Ada Pertanyaan? Hubungi Kami 
2026 Hak Cipta Milik Hukumonline.com
Produk Pilihan
Ada Pertanyaan? Hubungi Kami Marcell Sihombing, Fathan Qorib
Hukumonline's Training Event Entitled Legal and Technical Aspect of the Organization of Internet-Based Banking Service. Photo by: RES
The Ministry of Communications and Information Technology (Ministry), acting on behalf of the government, is currently continuing its deliberations of the Draft Ministerial Regulation on Private Data Protection for Electronic Systems (Draft Regulation). These ongoing deliberations were revealed by Teguh Arifiyadi, Chairman of the Indonesia Cyber Law Community (ICLC) at a Hukumonline training event entitled Legal and Technical Aspects of the Organization of Internet-Based Banking Services (Digital Banking), which was held in Jakarta on Wednesday, 18 May 2016.
According to Mr. Arifiyadi, the various provisions set out in the Draft Regulation adopt the self-regulation model (commonly referred as “safe harbor principles”) which has been implemented in the US, as well as many European countries. This self-regulation model, as implemented by the US, defines the matter of privacy protection subjectively, meaning that the level of protection offered should fully conform to what each individual expects from any so-called framework of privacy protection.
“In the US, there are only two methods through which a party can relinquish their privacy. Either the person themselves can voluntarily reveal their personal information to the public, or another party can intentionally publicize a person’s private information without any permission first being granted.
However, it should be stressed that the self-regulation model currently being implemented across many European countries differs slightly from that of the US. Most European countries mandate that users can personally manage and control all kinds of private data, including data which is either directly or non-directly related to the user in question.
Mr. Arifiyadi further explained that any collection of private data must be specific, explicit, and used for lawful purposes, as well as being both accurate and up-to-date (should these criteria apply). Additionally, users are responsible for drawing up documents outlining written consent which allows the use of his/her private data for purposes other than those stipulated under prevailing laws.
“The European model is thus tighter than that employed by the US,” asserted Mr. Arifiyadi.
Similar to the US and European model in many ways, the current Draft Regulation mandates for the regulation of accurate data collection and procurement procedures, as well as mandatory written consent, the confidentiality principle (unless regulated otherwise under prevailing laws), the right to modify any submitted data, verification procedures for data owners, and the use of the Indonesian language.
All data processing and analyses must comply with the initial purposes behind the collection. Such data will also be held for a period of five years according to the provisions set out in Law No. 43 of 2009 on Archiving. Moreover, all collected data must be stored on Indonesian soil.
“The display, publicizing, transfer, and dissemination of any private data can only be achieved after written consent has been secured [from its owner], unless specifically regulated otherwise under prevailing laws and regulations,” Mr. Arifiyadi emphasized.
The Draft Regulation also incorporates provisions which relate to the various rights of private-data owners, including the right to erase, modify, renew, or withdraw data, as well as the right to file a complaint against the use of his/her data. The Draft Regulation also regulates the obligations of electronic-systems organizers, such as the obligation to obtain relevant electronic-systems certification, the obligation to ensure data confidentiality and the obligation to notify data owners in writing should any data breach occur, explaining that they can file a complaint while outlining the sufficient reasons for doing so, as well as identifying any possible potential losses.
Electronic Signatures
Riki Arif Gunawan, Head of the Sub-Directorate for Information Security at the Ministry, also ventured an opinion on this issue during the recent training event. During his address, Mr. Gunawan sought to emphasize the importance that electronic signatures are predicted to play during the upcoming digital banking era, and expressed his hope that all bank customers would ultimately take possession of their own personal electronic signatures.
“The regulation covering this matter [electronic signatures] is currently being deliberated. In the future, all individuals will be required to submit a P12 file [containing verified electronic signatures] so that they can be verified [as the owner of their own electronic signature],” Mr. Gunawan asserted.
