INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
sonal data may trigger additional regulatory obliga - tions. Under PDP Law, such processing may: (i) serve as an indicator of “high-risk processing”, thereby requiring the conduct of a DPIA or risk assessment; or (ii) serve as one of the indicators for the mandatory appointment of a DPO. Processing of Children and Persons with Disabilities The PDP Law further provides that the processing of children’s personal data and the personal data of per - sons with disabilities must be carried out in a specific manner and subject to additional requirements. In the case of children, processing requires parental consent and/or legal guardians in accordance with applicable laws and regulations. For persons with disabilities, processing must be conducted using appropriate communication methods as regulated under appli - cable laws, and requires consent from the individual concerned and/or their legal guardian. In addition, the processing of children’s (defined as individuals who use or access the products, services, and features and are under 18 years of age) person - al data through electronic systems is subject to PP TUNAS (see 1.1 Overview of Data and Privacy-Relat- ed Laws ). PP TUNAS applies to all electronic system operators (ESOs), both public and private, whose products, services, or features are intended for use by children or are likely to be accessed by them. As an implementing regulation of the EIT Law, PP TUNAS introduces a range of obligations and prohibitions relating to children’s privacy and personal data pro - tection, including requirements on parental consent and notification, high-privacy settings by default, the conduct of DPIAs, and the appointment of a DPO, as well as prohibitions on profiling and precise geoloca - tion tracking by default, and manipulative practices (any methods, techniques, or non-transparent prac - tices that can encourage children to overshare data, disable privacy settings, or engage in harmful behav - iour), are strictly forbidden. 1.4 Processing of Personal Data for Research and Development Purposes In principle, the PDP Law does not prohibit the processing of personal data or anonymise data for research and development purposes, provided that
such processing complies with the PDP Law and any applicable sector-specific regulations (for example, healthcare regulations). Although the PDP Law does not currently contain spe - cific provisions governing research and development activities, it recognises that certain data subject rights may be exempted for public interest purposes, includ - ing for statistical purposes and scientific research. Where personal data is processed for the statistical activities and scientific research, the exempted rights are (i) the right to withdraw consent; (ii) the right to object to automated decision-making and profiling; (iii) the right to restrict processing; (iv) the right to data portability; and (v) the right to request the termination of processing, deletion, and/or destruction of personal data. Accordingly, while the PDP Law does not provide a dedicated research and development regime, it allows limited restrictions on certain data subject rights, with - out relieving compliance with the core principles and obligations under the PDP Law. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Indonesia’s legal framework on artificial intelligence (AI) is still in an emerging stage, and there is currently no comprehensive statute governing the develop - ment or use of AI. Regulatory oversight is fragmented and primarily derived from existing, sector-specific laws and policy instruments issued and supervised by various authorities. These include, among oth - ers, the MOCD, which issued Circular Letter No 9 of 2023 on AI Ethics, as well as sectoral guidance from other regulators, such as the OJK, which introduced the OJK and Fintech Associations AI Code of Ethics. The personal data protection-related aspects under these instruments are relatively general in nature. They require that any processing of personal data involving automated decision-making and AI systems comply with the PDP Law and other applicable regulations. The PDP Law does not contain AI-specific provisions. Nevertheless, the use of AI systems or models involv - ing the processing of personal data is subject to the general requirements under the PDP Law. In particular,
161 CHAMBERS.COM
Powered by FlippingBook