Jakarta, IO – The House of Representatives (DPR) finally passed the long-awaited Personal Data Protection (PDP) bill into law at the plenary session on Tuesday (20/9).
The draft of the law has been discussed since 2016. It consists of 371 problem inventory list (DIM) and 16 chapters and 76 articles. The number of articles in the PDP law has increased by four from the 72 proposed by the government at the end of 2019.
The following are key points of the PDP Law, a reported by CNN Indonesia on Wednesday (21/9).
- Six years imprisonment and a fine of Rp6 billion
Hackers, leakers and users, as well as forgers of personal data, can be sentenced to a maximum of six years imprisonment and/or a fine of up to Rp6 billion. Collecting personal data via illegal channels, be it through hacking, purchases from other parties, can be subject to a maximum sentence of five years imprisonment and/or a fine of Rp5 billion (Article 67(1)). Revealing other people’s personal data can be jailed for four years and/or a maximum fine of Rp4 billion (Article 67(2)). Users of personal data that do not belong to them will face five years imprisonment and/or a maximum fine of Rp5 billion. (Article 67(3)). Forgers of personal data carry a maximum sentence of six years and/or a fine of maximum Rp6 billion. (Article 68)
- 10 times the punishment for corporations
If the accessor, collector, user and forger of personal data is a corporation, according to Article 70(1), a punishment can be imposed on the management, controller, order giver, beneficial owner, and/or the corporation as a whole. The fine is 10 times more than that imposed on individuals. The punishment is a maximum fine of Rp4-6 billion and a maximum imprisonment of 4-6 years. In addition, corporations may be subject to various additional penalties, ranging from confiscation of profits and/or assets resulting from criminal acts, freezing of all or part of the corporation’s business, and permanent prohibition from conducting certain activities. All or part of the place of business and/or corporate activities may be shut, carrying out its obligations, and paying compensation. Their license may also be revoked.