Introduction
Under the provisions of Article 87 of Law Number 12 of 2011 on Formation of Legislation which was last amended by Law Number 13 of 2022 on Second Amendment to Law Number 12 of 2011 on Formation of Legislation which essentially regulates that a law comes into force since it was promulgated, hence since 17 October 2022, Law Number 27 of 2022 on Personal Data Protection (“PDP Law”) has been legally valid in Indonesia.
In the PDP Law, it has been regulated regarding the existence of an agency that has the function to supervise and enforce personal data protection laws in accordance with the PDP Law. The existence of a special agency that was formed to carry out supervision and law enforcement related to certain objects in a previous law also existed in other fields such as the National Narcotics Agency (Badan Narkotika Nasional, “BNN“) to carry out supervision and law enforcement related to narcotics, the Corruption Eradication Commission (Komisi Pemberantasan Korupsi, “KPK“) to carry out supervision and law enforcement related to eradicating criminal acts of corruption, or the Business Competition Supervisory Commission (Komisi Pengawas Persaingan Usaha, “KPPU”) to carry out supervision and law enforcement related to unfair business competitions.
Discussion
Article 58 of the PDP Law states that the implementation of personal data protection is carried out by an agency established by the President and is responsible to the President. Furthermore, Article 58 paragraph (5) of the PDP Law stipulates that further provisions regarding the existence of this agency are regulated in a Presidential Regulation.
Comparing the existence of KPK and KPPU as supervisors and law enforcers, the author found differences regarding the basis for establishing these agencies. KPK was established through a separate law from Law Number 31 of 1999 on Corruption Eradication, while KPPU was established under Law Number 5 of 1999 on Prohibition of Monopolistic Practices and Unfair Business Competitions and a Presidential Decree. The same applies to BNN which was established under Law Number 35 of 2009 on Narcotics and a Presidential Regulation.
Then related to the authority they have, under Article 60 of the PDP Law, personal data protection agency has the authority to make policies in the field of Personal Data Protection in connection with monitoring and enforcement of the PDP Law, including receiving complaints and carrying out inspections and tracing in the event of alleged violations of the PDP Law, including summoning and requesting information from related parties suspected of committing violations, asking for expert opinions, requesting information, data, statements and documents related to alleged violations of the PDP Law. The PDP Law also has the authority to enforce administrative law, which means it has the right to impose administrative sanctions in the event of a violation of the PDP Law.
If we look at the authorities that have been determined, it is known that the personal data protection agency has the authority to enforce the law administratively, such as making policies and imposing administrative sanctions, which are preceded by an initial examination in the event of an alleged violation of the PDP Law, either originating from a complaint or as a result of supervision carried out. The authority possessed is similar to that of the KPPU in terms of supervising and enforcing laws related to business competitions. Apart from KPPU, the authority to make and implement policies in their respective fields also belongs to BNN, as Article 70 item a of Law Number 35 of 2009 on Narcotics.
With regard to the authority to enforce the law criminally, when compared to BNN and KPK, there is a very clear difference because BNN and KPK have the authority to enforce the law criminally in accordance with the provisions of the Criminal Procedure Code (Kitab Undang-Undang Hukum Acara Pidana, KUHAP), including carrying out preliminary investigation and investigation of criminal acts by coercive measures, while the personal data protection agency does not have this authority. The authority of personal data protection agency in criminal law enforcement is only limited to assisting law enforcement officials as stipulated in Article 60 item d of the PDP Law.
In the event that an alleged criminal act on Personal Data is found by the agency during the examination process, given that there is no authority to conduct an investigation in the PDP Law, the personal data protection agency is obliged to submit documents related to the alleged criminal act of Personal Data to law enforcement officials. Apart from not being accommodated by investigations and coercive efforts by agency, the delegation of criminal handling of Personal Data to law enforcement officials is also a form of exercising agency authority in accordance with Article 60 item d of the PDP Law.
Regarding the implementation of the authority possessed, the PDP Law does not explicitly stipulate legal consequences in the event of a refusal to examine Every Person and/or Public Agency in connection with alleged violations of the PDP Law. This is different from the implementation of examination by KPPU where the business actors being examined are prohibited from refusing, therefore, when a refusal occurs, KPPU may refer the examination process to be investigated by investigators. According to the author, even though the PDP Law does not stipulate consequences in the event of a refusal, personal data protection agency can apply for legal assistance to the prosecutor’s office in the event of an inspection refusal. Legal assistance to the prosecutor’s office can also accommodate the implementation of administrative sanctions given by the agency to people and/or public agencies who violate the PDP law.
With the provisions in the PDP Law mandating an agency in the field of Personal Data to be established under a Presidential Regulation, it is worth waiting to see whether the Presidential Regulation adds to the authority of the agency so that it has the authority to investigate or only reinforces the authority it currently has. Then, according to the author, it is necessary to further regulate the authority of the agency, particularly the authority to assist law enforcement officials in accordance with Article 60 item d of the PDP Law with the aim that there is no overlap of authority.
