Report on the Implementation of the Field Study by the Center for the Promotion of International Economic Partnerships (Indonesia, October 8-12, 2019)
Finished

Report on the field survey conducted by the Center for the Promotion of International Economic Partnerships
(Indonesia, October 8-12, 2019)


1. status of digital regulation: aiming to enact a personal information protection law by the end of 2020

Aggressive digital promotion policy
　In Indonesia, which has the world's fourth largest population, consumer activities driven by the middle class have contributed greatly to economic development in recent years. In particular, the spread of smartphones has spawned a variety of services via apps, including e-commerce, travel arrangements, car dispatch, electronic payment, and investment, and their use is spreading rapidly even in rural areas where people do not have bank accounts. In light of this situation, the Indonesian government is taking a positive stance toward digital promotion in anticipation of the future. Specifically, the government is promoting infrastructure development, including the construction and strengthening of the national information and telecommunications network, and at the same time, it is actively supporting businesses in new fields that utilize digital technology based on the "Making Indonesia 4.0" policy launched in 2018. In addition, under its "Next I Corn" policy, it is also committed to nurturing the next generation of companies that will follow in the footsteps of the leading unicorns Gojek and Traveloka. In addition to the Ministry of Communications and Information (MCIT), the Ministry of Trade (MOT), and other regulatory authorities, the BEKRAF (Creative Economy Agency), which was newly established in 2015 under the current administration, also focuses on the development and promotion of creative new businesses.

Localization regulations eased.
　The reason for this may be that the 2019 Amendment Decree 71 deregulated the domestic storage (localization) obligation, which had previously been a factor in the protectionist image of Indonesia, to cover only public data. This is likely to be one of the reasons for this. On the other hand, in individual industries, Indonesian Financial Services Agency (OJK) Regulation No. 1 (2013) mandates domestic management of certain data held by financial institutions. Combined with the increasing number of data centers and cloud service providers in Indonesia due to the improved telecommunications environment, the impact on business development by firms appears to be minimal.

Enactment of the Personal Information Protection Law
　Indonesia is said to have a high tolerance for the sharing and disclosure of personal information. As a result, the risk of information leakage tends to be underestimated compared to the opportunities to enjoy the benefits of information disclosure, such as the building of human networks and the convenience of daily activities. On the other hand, with the recent spread of smartphones and electronic payments, the harms and risks associated with corporate and personal information leaks are becoming more serious, and the need for corporate and personal information protection is becoming more and more important in industry and among individuals. Currently, there are as many as 32 laws and regulations regarding the protection of personal information, including partial regulations by industry and by subject. In addition to being difficult to understand, many argue that the legal framework for personal information protection is weak because penalties are limited and enforcement by regulatory authorities is not strict. Against this backdrop, the Data Protection Bill (DPL), which stipulates data protection including personal data, is currently under discussion.

　KADIN, which has the largest number of member companies and organizations among industry associations in Indonesia and has a long history, conducts various activities as a bridge between the government and the private sector. KADIN frequently holds events and educational activities on digitalization and the digital industry that transcend industry boundaries, and its committees, consisting of presidents representing various companies, seem to be actively discussing business issues and regulations related to the promotion of the digital sector. Recent issues of interest to member companies include data classification and personal information protection practices.

2. impact on industry and business

Reactions and Responses of Companies to Data Localization
　Government Regulation No. 82 of 2012 imposed the obligation to establish data centers in Japan, but in October 2019, the revised Decree No. 71 was issued, which deregulates the regulation. In this context, the following comments were heard from government agencies, industry associations, and companies (including Japanese companies).

[Claire] Positive feedback.
- The deregulation is welcome, as it allows private companies to store data outside of the country, with the exception of some industries such as finance. This will be especially beneficial for companies newly entering the market. However, many companies that have already established operations in Japan are already using cloud computing and other means to store data in Japan in response to Government Regulation No. 82, so even if the deregulation is relaxed, the number of companies moving their data out of Japan is likely to be limited. (Japanese companies, industry associations)
- This would be desirable for companies that wish to locate their servers outside the country (e.g. Singapore), as there are few data/information analysis specialists in Indonesia. (Japanese companies)
- Indonesia's telecommunications environment has been improving markedly. Furthermore, Indonesia is an island nation with a large market size, so there are significant advantages to setting up a data center in the country. (Government agencies, Japanese companies)

[Claire] Negative.
- OJK regulations on financial businesses are expected to continue, and they will need to continue to store data in Japan. (Japanese companies)
- Domestic cloud services are not internationally competitive, and if storage is allowed overseas, many companies may move their data overseas, which could hurt Indonesia's domestic data center and cloud services businesses. (Local companies)

[Reactions of companies to the Data Protection Bill
　There are as many as 32 laws and regulations related to personal data protection, and in addition to being difficult to understand, the legal framework for personal data protection is weak, with limited penalties and less stringent enforcement by regulatory authorities. The GDPR-based Data Protection Bill is currently being debated in the Diet. The following opinions were heard from government agencies, industry associations, and companies (including Japanese companies).

[Claire] Positive feedback.
- Existing legal regulations are unclear on the rights and responsibilities of data distribution. No regulations exist to hold data processors responsible when problems occur in data distribution. In Europe, the responsibilities of controllers and processors are clearly defined. (Industry associations)
- Among local companies, an increasing number of companies, especially those doing business with Europe and the U.S., are taking measures to protect personal information, wary of the risk of litigation, etc. associated with the GDPR. Since Japanese-affiliated companies are following the lead of their headquarters in adopting the regulation, the impact is expected to be limited. (Japanese companies)

[Claire] Negative.
- It is my impression that the management of Japanese-affiliated companies are aware of the need to protect personal information, but have not yet budgeted the resources to do so. In particular, the manufacturing industry handles only a small amount of personal information, so the cost of complying with strict regulations would be a heavy burden. (Japanese-affiliated company)