Lazada, Tokopedia, and Shopee are not foreign to Indonesians, and to a certain extent can even be categorised as part of the daily life of Indonesians in sourcing their necessities.

As the Indonesian government continues re-shaping its view on the data security and privacy in Indonesia, the regulatory landscape of e-commerce business continues to be developed.

What is considered e-commerce?

Indonesian Trading Laws defines trading as the arrangement or activities in transacting goods and/or services within or outside Indonesia with the objective to transfer the ownership of the goods and/or fulfil the enjoyment of the services in return of a payment or compensation payable to the goods and/or services provider.

Indonesian EIT Law provides scope of trading activities using electronic manners (devices and procedures), known as e-commerce, which include the use of computers, computer networks, and/or other electronic media. E-commerce businesses in Indonesia involve internet commerce, web commerce, and electronic data interchange scheme.

It should be noted that e-commerce entities are not the seller of the goods/services but a mere technology provider who provides the platform for goods/services sellers to deal with the buyers.

Goods/services that can be sold under e-commerce schemes?

There is no specific list of goods/services that can be offered through e-commerce schemes; having said that, the goods/services must not be considered as illegal goods/services. As a general rule of thumb, the selling of the goods/services must be governed by a specific agreement between sellers and buyers to indicate consent of both parties and to meet the cumulative contracting principles under Indonesian Civil Code.

For completeness, it is a common practice within the e-commerce landscape to use standard contract (template document) to establish a relationship/contract between sellers and buyers.

Important regulators relevant to e-commerce entities & foreign ownership limitation

1. Ministry of Investment/Board of Foreign Investment;
2. Ministry of Telecommunication and Communication;
3. Consumer Protection Agencies;
4. Financial Services Regulators – relevant where e-commerce allows offering of financial products (such as insurance coverage as add-on) within its platform.

Under the latest positive list of investment, the Indonesian government has set-up a clear standing where maximum foreign ownership is being removed and replaced with the requirement for foreign investment companies to cooperate with local (Indonesian) business players who are regarded as micro and medium scale (UMKM).

Latest data privacy requirement applicable to e-commerce entities

Data security and privacy requirements have always been seen as the underlying pillars of technology driven business, including e-commerce businesses.

Indonesian EIT Laws compartmentalized and categorized e-commerce entities as an “Electronic System Operator”. Key underlying principles that must be met by the Electronic System Operator in dealing with personal data of anyone having access to its platform/electronic system:

1. maintain the confidentiality, integrity and availability of the Personal Data it manages;
2. guarantee that the acquisition, use, and utilization of Personal Data is based on the approval of the owner of the Personal Data, unless otherwise stipulated by laws and regulations; and
3. guarantee that the use or disclosure of data is carried out based on the consent of the owner of the Personal Data and in accordance with the purposes conveyed to the owner of the Personal Data at the time of data acquisition.

This set of principles is then followed by key principles in collecting and administering personal data.

Having reviewed the recent supplementing regulations of Indonesian EIT Laws and the precedent issued by the Supreme Court of Indonesia (Mahkamah Agung), it appears that the principles to protect the personal data remain to be imposed solely to the e-commerce platform operator (rather than the sellers of the goods/services on the platform), provided always that the sellers’ scale of business fall within a non-material scale (commonly known as home industry).

This imposes material onus to the e-commerce platform operator to ensure it has sustainably compliant processes, policies, guidelines, and procedures to handle the end-to-end process of collection and administration of personal data.

To date, MNP has had the chance to assist the following establishment of guidelines and procedures applicable to e-commerce operators:

1. Privacy notice
2. Guidelines in handling request of change/deletion/modification of personal data
3. Policies in handling complaint in relation to the use of personal data
4. Guidelines in handling complaints before regulatory authority
5. Rules and procedures in escalating complaints handling
6. Release of liability following deletion/removal of a specific personal data.

As we continue to build our privacy practice, MNP welcomes any opportunity to assist e-commerce operators in shaping their approach towards compliance to data privacy and security regulatory requirements.

————-III————-

MURZAL & PARTNERS

For more information, please reach us at Murzal & Partners Law Firm via:

e-mail: [email protected]
Tel: +62 21 29930869
WhatsApp: +62 81211122884

LinkedIn: Murzal & Partners Law Firm

www.murzallawfirm.com

A member of World Law Alliance

Disclaimer:
The foregoing material is the property of MNP and may not be used by any other party without prior written consent. The information herein is of general nature and should not be treated as legal advice, nor shall it be relied upon by any party for any circumstance. Specific legal advice should be sought by interested parties to address their particular circumstances.

Any links contained in this document are for informational purposes and are available and relevant at time this publication is made. We provide no liability whatsoever in respect of any information or content in such links.