However, Mr. Gunawan also sought to remind the various parties present at the training event of the vital need for a third-party Certified Authority (CA), which would have the authority to issue electronic-signature certifications. This CA must satisfy several requirements, such as the requirement to secure certification from the Ministry and the requirement to be 100% fully-owned by domestic parties and therefore not open to Foreign Direct Investment (FDI). In the future, a single certified electronic signature could thus end up being used for all kinds of services.
“A signature guarantees the identity, content integrity, and uniqueness of its owner. Therefore, the P12 file must never be given to any other party, because any usage must be registered under the name of its original owner,” Mr. Gunawan concluded.
According to Mr. Arifiyadi, the various provisions set out in the Draft Regulation adopt the self-regulation model (commonly referred as “safe harbor principles”) which has been implemented in the US, as well as many European countries. This self-regulation model, as implemented by the US, defines the matter of privacy protection subjectively, meaning that the level of protection offered should fully conform to what each individual expects from any so-called framework of privacy protection.
“In the US, there are only two methods through which a party can relinquish their privacy. Either the person themselves can voluntarily reveal their personal information to the public, or another party can intentionally publicize a person’s private information without any permission first being granted.
However, it should be stressed that the self-regulation model currently being implemented across many European countries differs slightly from that of the US. Most European countries mandate that users can personally manage and control all kinds of private data, including data which is either directly or non-directly related to the user in question.
Mr. Arifiyadi further explained that any collection of private data must be specific, explicit, and used for lawful purposes, as well as being both accurate and up-to-date (should these criteria apply). Additionally, users are responsible for drawing up documents outlining written consent which allows the use of his/her private data for purposes other than those stipulated under prevailing laws.
“The European model is thus tighter than that employed by the US,” asserted Mr. Arifiyadi.
Similar to the US and European model in many ways, the current Draft Regulation mandates for the regulation of accurate data collection and procurement procedures, as well as mandatory written consent, the confidentiality principle (unless regulated otherwise under prevailing laws), the right to modify any submitted data, verification procedures for data owners, and the use of the Indonesian language.
All data processing and analyses must comply with the initial purposes behind the collection. Such data will also be held for a period of five years according to the provisions set out in Law No. 43 of 2009 on Archiving. Moreover, all collected data must be stored on Indonesian soil.
“The display, publicizing, transfer, and dissemination of any private data can only be achieved after written consent has been secured [from its owner], unless specifically regulated otherwise under prevailing laws and regulations,” Mr. Arifiyadi emphasized.
The Draft Regulation also incorporates provisions which relate to the various rights of private-data owners, including the right to erase, modify, renew, or withdraw data, as well as the right to file a complaint against the use of his/her data. The Draft Regulation also regulates the obligations of electronic-systems organizers, such as the obligation to obtain relevant electronic-systems certification, the obligation to ensure data confidentiality and the obligation to notify data owners in writing should any data breach occur, explaining that they can file a complaint while outlining the sufficient reasons for doing so, as well as identifying any possible potential losses.
Electronic Signatures
Riki Arif Gunawan, Head of the Sub-Directorate for Information Security at the Ministry, also ventured an opinion on this issue during the recent training event. During his address, Mr. Gunawan sought to emphasize the importance that electronic signatures are predicted to play during the upcoming digital banking era, and expressed his hope that all bank customers would ultimately take possession of their own personal electronic signatures.
“The regulation covering this matter [electronic signatures] is currently being deliberated. In the future, all individuals will be required to submit a P12 file [containing verified electronic signatures] so that they can be verified [as the owner of their own electronic signature],” Mr. Gunawan asserted.
However, Mr. Gunawan also sought to remind the various parties present at the training event of the vital need for a third-party Certified Authority (CA), which would have the authority to issue electronic-signature certifications. This CA must satisfy several requirements, such as the requirement to secure certification from the Ministry and the requirement to be 100% fully-owned by domestic parties and therefore not open to Foreign Direct Investment (FDI). In the future, a single certified electronic signature could thus end up being used for all kinds of services.
“A signature guarantees the identity, content integrity, and uniqueness of its owner. Therefore, the P12 file must never be given to any other party, because any usage must be registered under the name of its original owner,” Mr. Gunawan concluded.
