The relevant laws/regulations governing data protection are:
a. Law No. 11 of 2008 concerning Electronic Information and Transaction, in particular Article 26.
b. Government Regulation No. 8 of2012 concerning Electronic System and Transaction Operation
It should be noted that data protection under the above instruments are in the context of regulating operation of electronic systems/transactions. (a) is an Act of Parliament while (b) is a subsidiary regulation.
The basic requirement is that the party collecting data needs to secure the consent of the data subject in respect of the intended use of the data.
The only provision on data protection in the EIT law is Article 26.
Article 26 of EIT Law
(1) Unless provided otherwise by Rules, use of any information through electronic media that involves personal data of a Person must be made with the consent of the Person concerned.
(2) Any Person whose rights are infringed as intended by paragraph (1) may lodge a claim for
damages incurred under this Law.
Elucidation of Article 26 of EIT Law
In the utilization of Information Technology, personal data shall be a part of the privacy rights to be protected. Privacy rights shall contain the following meaning:
a. A privacy right shall be the right to enjoy personal life and be free from any disturbance.
b. A privacy right shall be the right to communicate with other Persons without surveillance.
c. A privacy right shall be the right to inspect access to information about personal life of and data on individuals.
The elucidation (which is considered as part of the law) clarifies the rights of the data subjects.
Essentially, consent of the data subject is required in respect of use of the data intended by the client.
Given that the party's ability to use personal data is based on consent from the data subjects, it is recommended that the the privacy policy also provide for the data subject's consent to the transfer of data. Where the destination system is under the control of a different entity, it is unclear if the original consent can extend to the new entity.
In 2012, the government issued government Regulation 82 of2012 concerning Electronic Systems and Transaction Operation (GR 82/2012) purportedly to implement certain provisions of the EIT Law.
The relevant provisions on data protection of GR82/2012 are set out below
15. Electronic System Operator shall:
keep the confidentiality, integrity, and availability of Personal Data are managed;
ensure that the acquisition, use, and utilization of Personal Data are based on approval from the owner of Personal Data, unless otherwise provided by laws and regulations; and
ensure the use or disclosure of the data is based on approval from owner of such Personal Data, and in accordance with the purpose mentioned to the owner of Personal Data on the data acquisition.
(2) If there is a failure in the confidentiality protection of Personal Data that are managed, Electronic System Operator shall notify in writing to the owner of those Personal Data.
(3) Further provisions on the guidelines for Personal Data protection in Electronic Systems as referred to in paragraph (2) will be governed by Ministry Regulation.
Article 15 of GR82/2012 Regulation does not really add much to Article 26 of EIT law other than the requirement to notify the data subject in writing in the event that there is any "failure in the confidentiality protection of personal data".
GR82/2012 contains rather onerous requirements such as the need for electronic system operators for public (which includes most E-commerce merchants) to be registered (Article 5), obtain "electronic systems capability certificate", registration of software used by the electronic system operator (Article 7). To date, the Ministry of Communication and Informatics has issued regulation 36/2014 discussed above.