Enhancing Data Protection Standards

Since 2014 the Indonesian Ministry of Communication and Informatics (MOCI) has been proposing that the Parliament passes a comprehensive data protection law. A first draft data protection law was issued by the Government for public comment in 2015 but no progress was made, and then in early 2018, the Indonesian Government issued a new draft personal data protection law. 

While these renewed efforts have positive intentions, a number of concerns ought to be addressed with the aim of strengthening the data protection framework in Indonesia. The Protection of Personal Data Bill proposed has a number of significant shortcomings.

Our analysis of the proposed Bill recommends that to effectively protect privacy and to meet international standards in protecting personal data, consideration must be given to the areas of concern and improvements outlined in our submission.

As the legislative process continues, Privacy International is calling for an open, constructive and consultative process. Privacy International hopes to contribute constructively to the next steps of this process along with the national civil society organisations in Indonesia.

Our priority is to ensure that the highest data protection safeguards are encoded in law and effectively enforced so that people in Indonesia are protected from undue harm and they are able to fully exercise the enjoyment of their fundamental rights and freedoms.

To find out more about privacy and data protection in Indonesia, please refer to ‘The State of Privacy in Indonesia’ (last updated in February 2018).

We take the opportunity to share our guide for policy engagement on data protection "The Keys to Data Protection". The guide is intended to help organisations and individuals improve their understanding of data protection, by providing a framework to analyse the various provisions which are commonly presented in a data protection law.  

In September 2018, the National Executive sent the proposed Data Protection Bill to the National Congress. The proposed law was directed to the Senate and it will be considered by two commissions: the Commission of Constitutional Affairs (Comision de Asuntos Constitucionales) and the Commission of Rights and Guarantees (Comision de Derechos y Garantías).

Privacy International welcomes the continued efforts by Argentina to provide protections for the right to privacy, already enshrined in the Constitution of Argentina. PI welcomes the main aim of the draft law forprotection of personal data (“the Bill”), namely to regulate the processing of personal data in order to guarantee fully the exercise of data subjects in accordance with Articles 18, 19 and 43 of the Constitution. (Clause 1 of the Bill.)

While these efforts have positive intentions, a number of concerns ought to be addressed with the aim of strengthening the data protection framework and Privacy International wishes to make a number of observations and recommendations based on our analysis of the draft law.

We also invite you to refer to the submission published by our national partners, Asociación por los Derechos Civiles (ADC), which presents their analysis of the proposed Data Protection Bill.

As the legislative process continues, Privacy International is calling for an open, constructive and consultative process. Privacy International hopes to contribute constructively to the next steps of this process along with the national civil society organisations in Argentina.

Our priority is to ensure that the highest data protection safeguards are encoded in law and effectively enforced so that people in Argentina are protected from undue harm and they are able to fully exercise the enjoyment of their fundamental rights and freedoms.

To find out more about privacy and data protection in Argentina, please refer to ‘The State of Privacy in Argentina’ (last updated in January 2018).

We take the opportunity to share our guide for policy engagement on data protection "The Keys to Data Protection". The guide is intended to help organisations and individuals improve their understanding of data protection, by providing a framework to analyse the various provisions which are commonly presented in a data protection law.  

In parallel to the legislative process initiated by the Kenya Senate in July 2018, a Task Force constituted by the Ministry of Information, Communication and Telecommunication developed a draft Data Protection Bill which it published for consultation in May of this year. 

Privacy International and its Kenya Partners, the National Coalition of Human Rights Defenders – Kenya (NCHRD-K), the Centre for Intellectual Property and Information Technology (CIPIT) are pleased to have had the opportunity to take part in the open consultative process of the Ministry to seek feedback on the proposed Bill.

We welcome the effort by the Government of Kenya to give life to and specify the right to privacy, already enshrined in Article 31(c) and (d) of the Constitution of Kenya by proposing a draft Data Protection Act.

However, the Data Protection Bill proposed by the Taskforce has a number of significant shortcomings. We recommend that to effectively protect privacy and to meet international standards in protecting personal data, that full consideration be given to the areas of concern and improvements outlined below under each Part of the Bill, which include:

