INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
such processing may be classified as high-risk pro - cessing, as the use of new or emerging technologies is expressly recognised as one of the indicators of high- risk processing under the PDP Law framework and further triggers the requirement to conduct a DPIA. In addition, the PDP Law grants data subjects spe - cific rights in relation to automated decision-making. Where a data subject objects to a decision made solely through automated processing, which may include decisions generated automatically through AI, the data subject may request that the decision be reviewed or re-made with human involvement, in accordance with the PDP Law. 1.6 Data Breach Requirement In the event of a data breach or personal data protec - tion failure, the personal data controller must provide a written notification no later than 3 x 24 hours (ie, within 72 hours) to the affected personal data subject and to the personal data protection authority (“PDP Authority”). In certain cases, where the personal data protection failure interferes with public services and/ or has a significant impact on the public interest, the personal data controller must notify the public of such personal data protection failure. The written notification shall at least contain the fol - lowing: • the disclosed personal data; • when and how the personal data are disclosed; and • efforts to handle and recover from the disclosure of personal data by the personal data controller. The PDP Law stipulates that the data privacy litigation or dispute resolution is conducted through court, arbi - tration, or other alternative dispute resolution bodies. In practice, a data breach involving ESOs must also be notified to the MOCD within 72 hours from the dis - covery of the personal data protection incident. The MOCD provides a specific reporting form for data breach/incident, which must be completed by the ESOs and submitted together with relevant supporting documents evidencing the occurrence of the personal data protection breach.
With respect to investigations conducted by the MOCD, the legal basis for such investigative powers is derived from the EIT Law and MOCD Reg 20/2016. Under the EIT Law, the competent authorities, spe - cifically investigators from the MOCD, the Indonesian National Police and certain authorised civil servant investigators, are granted the authority to examine the following: • the accuracy of reports or information relating to criminal offences in the field of information technol - ogy and electronic transactions; • any person and or business entity reasonably sus - pected of committing a criminal offence in the field of information technology and electronic transac - tions; and • any tools and/or facilities related to information technology activities that are suspected of being used to commit criminal offences in the field of information technology and electronic transactions Under MOCD Reg 20/2016, the MOCD is authorised to trace and follow up on reports of personal data protection failures and, for supervisory purposes, may request data and information from ESOs in connection with personal data protection, either periodically or at any time as deemed necessary. 1.7 Regulators PDP Authority The PDP Law mandates an independent PDP Author - ity appointed by the President. The PDP Authority has the power to: • govern and establish policies in the field of per - sonal data protection; • conduct supervision over the compliance of per - sonal data controllers; • impose administrative sanctions for violations of personal data protection committed by personal data controllers and/or personal data processors; • assist law enforcement authorities in handling alleged personal data violations as referred to in the PDP Law; • co-operate with personal data protection authori - ties of other countries in order to resolve alleged cross-border personal data protection violations;
162 CHAMBERS.COM
Powered by FlippingBook