In brief

In April 2023, in two separate judgments, the Constitutional Court clarified the interpretation of some provisions in Law No. 27 of 2022 on Personal Data Protection (“PDP Law“), i.e., provisions on personal or household processing of personal data and on the limitations of a data subject’s rights in relation to national security and defense.

The judgments were rendered following two applications for a constitutional review of the PDP Law, specifically the above provisions, which were filed by individuals in October 2022 (“First Case“) and November 2022 (“Second Case“). The applications requested that the Constitutional Court declare the relevant articles in the PDP Law to be unconstitutional. However, the applications were fully rejected, and therefore the relevant articles remain valid without any change.

Court considerations

The Constitutional Court did not find any inconsistencies between the challenged provisions of the PDP Law (as mentioned below) and the Indonesian 1945 Constitution in either of the cases.

Data processing by people in personal or household activities

The First Case requested that the following articles of the PDP Law be declared unconstitutional:

Article 1.4 of the PDP Law — definition of a data controller
Article 2(2) of the PDP Law — exemption for personal or household data processing activities
Article 19 of the PDP Law — types of data controller and data processor

With regard to Article 1.4 and Article 19 of the PDP Law, the applicant argued that legal entities are not considered as data controllers, and therefore legal entities are not eligible to conduct personal data processing in Indonesia. For context, Article 1.4 and Article 19 both state that a data controller covers persons, public organizations and international organizations.

The Constitutional Court rejected the applicant’s request on this simply because the court viewed that the definition of “person” under Article 1.7 of the PDP Law covers both individuals and legal entities. Therefore, both individuals and legal entities can be data controllers.

In relation to Article 2.2. of the PDP Law, the applicant’s concern was raised when he saw that there were business activities carried out based on personal or household activities, e.g., a stay-at-home spouse selling goods on e-commerce platforms for their own purposes (which was a very common activity during the COVID-19 pandemic). Therefore, the question was whether these activities are also outside the scope of personal data protection under the PDP Law.

The Constitutional Court clarified that the exemption given by Article 2.2 of the PDP Law applies to non-commercial personal or household activities. Further, the government has provided clearer guidance on this exemption, namely that the processing activities excluded from the scope of the PDP Law are personal, intimate, non-commercial and/or non-professional.

Limitations of a data subject’s rights — national security and defense

In the Second Case, the applicant argued that the PDP Law provides an unclear interpretation of, and fails to define, “national defense and security”, which is the basis for limitations of a data subject’s rights, and therefore violates his constitutional rights as a citizen who needs legal certainty.

For context, Article 15.1 (a) states that the rights of a data subject (i) to end data processing involving their personal data, (ii) to take back consent for the processing of their personal data, (iii) to lodge an objection to automated decisions, (iv) to postpone or suspend the processing of their personal data, (v) to get and use their personal data from a data controller, and (vi) to use and send their personal data to another data controller, are excluded for the benefit of national defense and security. The PDP Law does not elaborate on what is considered as “for the benefit of national defense and security”.

The Constitutional Court clarified that the limitation of a data subject’s rights for the benefit of national defense and security is supporting the principle of public interest, in that the processing of personal data by the state is only used to protect the public interest and the wider community, in accordance with the prevailing laws and regulations. This is in line with the government’s view, which is that data processing (in the case of national defense and security) must be in line with and subject to the relevant regulations, e.g., the State Defense Law.

Conclusion

These judgments from the Constitutional Court provide a clearer view of the Article 1.4, Article 2.2 and Article 19 in the PDP Law (as elaborated above). They have led to expectations that the implementing regulations of the PDP Law will be issued soon due to society’s various concerns regarding the implementation of personal data protection under the PDP Law. As of 1 June 2023, the drafts of the implementing regulations of the PDP Law are currently in the formulation process.

* * * * *

© 2023 HHP Law Firm. All rights reserved. HHP Law Firm is a member firm of Baker & McKenzie International. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.