• Reviewing some of the definitions outlined in Part 1 and in particular clarify the definition of ‘sensitive personal data’. 
• Reviewing the material and territorial scope of the law, in particular with the aim of ensuring that the law applies to public entities including law enforcement and intelligence agencies.
• Guaranteeing that all data protection principles are included and revised clearly to provide for principles of fairness and transparency, storage limitation, integrity and confidentiality, and accountability. 
• Guaranteeing that data subjects are provided with rights including the right to suppress or block (restrict), the right to data portability, as well as the protection and enjoyment of their rights in relation to profiling and automated decision making. 
• Reviewing the current scope of the obligation to notify a data subject about the processing of their personal data.
• Providing clarity as to what the legal grounds for processing may be including by defining concepts such as ‘public interest’ and ‘legitimate interest’, and in particular reviewing the legal grounds for processing ‘sensitive personal data’ to strengthen the protection of such data.
• Ensuring that any exemptions relating to the different data protection principles and the rights of data subjects must be provided for in the law in a form which is clear, precise and limited to specific necessary and proportionate exceptions rather than broad blanket exemptions, particularly for government authorities.
• Reviewing the grounds for processing including ensuring that processing of data which is available to the public or deemed publicly available is not free for all to use without requiring further involvement of the data subject.
• Reviewing the clause on the storage of data in Kenya and focus on ensuring the data is protected with the highest safeguards rather than demanding data localisation which may not achieve the purpose of providing a higher level of protection as intended.
• Guaranteeing that a strong process is in place to regulate the transfer of personal data including developing a process for assessing adequacy of protection in the receiving country, not only in terms of data protection but also protection of human rights and rule of law.
• Ensuring that the protection of the data subject and their data as well as their right of privacy is balanced with freedom of expression under Article 33 of the Constitution for the media, artistic or literary work. 
• Guaranteeing that the independent authority established by the law, the Office of the Data Protection Commissioner, has sufficient resources to undertake its mandate, and also that data subjects are given access to an effective remedy and ensuring that the Commissioner has the power to impose penalties, and ensure effective remedies.

Moving forward, Privacy International with our partners and other interested parties, in particular civil society organisations, will monitor this legislative process which is occurring alongside the draft Data Protection Bill in Kenya (on which we also submitted comments).

Our priority is to ensure that the highest data protection safeguards are encoded in lawand effectively enforced so that people in Kenya are protected from undue harm and they are able to fully exercise the enjoyment of their fundamental rights and freedoms.

To find out more about privacy and data protection in Kenya, please refer to ‘The State of Privacy in Kenya’ (last updated in February 2018).

We take the opportunity to share our guide for policy engagement on data protection "The Keys to Data Protection". The guide is intended to help organisations and individuals improve their understanding of data protection, by providing a framework to analyse the various provisions which are commonly presented in a data protection law.  

We welcome the effort by the Pakistani Ministry of Information Technology and Telecommunications to regulate the processing of personal data in Pakistan, and take measures to guarantee the right to privacy as guaranteed under Article 14(1) of the Constitution: “[t]he dignity of man and, subject to law, the privacy of home, shall be inviolable.”

This legislative development is crucial and timely as Pakistan continues to embrace innovative governance initiatives and deploy data-intensive systems which have taken the form of a biometric national identity system known as NADRA, a biometric verification voter system, biometric SIM card registration as well as smart city projects such as the Punjab Safe City project, in Islamabad and Lahore in 2016, amongst others.

To find out more about privacy and data protection in Pakistan please refer to our ‘ State of Privacy’ and ‘State of Surveillance’ briefings.

Whilst data protection is only one piece of the puzzle which must be complemented by other legal safeguards to regulate any activities which include the processing of personal data as well as respect for rule of law and protection of international human rights standards, a comprehensive data protection framework constitutes a foundational mechanism for individuals to exercise their right to privacy.

Working with its partner the Digital Rights Foundation, Privacy International has presented to the Pakistani Ministry of Information Technology and Telecommunications an initial analysis of the Personal Data Protection Bill presented for consultation. While comprehensive in some respects, the Personal Data Protection Bill has a number of significant shortcomings.

We recommend that to effectively protect privacy and meet internationally recognised data protection standards, full consideration must be given to the areas of concern and improvements presented below and developed in more detail in our submission under each Part of the Bill:

1. To include public bodies and government-held personal data: The scope of the law should not be restricted to commercial transactions;
2. Expanding the definition of “personal data”: As a central component of the law, the definition of personal data must be reviewed to encompass all personal data held by both private and public bodies without the caveat of “commercial transactions” attached to it;
3. Define the scope of the Act clearly: It is essential for the law to clearly define its material and territorial scope to ensure that the rights of data subjects are protected regardless of where their data is processed or held;
4. Definition of consent: Given that consent of the data subject is one of the major grounds for processing of personal data, it is important that consent be defined clearly in section two, and that the definition adopted ensures that consent must be explicit, free, informed, proactive and specific;
5. The definition of “sensitive personal data”: Biometric and genetic personal data must be included within the definition of sensitive personal data. This is particularly relevant in Pakistan where various biometric data-intensive systems have been deployed;
6. Safeguards against mass surveillance: Data processing by law enforcement agencies and investigative and intelligence bodies must be included within the scope of the law to ensure those activities are regulated. These authorities should be subject to data protection obligations as well as the standards of necessity and proportionality enshrined in international human rights law;
7. International data sharing: Data processing and sharing activities by Pakistani data controllers and foreign entities must be regulated by this Bill and higher standards should be in place to govern such transfers;
8. Limit broad powers given to the Federal Government to make exemptions: Exemptions to the Act should be limited and we recommend that the Bill be amended to limit broad discretionary powers awarded to the Federal Government, and to ensure that any deviations from the Act be subject to an open, inclusive and transparent legislative process.

We look forward to informing the next steps of the consultative process opened by the Pakistani Ministry of Information Technology and Telecommunications in the hope that the process will be inclusive, transparent and well-defined.

To find out more about our work in this area, please visit our website:

• Where We Work: Pakistan
• What We Do: Modernise Data Protection Law