SAFEGUARDING PERSONAL DATA IN THE PUBLIC SECTOR: UNVEILING THE IMPACT OF THE NEW PERSONAL DATA PROTECTION ACT IN INDONESIA

Abstract

Personal data protection is a significant issue that has attracted public attention in recent years due to various personal data leaks, especially those held by public sector institutions. The issue prompted lawmakers to re-open the discussion of the Personal Data Protection Bill (PDP Bill), which was finally enacted in October 2022. An essential aspect addressed in the newly enacted PDP Act was data protection by public sector institutions in Indonesia. Several studies showed that the collection of personal data by these institutions is primarily mandatory. Therefore, this study examines the laws and regulations related to personal data protection by public sector institutions and the potential implementation challenges. The challenges include the tendency to “prioritise” sectoral regulations over the PDP Act and the potential to “over-utilise” and “over-interpret” data protection exemptions. The findings indicated that the newly enacted PDP Act provided excessive leeway for public institutions to exempt data subjects’ rights despite the high standard for data processing. The findings suggested that to achieve a meaningful implementation of the PDP Act, the mandated supervisory authority must be independent in carrying out its duties and functions to ensure the just enforcement of personal data protection in the public and private sectors. In addition, the government must develop a strategy to ensure the consistency of data protection implementation through various legislations currently being drafted, as well as harmonising the PDP Act with other related Acts.