Asian Angle | Indonesia’s #Bjorka embarrassment exposed its devastatingly weak cybersecurity – but a new data protection law may help
- A long-awaited data protection law passed earlier this month could pave the way for Indonesia to enjoy all that embracing a digital economy promises
- But only if it’s implemented correctly. The Bjorka hacking case showed the government needs to better prepare itself to protect its citizens
Overall, Indonesia’s government seems to be optimistic about the PDP law. Communication and Information Technology Minister Johnny G. Plate claimed that Indonesia was the fifth Asean country to have PDP regulations and said he believes the law embodies the government’s protection of Indonesian citizens’ private data.
If successfully implemented, the law will provide a future-oriented regulatory framework and possibly stimulate reform in data governance for the government and non-government organisations.
01:43
Fuel prices infuriate Indonesians amid cost of living crisis
It also closes the lacuna in Indonesia’s governance framework for the protection of citizens’ personal information and data, a lack that the government acknowledged years ago.
However, not all commentators are optimistic. The implementation of the new PDP law already faces some serious challenges. First, it stipulates the need for “implementing regulations” to be harmonised across government, from the executive (presidential) to ministerial level.
All of these supporting regulations need to be formulated inclusively. Second, what form the implementing agency will take as the highest PDP authority that reports directly to the president is still unclear. Many alternatives are being suggested and this authority could take at least a year to be established. The implementation of a comprehensive PDP framework will inevitably entail more complex debates.
Looking at Indonesia’s legislative experience, worries about delays in the implementation of important laws are not baseless. The National System for Science and Innovation Law No. 11 of 2019 (UU Sisnas Iptek), for instance, was ratified in mid-2019 to mandate the formation of an independent Research and Innovation Agency, which is still not fully operational.