6. Privacy and Personal Data Protection in Indonesia: The Hybrid Paradigm of the Subjective and Objective Approach

Consumer protection is also governed by GR 80/2019 on E-Commerce. The regulation expressly stated the treatment of personal data as ownership rights (art. 58). It contains the obligation of e-commerce business to store personal data in accordance with the ‘standard of personal data protection’ or ‘developing ordinary business practice’ to the extent these standards and practices conform with the principles laid down under art. 59. The principles of personal data protection under art. 59(2) are as follows: a) legitimate collection; b) purpose limitation; c) data adequacy and relevancy (elaboration of purpose limitation); d) accuracy; e) temporal limitation; f) lawfulness; g) confidentiality, security, and integrity; h) no cross-border personal data transfer shall be made unless the target country declared has an adequate level of protection by the Minister. The relationship between the GR 71/2019 and GR 80/2019 is unique. Although the two regulations are within the same level of the regulatory hierarchy, GR 80/2019 only regulates the e-commerce sector, whereas GR 71/2019 is applicable for all e-system operators. Therefore, GR 80/2019 is only applicable as lex specialis for the e-commerce sector. Consequently, the e-commerce sector shall secure compliance with both regulations. The supervisory authority for GR 80/2019 is the Minister of Trade. Thus enforcement and sanction of personal data violation under this regulation are administered by the Trade Ministry. These non-compliance measures include warning, priority watchlist, blacklist, temporary service blockage, or revocation of permit (art. 80(2)).