A comparison of cybersecurity regulations: Indonesia

As the world grapples with rampant cyberattacks, policymakers in the region have toughened their data security measures and business compliance is crucial

Various Indonesian government agencies and businesses are considering an emerging futuristic technology called the metaverse, a portmanteau of “meta” (meaning beyond) and “universe”, which promises to dramatically advance social connectivity via the internet, boosting virtual 3-D experiences from tourism and cultural exploration to interactive banking, consumer sales, office communication, education and daily life.

One especially controversial aspect of this gradual convergence of digital and physical worlds, however, is its requirement for the collection of biometric data used as personal identification to bring out the individual’s natural character in this virtual metaverse. But the acquisition of biometric data is a sensitive issue, given its inherent vulnerability to potential threats, while Indonesia’s regulatory framework is limited with personal data protection and safeguarding against cyberattacks.

In this article, the authors discuss the existing framework and long-awaited Law No. 27 of 2022 on Personal Data Protection Law (PDP Law) recently came into force in Indonesia, and whether a more specific regulation on biometric data is needed in anticipation of the metaverse evolution.

The pandemic encouraged many enterprises to reconsider how to carry out their businesses more effectively. Not surprisingly, many turned online using digital meeting platforms such as video-conferencing, webinars and many other forms of internet communication. However, despite certain clear benefits, these also had limitations that are considered somewhat confining compared to more flexible experiences in the real world. Hence the metaverse emerged, bridging the metaphysical gap to answer those problems, offering real-life experiences in a virtual world through a replica of the physical realm where parties can more effectively socialise, attend meetings and participate in events through avatars representing themselves without a physical presence.

In Indonesia, as elsewhere, this metaverse provides many opportunities to improve and encourage the national economy and stakeholders have already begun to explore this virtual world to advance their business activities. Bank Rakyat Indonesia, one of the largest state-owned banks, has signed a memorandum of understanding to develop a metaverse ecosystem. This could, for example, provide new experiences and opportunities for customers to access virtual banking services. At the same time, although there would be costs in development, metaverse businesses could also reduce the cost of building physical offices.

Meanwhile, Indonesia’s Minister of Tourism and Creative Economy recently signed a collaborative plan to launch the “WonderVerse”, a metaverse platform to promote Indonesian tourism globally, with virtual space for local businesses to market their products virtually.

The metaverse is still emerging and evolving, and is far from the finished article. Development is at an early stage and even tech companies competing to create optimum ecosystems are still only forming a picture of what the completed metaverse will look like. While there are many ways to participate in the virtual world, one sensitive drawback already is uniformity of access. Submitting various kinds of data required to register user profiles, including biometric data, to ensure only authorised parties can access the system.

Although biometric data for identification is considered more secure than the password-based method, it remains very sensitive and high-risk, potentially exposing someone’s profile and characteristics vulnerable to cyber threats. There are many ways to hack biometric data, whether via cyberattack through an IT system or simply insider threats due to the level of access, and many other possibilities. For example, a high-resolution digital photo could be used to manipulate a face recognition system.

Articles 27 and 28 of the PDP Law legally require personal data controllers to perform personal data processing only in a limited and specific manner that is legally valid and transparent. This means that collection of personal data must be limited in accordance with its purpose of processing and explicitly determined at the time of collection.

Processing must be conducted in accordance with the applicable laws and regulations, and data subjects should be fully aware of how their personal data will be processed. In addition, article 34 emphasises that personal data controllers must also assess the impact on personal data protection if the data processing is considered high-risk to the subject.

Under article 58, the government takes the role of implementing the protection of personal data in accordance with the law through the establishment of a data protection institution that will be directly appointed by (and responsible to) the president. This institution will be mandated to carry out the formulation and stipulation of policies and strategies for personal data protection, supervision, administrative law enforcement, and facilitating dispute resolution outside the courts.

In short, the PDP Law formulates far more significant policies than before, where corporations will be subject among other things to hefty fines of up to 2% of annual income or revenue for failure to notify the data subject and authority on a data breach within 72 hours. While some may argue the 2% fine is considered low for large corporations, given the sensitive nature of biometric data, businesses should anticipate and be ready for this very short notification period compared to the previous 14 days’ notice.