Why a privacy law is needed

LAST year was a banner year for the exposure of personal information, and the lesson learned is that Indonesia needs to adopt a privacy law this year.

The cyberattacks on state institutions, from website defacements to data breaches, happened during the coronavirus pandemic when people relied more on digital technology but without proper regulations protecting their personal data.

One notable incident was detected in May last year, when an account with the username Kotz on hacking forum RaidForums claimed to have the personal information of over 200 million policyholders of the national health insurance (JKN) programme, both dead and alive.

Kotz initially provided a link to three separate file-sharing websites on which data on two million people could be downloaded as a sample, but later deleted the post and denied having offered to sell the data.

The Communications and Information Ministry found indications that the data was identical to that of the JKN’s database because it contained personal information such as policy numbers and premium payment statuses.

The ministry blocked access to RaidForums after finding that at least 100,000 entries were valid.

The ministry also summoned the board directors of the Health Care and Social Security Agency, which manages the JKN programme, to coordinate its investigation with the ministry and the National Cyber and Encryption Agency.

It was the second massive breach detected in Indonesia after the personal information of up to 91 million users of Indonesian e-commerce platform Tokopedia was stolen and offered for sale in May 2020.

Experts were quick to call on policymakers to pass the long-awaited data protection Bill, which is expected to require any entities processing and managing personal data to protect against illegal use of personal data.

Yet its deliberation has been slow while data breaches continued to happen last year, including one that centred on personal information on the now-defunct electronic Health Alert Card (eHAC) system in August 2021, which jeopardised 1.3 million eHAC users.

Critics say the repeated cyberattacks on state agencies indicate that the government has a weak awareness of data security and no certain steps to improve it.

Institute for Policy Research and Advocacy executive director Wahyudi Djafar said this underscored the need to pass the data protection Bill.

The Bill, drafted and proposed by the government in 2014, has been listed as a priority this year, but its deliberation has been delayed several times. — The Jakarta Post/ANN