Approval of the Revised PSTE Government Regulation: The Jokowi Administration Is Inconsistent

JAKARTA, October 17, 2019 – We, the Indonesia Data Center Provider Organization (IDPRO), the Indonesian Cloud Computing Association (ACCI), the Indonesian Internet Service Providers Association (APJII), the Indonesian Information Technology Federation (FTII), the Indonesian Telematics Software Association (ASPILUKI), Indonesia ICT Institute, as well as the umbrella organization for Indonesia’s ICT sector, the Indonesian Telematics Society (MASTEL), feel it necessary to submit our response to the draft revision of Government Regulation No. 82 of 2012 (PP PSTE), specifically the version dated August 2, 2019, which we obtained from the Public Information Disclosure Office (PPID) of the Ministry of Communication and Information Technology.

After reviewing the draft, we conclude that the content of the draft revision to PP 82/2012 is in direct conflict with the messages conveyed by President Ir. H. Joko Widodo in various state and presidential addresses, specifically in:

1. The State of the Nation Address on August 16, 2019, in which the President stated that data constitutes a new form of national wealth, now more valuable than oil. “We must remain vigilant against the threat of cybercrime, including data misuse. Data is a new form of wealth for our nation; today, data is more valuable than oil; therefore, data sovereignty must be realized, and citizens’ rights to their personal data must be protected. Relevant regulations must be prepared immediately; there can be no compromise.”
2. In his opening remarks at the Palapa Ring inauguration on October 14, 2019, President Jokowi urged his officials to exercise caution in addressing the negative aspects of the digital age. This is because the presence of digital technology can be exploited by other countries to gauge the extent of business opportunities in Indonesia. The President also reminded the public to be vigilant because, at present, apps originating from other countries have been secretly collecting data from the Indonesian public with the aim of understanding the behavior of Indonesians as a market/consumer base for products from those other countries. The President firmly stated: “We must not allow our data—our consumer preferences and market trends—to be known by other countries, so that they can flood us with products tailored to our preferences. “Be on guard against this,” the President emphasized.

The contradiction between the content of the Draft Amendment to Government Regulation No. 82/2012 and the President’s directive to protect the data of the Indonesian public lies in Article 21, paragraph (1), which reads:

“Private-Sector Electronic System Operators may manage, process, and/or store Electronic Systems and Electronic Data within the territory of Indonesia and/or outside the territory of Indonesia.”

Given the wording of the above clause, the result will be that the state will be unable to protect “our data” (the data of the Indonesian public) because the government is giving the green light to private-sector electronic system operators and applications originating from other countries to store data outside Indonesian territory—which means the content of the Revision to Government Regulation No. 82/2012 is in direct conflict with the President’s directive.

Other implications of granting permission to Private-Sector Electronic System Operators to process and store data outside of Indonesia’s territory are as follows:

1. There is a 90% likelihood that data in Indonesia will flow outside of Indonesia’s territory; this will have a major impact on Indonesia’s political, economic, social, cultural, and security aspects in the era of the data economy, given that Indonesia currently lacks adequate data protection regulations. This represents a major setback for Indonesia; at a time when developed nations are implementing strict data protection measures within their own borders—such as the European Union through the EU GDPR—we are instead relaxing regulations without any protection whatsoever.
2. By allowing private-sector Electronic System Operators to process and store data outside Indonesia, foreign providers of data centers, cloud computing, and OTT (Over-The-Top) services are no longer required to invest in Indonesia because they can already serve the Indonesian public from outside the country—a situation that is highly detrimental economically.
3. Law enforcement will face difficulties if the enforcement process requires data stored outside Indonesia, as each country has its own rules and jurisdiction.

For the reasons outlined above, we hope that President Jokowi can truly fulfill what he stated in his State of the Nation Address, which was witnessed by all Indonesians. We hope the President will not ratify the revision of the PSTE Government Regulation (PP) until it has been amended in accordance with what he has promised to all his people. May President Jokowi, in his next cabinet, select advisors capable of realizing this excellent vision. We look forward to the implementation of President Jokowi’s promise to immediately achieve data sovereignty without compromise.

Quotes from Association/Organization Leaders

“The issue of PP-82 concerns data sovereignty, law enforcement, and, at the same time, the path toward equal treatment in taxation. The government should be the one more concerned with safeguarding this issue. However, the opposite is happening—it is the associations and communities that are actually concerned and have repeatedly reminded the government. IDPRO urges the government to postpone the ratification of this draft because the majority of the ICT community in Indonesia does not yet agree with its contents. Much of the revised text still needs improvement because, in fact, the revision of PP 82/2012 could serve as a pathway to improving Indonesia’s digital economy ecosystem.” (Hendra Suryakusuma, Chairman of IDPRO)

“The revision of Government Regulation No. 82 actually closes the door on opportunities for citizens to obtain data protection. National sovereignty is at serious risk if the revision of Government Regulation No. 82/2012 is enacted without us having adequate data protection regulations.” (Andi Budimansyah, Chairman of FTII).

“We are not opposed to change, because change brings progress. It is the substance of the changes—which we have known from the outset will have negative long-term impacts on a larger scale—that we should avoid. We hope these changes can be reviewed first from a broader perspective and in the interest of the greater good before a decision is made—something we did not feel was the case in the current revision process of Government Regulation No. 82.” (Djarot Subiantoro, Chairman of ASPILUKI)

“Government Regulation No. 82 serves as a guideline for several sectors. To date, this regulation has made many positive contributions, particularly in terms of investment. If revised, the consequences must be carefully considered because such a revision will impact Indonesia’s digital economic infrastructure, which is expected to shift overseas. Australia, Singapore, and the European Union can serve as examples of countries that have implemented policies requiring data centers to be located domestically.” (Heru Sutadi, Executive Director of the Indonesia ICT Institute)