Indonesia’s censorship and tight internet regulation mission continue with the implementation of the ministry of communication and informatics’ Ministerial Regulation no. 5/2020 on Private Electronic System Operators (PSE).
Previously, the government had banned several popular online services by blocking internet access to their sites such as payment service Paypal, several gaming services and sites such as Steam, Epic Games and Origin for not registering their service on the government’s website. The policy sparked outrage over freelancers since they could not receive payment through PayPal or unable to transfer their funds to their bank account.
The regulation applies to both local and international tech companies operating in Indonesia across all industries, including overseas gaming companies, social networking companies, financial companies and others. If the service is offered online, the regulation applies to them.
The registration requirement may increase fairness in terms of tax concerns by international tech companies, as many of them have yet to contribute to the country’s tax income. It might also help the local game industry by encouraging higher-quality games between local and foreign game businesses and funding internship opportunities at large game studios.
Take example of what Spotify did with the local music industry. The company expands its service to locals, giving independent and small musicians a platform to publish and earn revenue from their music, enabling regional pricing for a more affordable subscription price and opening partnerships with other local companies.
Beyond local business
However, the purpose of the regulation does not stop at taxes and local opportunities. The regulation mandates a lot of things. Two major issues that foreign companies and investors should worry about are private data policy and content moderation policy.
For private data, companies will be required to provide the government access to their users’ data. This regulation may violate the rights towards data protection, especially towards foreign companies, considering different companies from different countries have different private data policies.
For content moderation policy, companies are required to follow the government’s request to take down notice on several contents that “disturb public order” such as social media posts with several urgency, the shortest one being within four hours of take down request. Companies that failed to comply are prone to lawsuits and fine up to US$ 33,000 per violation. However, there is no further information on what classifies as content that “disturb public order”.
Authority on information
Indonesia is infamous for its internet censorship. There was a case where Internet access was cut off in several regions by the government. One notable case was when the internet was cut in Papua in mid-2019 for two weeks following massive protests in several areas such as Fakfak, Sorong, Manokwari and Jayapura.
Popular online services – such as Facebook, Twitter, WhatsApp, Instagram and the previous companies that were banned like Paypal and Steam – have since registered their services on the government’s system. At a first glance, this might be good news for users as they can use the online services without fear of access being blocked by the government. However, these popular online services must now abide the government regulation, especially concerning private data policy.
Private data leakage
Other than the fact that private user data can now be accessed by the government’s request, the security of the accessed private user data itself is another concern. Over the weeks, there have been private data leaks where a significant amount of Indonesian ID numbers along with its address, phone numbers and other personal information, including several public servants’ data, were leaked and freely sold online with a free two million data samples in an underground online forum.
The information ministry refuses to take responsibility and responded that data protection is not part of its task and instead forward the responsibility to National Cyber and Encryption Agency (BSSN). In addition, information minister Johnny G. Plate asked that the PSE should have an encryption system, along with informing the local community to protect their private data.
“We must always change the one time password (OTP) so that we can keep our data from being breached,” he said in Bali on September 3, 2022.
Private tech companies and investors who wish to invest and innovate in tech in Indonesia must be aware of what the regulations entail and its risks. For now, the government only implements a blacklist system on popular online services that did not comply the regulation. However, the government plans to create a whitelist system that mirrors China’s great firewall system through its national DNS (domain name system) program.