(rfs/sp)
Marcell Sihombing, Fathan Qorib
Hukumonline's Training Event Entitled Legal and Technical Aspect of the Organization of Internet-Based Banking Service. Photo by: RES
The Ministry of Communications and Information Technology (Ministry), acting on behalf of the government, is currently continuing its deliberations of the Draft Ministerial Regulation on Private Data Protection for Electronic Systems (Draft Regulation). These ongoing deliberations were revealed by Teguh Arifiyadi, Chairman of the Indonesia Cyber Law Community (ICLC) at a Hukumonline training event entitled Legal and Technical Aspects of the Organization of Internet-Based Banking Services (Digital Banking), which was held in Jakarta on Wednesday, 18 May 2016.
According to Mr. Arifiyadi, the various provisions set out in the Draft Regulation adopt the self-regulation model (commonly referred as “safe harbor principles”) which has been implemented in the US, as well as many European countries. This self-regulation model, as implemented by the US, defines the matter of privacy protection subjectively, meaning that the level of protection offered should fully conform to what each individual expects from any so-called framework of privacy protection.
“In the US, there are only two methods through which a party can relinquish their privacy. Either the person themselves can voluntarily reveal their personal information to the public, or another party can intentionally publicize a person’s private information without any permission first being granted.
However, it should be stressed that the self-regulation model currently being implemented across many European countries differs slightly from that of the US. Most European countries mandate that users can personally manage and control all kinds of private data, including data which is either directly or non-directly related to the user in question.
Mr. Arifiyadi further explained that any collection of private data must be specific, explicit, and used for lawful purposes, as well as being both accurate and up-to-date (should these criteria apply). Additionally, users are responsible for drawing up documents outlining written consent which allows the use of his/her private data for purposes other than those stipulated under prevailing laws.
“The European model is thus tighter than that employed by the US,” asserted Mr. Arifiyadi.
Similar to the US and European model in many ways, the current Draft Regulation mandates for the regulation of accurate data collection and procurement procedures, as well as mandatory written consent, the confidentiality principle (unless regulated otherwise under prevailing laws), the right to modify any submitted data, verification procedures for data owners, and the use of the Indonesian language.
All data processing and analyses must comply with the initial purposes behind the collection. Such data will also be held for a period of five years according to the provisions set out in Law No. 43 of 2009 on Archiving. Moreover, all collected data must be stored on Indonesian soil.
“The display, publicizing, transfer, and dissemination of any private data can only be achieved after written consent has been secured [from its owner], unless specifically regulated otherwise under prevailing laws and regulations,” Mr. Arifiyadi emphasized.
The Draft Regulation also incorporates provisions which relate to the various rights of private-data owners, including the right to erase, modify, renew, or withdraw data, as well as the right to file a complaint against the use of his/her data. The Draft Regulation also regulates the obligations of electronic-systems organizers, such as the obligation to obtain relevant electronic-systems certification, the obligation to ensure data confidentiality and the obligation to notify data owners in writing should any data breach occur, explaining that they can file a complaint while outlining the sufficient reasons for doing so, as well as identifying any possible potential losses.
Electronic Signatures
Riki Arif Gunawan, Head of the Sub-Directorate for Information Security at the Ministry, also ventured an opinion on this issue during the recent training event. During his address, Mr. Gunawan sought to emphasize the importance that electronic signatures are predicted to play during the upcoming digital banking era, and expressed his hope that all bank customers would ultimately take possession of their own personal electronic signatures.
“The regulation covering this matter [electronic signatures] is currently being deliberated. In the future, all individuals will be required to submit a P12 file [containing verified electronic signatures] so that they can be verified [as the owner of their own electronic signature],” Mr. Gunawan asserted.
However, Mr. Gunawan also sought to remind the various parties present at the training event of the vital need for a third-party Certified Authority (CA), which would have the authority to issue electronic-signature certifications. This CA must satisfy several requirements, such as the requirement to secure certification from the Ministry and the requirement to be 100% fully-owned by domestic parties and therefore not open to Foreign Direct Investment (FDI). In the future, a single certified electronic signature could thus end up being used for all kinds of services.
