Indonesian Law Perspective on Government Surveillance

Government surveillance has been a prevailing controversial issue persisting for decades that threatens the privacy rights of ordinary people. Massive innovation in information and communication technology that has brought enormous benefits to our everyday lives can also be a tool to extract valuable data about our behaviors and activities online. Our computers, mobile applications and smartphones can be considered valuable asset for the government to spy on all of us.

Recently, France’s National Assembly have passed a bill that included a provision which permits the law enforcement to surveil suspects by remotely activating cameras, microphones and GPS location systems on phones and other devices through the use of spyware for their investigation.1 If not contained by France’s existing laws, the government spyware usage might lead to further covert and unfettered surveillance that will undermine citizen’s privacy.

Generally speaking, government surveillance is conducted on the basis of national security and defense and must be balanced against privacy rights of citizens. In Indonesia, there exists laws and regulations that regulate surveillance where government interception of communication is permitted only in specific circumstances. For instance, under Indonesia’s Telecommunication Law, communication interception is prohibited by any party and is only allowed to investigate crime2 where telecommunication service providers may provide information to the general attorney, investigators and/or the chief of Indonesian National Police accordance with applicable law.3

Under the Electronic Information and Transaction Law, the use of any personal data through electronic media without the consent of that personal data owner is prohibited, unless otherwise stipulated by laws and regulations.4 However, the Electronic Information and Transaction Law allows interception of electronic data carried out within the framework of law enforcement at the request of the police, prosecutors or other institutions according to the law.5

The Indonesian national police force conducts wiretapping of electronic data based on the Chief of National Police of Indonesia Regulation Number 5/2010 on the Procedure for Wiretapping at the Police Monitoring Center (“National Police Reg 5/2010”). Communication interception under National Police Reg 5/2010 is restricted only to conduct preliminary investigation, investigation, prosecution and examination of criminal acts.6 The national police force will commence the wiretapping after obtaining approval from the head of the district court that has jurisdiction over the location of where the wiretapping operation will be carried out.7

For the intelligence agency, Law Number 17 of 2011 on State Intelligence (“State Intelligence Law”) grants the State Intelligence Agency the authority to conduct wiretapping and extract information only to people that conduct, based on sufficient evidence, the following:

• Activities that threaten national interests and security including ideology, politics, economy, social, culture, defense and security, and other sectors of public life, including food, energy, natural resources, and the environment; and/or
• Activities of terrorism, separatism, espionage and sabotage that threaten national safety, security and sovereignty, including those that are currently undergoing legal proceedings.8 The wiretapping operation by the State Intelligence Agency can only proceed after approval by the district court for a duration of 6 months.91. https://www.lemonde.fr/en/france/article/2023/07/06/france-set-to-allow-police-to-spy-through-phones_6044269_7.html 2. Article 40 of Law Number 36/1999 on Telecommunication 3. Article 42 of Law Number 36/1999 on Telecommunication 4. Article 26 of Law Number 19/2016 on Electronic Information and Transaction5. Article 31(3) of Law Number 19/2016 on Electronic Information and Transaction 6. Article 4 of National Police Reg 5/2010 7. Article 6 of National Police Reg 5/2010 8. Article 31 of State Intelligence Law9. Article 32 of State Intelligence

Similarly, Indonesia’s Law Number 15 of 2003 as amended by Law Number 5 of 2018 on Eradication of Criminal Acts of Terrorism (“Eradication of Criminal Acts of Terrorism Law”) permits security officials to intercept any conversation by telephone or other means of communication suspected of being used to prepare, plan, and commit a criminal act of terrorism after receiving approval from the head of the district court whose jurisdiction covers the domicile of the security official.10 The interception of communication can only be conducted for 1 year.11 The amended version of the Eradication of Criminal Acts of Terrorism Law allows investigators to intercept communications in advance against people who are strongly suspected of preparing, planning and/or committing acts of terrorism before obtaining court approval in urgent situations. Court approval is obtained within a maximum 3 days after the interception.12

