 paragraph (1), “A Personal Data Controller may transfer Personal Data to another Personal Data Controller and/or Personal Data Processor outside the jurisdiction of the Republic of Indonesia only upon obtaining the consent of the Personal Data Subject or pursuant to a treaty approved by the House of Representatives in accordance with the provisions of this Law;” for Article 56 paragraph (2), “In conducting the transfer of Personal Data as referred to in paragraph (1), the Personal Data Controller shall ensure that the state in which the Personal Data Controller and/or Personal Data Processor receiving the transfer is domiciled possesses a level of Personal Data Protection equivalent to or higher than that provided under this Law based on a treaty ratified by the House of Representatives;” for Article 56 paragraph (3), “In the event that the requirements as referred to in paragraph (2) are not fulfilled, the Personal Data Controller shall ensure the existence of adequate and binding Personal Data Protection that has effective remediation mechanism that recognizes Personal Data as a fundamental human right;” for Article 56 paragraph (4), “In the event that the provisions referred to in paragraphs (2) and (3) are not met, the Personal Data Controller shall obtain the consent of the Personal Data Subject after informing them of the risks associated with the intended transfer of Personal Data.” He asks that any interpretation outside of those he requests be declared unconstitutional and not legally binding.

Also read: Journalists, Illustrator Seek Exception from Ban on Personal Data Disclosure

Aside from hearing case No. 137/PUU-XXIII/2025, Constitutional Justices Arief Hidayat (panel chair), Anwar Usman, and Enny Nurbaningsih also heard case No. 135/PUU-XXIII/2025, filed by civil society coalition for freedom of information and personal data operating under the name SIKAP, which challenges Article 65 paragraph (2) and Article 67 paragraph (2) of the PDP Law.

The Petitioners, who are members of SIKAP, consist of individuals and organizations, including academic Prof. Masduki, illustrator/cartoonist Amry Al Mursalaat, the Alliance of Independent Journalists (AJI) Indonesia, and the Southeast Asia Freedom of Expression Network (SAFEnet). At this hearing, they stated their wish to reduce the legal basis against which the articles be reviewed to only Article 28C paragraph (1), Article 28F, and Article 32 paragraph (1) of the 1945 Constitution.

Legal counsel Wildanu Syahril Guntur presented the Petitioners’ emphasis on the importance of upholding the principles of confidentiality and protection as the fundamental basis of the right to privacy. At the same time, they also underscored the need to consider the principles of balance and public interest as the foundation for formulating this petition.

“[This is] in order to realize a balance between the fulfillment of citizens’ fundamental rights, such as the right to privacy itself, and the fulfillment of the right to information and freedom of expression,” Wildanu said.

The Petitioners claim that Article 65 paragraph (2) in conjunction with Article 67 paragraph (2) of the PDP Law allows for broad and imprecise interpretation, posing a threat to the Petitioners’ constitutional rights, as their professional activities often require the disclosure of personal data in order to fulfil the public’s right to information. Those articles fail to accommodate freedom of expression and the public’s right to information as guaranteed under the Constitution.

Article 65 paragraph (2) of the PDP Law reads: “Any person is prohibited from unlawfully disclosing Personal Data that does not belong to them.” Article 67 paragraph (2) states: “Any person who intentionally and unlawfully discloses Personal Data that does not belong to them as referred to in Article 65 paragraph (2) shall be subject to imprisonment of up to 4 (four) years and/or a fine of up to Rp4,000,000,000.00 (four billion rupiah).”

The Petitioners argue that the provisions of Article 65 paragraph (2) in conjunction with Article 67 paragraph (2), when left without clarification, legitimize the silencing of lawful public expression, particularly when applied without objective and accountable parameters. The State unilaterally limits citizens’ participation in expressing opinions, ideas, or criticism of public policy.

In a constitutional democracy, the Petitioners contend, popular sovereignty can only be fully realized when citizens’ political, social, and cultural expression is fully guaranteed and is not arbitrarily restricted by vague legal norms. An unclarified norm could potentially be used to suppress constitutionally legitimate expression or opinion, thereby fostering fear in society and undermining the democratic climate.

In their petitums, the Petitioners request the Court to declare Article 65 paragraph (2) of the PDP Law unconstitutional and not legally binding insofar as it is not interpreted to mean: “Any person is prohibited from disclosing personal data that does not belong to them except in the course of journalistic, academic, artistic, and literary work and/or insofar as it relates to ensuring access to information for the development of the individual and their social environment.” They also request that Article 67 paragraph (2) of the PDP Law be declared unconstitutional and not legally binding insofar as it is not interpreted to mean: “Any person is prohibited from disclosing personal data that does not belong to them except in the course of journalistic, academic, artistic, and literary work and/or insofar as it relates to ensuring access to information for the development of the individual and their social environment as referred to in Article 65 paragraph (2), punishable by imprisonment of up to 4 (four) years and/or a fine of up to Rp4,000,000,000.00 (four billion rupiah).”

Author       : Mimi Kartika
Editor        : Lulu Anjarsari P.
PR            : Tiara Agustina
Translator  : Yuniar Widiastuti (NL)

Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version will prevail.

---