INDONESIA TRENDS AND DEVELOPMENTS Contributed by: Agus Ahadi Deradjat (Agung), Mahiswara Timur, Nina Cornelia Santoso and Dhan Partap Kaur (Sonia), ABNR Counsellors at Law
deny goods or services to the data subject, provided no personal data processing is involved. Additionally, the data controller must implement measures to identify users and ensure relevant personal data protection, including for services targeting children and individuals with disabilities. • Contractual necessity – in relying on contrac - tual necessity, the agreement that serves as a basis of the personal data processing must: (a) obtain valid express consent from the data subject; (b) fulfil relevant personal data protection measures; (c) assess the risk impact on the data sub - ject; (d) balance interests between the data sub - ject and controller; and (e) acknowledge the data subject’s rights – if the data subject does not provide valid consent, the personal data processing is considered null and void. • Legitimate interest – this lawful basis can be relied upon if the data controller: (a) analyses the needs, objectives, and bal - ance between the rights of data subjects and its own interests, demonstrating a legitimate interest in processing personal data; and (b) assesses that processing for other legiti - mate interests does not harm or impact the data subject, ensuring steps are taken to reduce any potential impact. Practical challenges arising from the existence of various lawful bases for data processing include the need for data controllers to appropriately identify the correct lawful basis for each pro - cessing activity. Given that the PDP Law is still relatively new and lacks sufficient guidance, data controllers must exercise caution when identify - ing the purpose of data processing and selecting
the appropriate lawful basis. This task requires careful assessment to ensure compliance with the law and to avoid potential risks associated with unlawful data processing. Therefore, it is advisable for data controllers to engage in con - tinuous consultation with authorities or legal consultants to ensure proper understanding and implementation of the law, as well as to address any ambiguities or uncertainties related to the lawful bases for personal data processing. AI technology providers and users must con - sider the use of personal data for AI learning, output creation, and feedback. The processing of personal data using AI must: • adhere to data protection principles under the PDP Law; • rely on an appropriate lawful basis for pro - cessing; and • implement safeguards throughout the pro - cessing stages. For instance, users of generative AI platforms must ensure they have secured the necessary lawful basis, such as obtaining consent from individuals before processing their personal data on AI platforms. Definition of children The PDP Law classifies data on minors as a spe - cial category but does not define “children” with - in the context of personal data. Definitions vary across regulations: the Indonesian Civil Code defines a child as someone under 21 and unmar - ried, while Law No 23 of 2002, amended by Law No 35 of 2014, defines a child as someone under 18. The Draft GR PDP clarifies this by defining a child as anyone under 18 and unmarried. Under the PDP Law, there are no exceptions to the requirement of obtaining parental or guard -
216 CHAMBERS.COM
Powered by FlippingBook