“A signature guarantees the identity, content integrity, and uniqueness of its owner. Therefore, the P12 file must never be given to any other party, because any usage must be registered under the name of its original owner,” Mr. Gunawan concluded.
According to Mr. Arifiyadi, the various provisions set out in the Draft Regulation adopt the self-regulation model (commonly referred as “safe harbor principles”) which has been implemented in the US, as well as many European countries. This self-regulation model, as implemented by the US, defines the matter of privacy protection subjectively, meaning that the level of protection offered should fully conform to what each individual expects from any so-called framework of privacy protection.
“In the US, there are only two methods through which a party can relinquish their privacy. Either the person themselves can voluntarily reveal their personal information to the public, or another party can intentionally publicize a person’s private information without any permission first being granted.
However, it should be stressed that the self-regulation model currently being implemented across many European countries differs slightly from that of the US. Most European countries mandate that users can personally manage and control all kinds of private data, including data which is either directly or non-directly related to the user in question.
Mr. Arifiyadi further explained that any collection of private data must be specific, explicit, and used for lawful purposes, as well as being both accurate and up-to-date (should these criteria apply). Additionally, users are responsible for drawing up documents outlining written consent which allows the use of his/her private data for purposes other than those stipulated under prevailing laws.
“The European model is thus tighter than that employed by the US,” asserted Mr. Arifiyadi.
Similar to the US and European model in many ways, the current Draft Regulation mandates for the regulation of accurate data collection and procurement procedures, as well as mandatory written consent, the confidentiality principle (unless regulated otherwise under prevailing laws), the right to modify any submitted data, verification procedures for data owners, and the use of the Indonesian language.
All data processing and analyses must comply with the initial purposes behind the collection. Such data will also be held for a period of five years according to the provisions set out in Law No. 43 of 2009 on Archiving. Moreover, all collected data must be stored on Indonesian soil.
“The display, publicizing, transfer, and dissemination of any private data can only be achieved after written consent has been secured [from its owner], unless specifically regulated otherwise under prevailing laws and regulations,” Mr. Arifiyadi emphasized.
The Draft Regulation also incorporates provisions which relate to the various rights of private-data owners, including the right to erase, modify, renew, or withdraw data, as well as the right to file a complaint against the use of his/her data. The Draft Regulation also regulates the obligations of electronic-systems organizers, such as the obligation to obtain relevant electronic-systems certification, the obligation to ensure data confidentiality and the obligation to notify data owners in writing should any data breach occur, explaining that they can file a complaint while outlining the sufficient reasons for doing so, as well as identifying any possible potential losses.
Electronic Signatures
Riki Arif Gunawan, Head of the Sub-Directorate for Information Security at the Ministry, also ventured an opinion on this issue during the recent training event. During his address, Mr. Gunawan sought to emphasize the importance that electronic signatures are predicted to play during the upcoming digital banking era, and expressed his hope that all bank customers would ultimately take possession of their own personal electronic signatures.
“The regulation covering this matter [electronic signatures] is currently being deliberated. In the future, all individuals will be required to submit a P12 file [containing verified electronic signatures] so that they can be verified [as the owner of their own electronic signature],” Mr. Gunawan asserted.
However, Mr. Gunawan also sought to remind the various parties present at the training event of the vital need for a third-party Certified Authority (CA), which would have the authority to issue electronic-signature certifications. This CA must satisfy several requirements, such as the requirement to secure certification from the Ministry and the requirement to be 100% fully-owned by domestic parties and therefore not open to Foreign Direct Investment (FDI). In the future, a single certified electronic signature could thus end up being used for all kinds of services.
“A signature guarantees the identity, content integrity, and uniqueness of its owner. Therefore, the P12 file must never be given to any other party, because any usage must be registered under the name of its original owner,” Mr. Gunawan concluded.
(rfs/sp)