In other circumstance, Indonesia’s Law Number 30 of 2002 as amended by Law Number 19 of 2019 on Corruption Eradication Commission (“Corruption Eradication Commission Law”) allows wiretapping of electronic devices by the Corruption Eradication Commission to conduct preliminary investigation, investigation and inquiry into crimes of corruption.13 Electronic interception can only be initiated for a duration of 6 months maximum by heads of the Corruption Eradication Commission after permission from the Supervisory Board is obtained.14 Data obtained from the electronic interception must remain classified and are only accessible for the court to adjudicate corruption cases.15 Any data that are not relevant to the crimes of corruption obtained by the Corruption Eradication Commission must be deleted and destroyed.16

In late 2022, the Indonesian government released its first major comprehensive data protection law called Law Number 27/2022 on Personal Data Protection (“Personal Data Protection Law”) that grants the rights of personal data subjects to request termination processing, delete and/or destroy personal data about the personal data subject in accordance with statutory provisions and to withdraw the consent to process personal data.17 These rights can only be waived when processing of personal data are conducted for national defense and security, law enforcement purposes and public interest of administering the state among others.18

Therefore, based on these aforementioned laws and regulations, any unauthorized surveillance of individuals through electronic devices by entities including the government is prohibited and wiretapping of electronic device is limited for security and law enforcement purposes to prevent crime and terrorism by the police force, prosecutors and/or other institutions mandated by law and wiretapping operation can only commence after court approval is obtained.

It remains to be seen whether Indonesia will enact legislation is similar to France’s justice reform bill in the near future. If Indonesia plans to enact a similar legislation, it must remain congruent with Indonesia’s existing laws and regulations. However, considering that spywares are now capable of remote access to smartphones without the users’ action through ‘zero-click’ attack, covert governments surveillance is becoming more advanced and we are still a long way before we can adequately address this issue.

10. Article 31(2) of Eradication of Criminal Acts of Terrorism Law

11. Article 31(3) of Eradication of Criminal Acts of Terrorism Law

12. Article 31A of Eradication of Criminal Acts of Terrorism Law

13. Article 12 of Corruption Eradication Commission Law

14. Article 12B of Corruption Eradication Commission Law

15. Article 12D of Corruption Eradication Commission Law

16. Ibid

17. Articles 8, 9, 10 and 11 of Personal Data Protection Law

18. Article 15 of Personal Data Protection Law

Naufal Fileindi, a Partner at GHP Law Firm and an award-winning regional Data Protection and TMT lawyer, leads the firm's digital, personal data, privacy, media group and intellectual property practice group. He has been nominated as the choice counsel by in-house counsels across Indonesia and is known for his creative legal writing and advocacy for promoting the law to the masses. He has acted for leading global and multinational companies on their corporate restructuring, transactions, and advisory work relating to e-commerce, technology and media, data protection, and privacy. In addition to his work in these areas, Naufal handles plantation and forestry, renewable energy, real estate, and employment matters, and has represented several real estate and major plantation companies.

Since 2010, Naufal has been a partner of HukumOnline, Indonesia's largest law media, and is a frequent guest speaker at off-air forums and on radios. He graduated from Universitas Indonesia and was honored as the Best Outstanding Student in 2010. He is a licensed Indonesian lawyer, a member of Peradi, a certified Data Protection Officer, and a Qualified Risk Governance Professional (QRGP).

Industries: Agribusiness and Commodities / Consumer Goods / Media and Entertainment / Real Estate / Technology and E-Commerce

Practice Areas: Corporate and M&A / Commercial Contracts / Employment / Intellectual Property / Data Protection

Rimba Arya Suryodipuro - Associate

Rimba Arya Suryodipuro, an associate at GHP Law Firm in the corporate group. His main practice mostly consists of mergers and acquisition, in bound investments, corporate restructuring, and technology. He has assisted and advised establishments of multiple companies along with its relevant compliance and licenses. He is adept in handling complex corporate restructuring and is the corner stone in the corporate department. Rimba graduated from Universitas Pelita Harapan and is fluent in Indonesian and English.

Practice Areas: Corporate and M&A / Employment / Intellectual Property / Mega Projects and State Owned Enterprises