On 5 December 2023, the House of Representatives of the Republic of Indonesia (Dewan Perwakilan Rakyat or “DPR”) finally passed the Law No. 1 of 2024 on the Second Amendment to Law No. 11 of 2008 on Electronic Information and Transactions (“EIT Law”) (“Second Amendment”), which previously has been amended for the first time by Law No. 19 of 2016.

With the objectives of setting out further legal certainty, justice and public interest protection from any disturbance resulting from abuse of Electronic Information, Electronic Document, Information Technology and/or Electronic Transaction; the Second Amendment is amending among other things the following matters:

• Electronic Information and/or Electronic Document that can be used as valid evidence in judicial proceedings;
• foreign Electronic Certification Providers in Indonesia;
• type of services provided by Electronic Certification Providers;
• definition on “proper operation” of Electronic Systems;
• child protection procedures, policies, and sanctions in operating Electronic Systems;
• treatment to high-risk Electronic Transaction;
• international Electronic Contract made by Electronic Certification Providers;
• addition of Government’s responsibility;
• addition of authority of Civil Servant investigator; and
• addition of prohibited actions in Electronic Information and Transactions.

Below are several provisions of the Second Amendment that we think noteworthy to be highlighted.

Foreign Electronic Certificate Providers must have legal presence in Indonesia

Under the new regime of the Second Amendment, a foreign Electronic Certification Provider must have legal presence in Indonesia in the form of an Indonesian legal entity, domiciled in Indonesia. A Foreign Electronic Certification Provider may be exempted from such a requirement, if the services it provides through the Electronic Certificate are not yet available in Indonesia. Details on implementing the above are to be set out further in a Government Regulation.

Previously, the EIT Law allowed a foreign Electronic Certification Provider to operate in Indonesia without any legal presence, so long it has been registered. However, there was no clear guidance or implementing regulations as to how and to whom such a registration ought to be made.

Type of services that can provided by Electronic Certificate Providers

Through the Second Amendment, the Indonesian government has now explicitly provided the types of services that may be carried out by an Electronic Certification Provider, namely: Electronic Signature; Electronic Seal; Electronic Timestamp; Registered Electronic Delivery Services; Website Authentication; Preservation of Electronic Signatures and/or Electronic Seals; Digital Identity; and/or other services that use Electronic Certificates. The provisions of such services are to be further set out in a Government Regulation.

Further elaboration on “proper operation” of Electronic Systems

Article 15(1) of EIT Law, provides that “Every Electronic System Operator must operate the Electronic System reliably and safely and be responsible for the proper operation of the Electronic System”.

The Second Amendment, in the elucidation section, has now provided further explanations on what “proper operation” means as in Article 15(1) of EIT Law above. The meaning of "proper operation" is now expanded so to include the Electronic System's ability to comply with or fulfil the governance obligations of Electronic System Operation as regulated in the laws and regulations, in addition to being capable to meet up to its specifications.

Child protection procedures, policies, and sanctions in Operating Electronic Systems

The Second Amendment requires every Electronic System Operator to also provide security and protection of children’s rights when children are using or accessing the Electronic System. Every Electronic System Operator shall prioritize the protection on children rather than the commercial interests in operating the Electronic System.

The security and protection of children’s rights shall include protection on children’s personal data, privacy and personal safety, whether physically, mentally or psychologically from any misuse of Electronic Information and/or Electronic Documents. Electronic System Operator must provide the following matters in carrying out the security and protection of children’s rights:

• information regarding the minimum age limit for children who can use the product or service;
• verification mechanism to identify that the users are children; and
• mechanism for reporting any abuse of products, services and features that may violate or may potentially violate children's rights.

Failure to comply with the above, an Electronic System Operator may be subject to the administrative sanctions in the form of written warning, administrative fines, temporary suspension, and/or termination of Access.

Treatment to high-risk Electronic Transactions

The Second Amendment has now mandated that every Electronic Transaction, that potentially has high risk to the relevant parties, to implement Electronic Signature and secure with Electronic Certificate. High risk Electronic Transactions includes, among other things, financial transactions that are not carried out physically or face to face.

International Electronic Contract Made by Electronic Certificate Providers

The Second Amendment has now mandated that every international Electronic Contract and any settlement of disputes arising between the Electronic System Operator and its users that meets the following descriptions, must be governed by Indonesian laws and regulations:

• the user of the Electronic System Operator's services, as a party to the Electronic Transaction, is originated from Indonesia and gives his/her consent from or within Indonesian jurisdiction;
• the contract is executed within Indonesian territory; and/or
• the Electronic System Operator has a place of business or carries out business activities in Indonesian territory.

An international Electronic Contract must be made using simple, clear and easy to understand Indonesian language, and upholds the principles of good faith and transparency.

Criminal Acts Classified in the Second Amendment

The Second Amendment also conforms to the latest Criminal Law by amending and inserting several clauses in relation to criminal acts, among other things: acts of disseminating any decency violating content, gambling content, content that attacks someone’s honor or good name, threat of violence content, misleading/false content causing losses in an Electronic Transaction and hatred/enmity content. With range of sanctions from two to ten years of imprisonment and/or a maximum fine from four hundred million to ten billion Rupiah.

Remarks

The Second Amendment shall take effect since its enactment, on 2 January 2024, affected companies should comply to the relevant provisions of the Second Amendment before then.

For further information on the subject please contact Andrew Frans (andrew.frans@atamalaw.com) and Charles Lee (charles.lee@atamalaw.com).

ATAMA Law in association with Miura & Partners | 5 January 2024.