Opt out protections from spam in Indonesia

Data protection is an increasingly hot topic. Individual privacy is ever more important in the online age of open accessible lives and data. ASEAN is working on harmonization slowly - see here. And national governments are working on ways to protect people from misuse of personal data. One aspect is the ability for people to opt out of online sales and marketing communications.

Indonesia has a rather messy collection of rules on this, which potentially leave a lot of gaps.

The ITE law

Article 26 of Law number 11 of 2008 concerning electronic information and transaction includes a "right to enjoy personal life and be free from any invasion." Possibly continued sending of marketing emails despite the recipient's opt out would contravene this right. The consequence of contravention would trigger a right to claim damages under article 26(2) although it is not a criminal offence.

Ministerial Decree from the Ministry of Communication and Information

SMS marketing is covered in a Ministerial rule which forbids sending SMSs to recipients that have opted out.  Article 20 provides for " administrative and/or criminal penalties in accordance with the prevailing law".  However as yet the government has not explained what these are.  SMS broadcast marketing must include an ability for recipients to opt out.

Another provision covers SMS messages that are contrary to the public interest, morality, security or public order which the government might also use in some cases.

Constitution of the Republic of Indonesia

Even the Constitution could protect an Indonesian citizen from "unwelcome" emails particularly after he has intimated his opt out because he “has the right to feel secure against and receive protection from the threat of fear to do or not do something that is a human right."  The application of this article in this context remains unclear though.

The Civil Code

There is a general provision in article 1365 of the Civil Code which enables a victim to claim damages for any legal wrong. It could apply to this situation.

Ideally Indonesia will bring all its data privacy laws together, as it will eventually be mandated to do if new ASEAN rules proposed come into force (see here).