Part 1 - Examining Personal Data Subjects: Identification, Jurisdiction, and Rights of Personal Data Subjects
By Even Alex Chandra & Inka Aita Putri / 25 July 2023
Understand the provisions in Law No. 27 of 2022 on the Protection of Personal Data (“PDP Law”), which is aimed at protecting, respecting, and guaranteeing the constitutional rights of personal data subjects in which personal data is attached with more specific discussion regarding individual data subjects, jurisdiction, grouping of personal data, to the rights of personal data subjects.
Key Points
- Subjects of personal data are people and/or corporations to which personal data is attached;
- The PDP Law applies to every person, public agency, and international organization that carries out legal actions within and outside Indonesia;
- Personal data is divided into two types, namely specific and general, which is divided based on the level of sensitivity and its ability to accurately identify individuals;
- Subjects of personal data have rights regulated in the PDP Law, but they are not absolute or limited following prevailing regulations.
Background
The rapid advancement of technology and information utilization in various sectors has been remarkable; however, along with this progress, there is a risk of interventions into individual privacy. The processing of personal data may potentially face threats such as cyber-attacks, identity theft, and other forms of personal data misuse. The leakage of personal data can jeopardize the constitutional rights of personal data subjects, including the right to personal privacy, family, honor, dignity, and property under their control.
To mitigate those risks, the Indonesian Government has enacted Law No. 27 of 2022 on Personal Data Protection (“PDP Law”).
To mitigate those risks, the Indonesian Government has enacted Law No. 27 of 2022 on Personal Data Protection (“PDP Law”).
Jurisdiction and Subjects of Personal Data
The PDP Law provides detailed regulations on the juridiction and subjects of personal data applicable in Indonesia. These rules include any person, public body, and international organization conducting legal acts (processing of personal data, including the acquisition to destruction of personal data) within Indonesian territory, as well as data subjects outside Indonesian jurisdiction with legal consequences within the country.
Personal data subjects, whether individuals or corporations, have rights to their personal data. These rights include access to information, correction and addition of inaccurate data, as well as the right to delete and destroy their personal data in accordance with the prevailing regulations.
Personal data subjects, whether individuals or corporations, have rights to their personal data. These rights include access to information, correction and addition of inaccurate data, as well as the right to delete and destroy their personal data in accordance with the prevailing regulations.
Personal Data: Specific and General
In the categorization of personal data, there are two types based on their nature, namely specific and general data. Specific personal data is data that contains highly sensitive information and can accurately identify individuals, such as health data, biometric data, criminal records, and personal finances fall into this category. Due to its sensitivity, specific personal data requires stricter protection to prevent the risk of leakage or misuse.
On the other hand, general personal data includes more common information, such as full name, gender, and nationality fall into the categorized as general personal data.
On the other hand, general personal data includes more common information, such as full name, gender, and nationality fall into the categorized as general personal data.
Rights of Personal Data Subjects: Non-Absolute Protection
The PDP Law provides several rights given to personal data subjects, but these rights are not absolute. These rights may be subject to certain limitations as regulated in the applicable laws and regulations. For example, there are exceptions for national defense and security interests, law enforcement purposes, and public interests in the context of state administration.
These exceptions are implemented to balance individual privacy rights with broader societal interests.
These exceptions are implemented to balance individual privacy rights with broader societal interests.
Conclusion
The protection of personal data is an increasingly urgent issue to address in the current digital era. Through the PDP Law, the Indonesian Government is committed to protecting the privacy and security of personal data for every individual. Personal data subjects have the right to control their personal data wisely, while understanding that these rights are not absolute and may be subject to necessary limitations for broader interests.
With proper implementation of the PDP Law, it is hoped that the public can feel safe and comfortable in using technology and information for their personal and business interests.
With proper implementation of the PDP Law, it is hoped that the public can feel safe and comfortable in using technology and information for their personal and business interests.