TMT Update: Minister of Communication and Information Technology Regulation No. 11 of 2022: Updated Provisions on the Implementation of Electronic Certification

5 May

new 1

General Overview

In 2019, the Government of Indonesia enacted Government Regulation Number 71 of 2019 regarding the Organization of Electronic Systems and Transactions (“**GR 71/2019**”). One of the provisions in GR 71/2019 is that Electronic Certification Providers are obliged to obtain an assessment from a certification body accredited by Certification Provider. As a follow-up to the mandate set out under GR 71/2019, in October 2022 Minister of Communication and Information (**MOCI**) issued Regulation Number 11 Year 2022 regarding Management Procedures for the Organization of Electronic Certification (“**MOCI Reg 11/2022**”) which replaces the previous MOCI Regulation No. 11 of 2018 regarding Organization of Electronic Certification (“MOCI Reg 11/2018”).

In general, MOCI Reg 11/2022 regulates about 4 (four) main matters, which are (i) Implementation of Electronic Certification, (ii) Supervision of Electronic Certification, (iii) Electronic Certification Provider Certification Agency (Lembaga Sertifikasi PSrE), and (iv) Imposition of Administrative Sanction on Electronic Certification.

This ARMA Update will discuss the implementation of electronic certification in Indonesia as regulated on MOCI Reg 11/2022.

Electronic Certification Registration

An Electronic Certification Provider (Penyelenggara Sertifikasi Elektronik, or “PSrE”) is a legal entity that acts as a trusted party that authorizes and audits electronic certificates.¹ PSrE are classified into 2 (two) based on their domicile and 2 (two) based on the form of organization. Based on their domicile, PSrE is classified into Indonesian PSrE and Foreign PSrE. While based on their form of organization, PSrE is divided into Institutional PSrE and Non-institutional PSrE.

Indonesian PSrE is a PSrE domiciled in Indonesia as a Limited Liability Company (Perseroan Terbatas/PT), which already has obtained official acknowledgement from the Minister of Communication and Information (“MOCI”). ² Indonesian PSrE encompasses governmental institutions and non-governmental institutions. While Foreign PSrE is a foreign legal entity which operates as an electronic certification provider outside the jurisdiction of Indonesia and is not equivalent as Foreign Investment Company (PT Penanaman Modal Asing/PT PMA). Suppose Foreign PSrE intended to conduct its business in Indonesia. In that case, Foreign PSrE has to fulfil the same requirements as Indonesian PSrE, which, therefore,the business entity need convert into Indonesian PSrE. ³

In operating its business, Indonesian PSrE is further divided into Institutional PSrE and Non-institutional PSrE. Institutional PSrE referred herein is a PSrE formed by a governmental institution which is legislative, executive, and judicial institutions at the central and regional levels, and other institutions formed by law. A Non-institutional PSrE is a PSrE formed by a private entity. ⁴

MOCI Reg 11/2022 adds several additional requirements from the prior MOCI Reg 11/2018 that must be met in order for Non-institutions to secure PSrE approvals from the Minister, which sets out as follows:⁵

Must have registered as an Electronic Service Organizer (“ESO”); 2.Must not be rooted to any other PSrE or vice versa;
Must have carried out self-evaluation that refers to the standard of facilities and equipment issued by the Ministry;
Must possess the facilities and equipment for the organization of electronic certification in Indonesia (e.g. information system to organize electronic certification holders registration, protection system to secure the facilities and equipment of electronic certification operation, etc.);
Must possess the facilities and equipment required to provide electronic certification services in Indonesia (e.g. e-sign, e-stamp, etc.);
Must have proof of certification and report that addresses the certified evaluation of information security management following the applicable laws and regulations in Indonesia;
Must at least employ 11 (eleven) trusted roles that in charge of facilities and equipment as mentioned on point (4);
Must have a procedure and method for the management and operation of their facilities and equipment;
Must have financially secured through possession of minimum total assets amounting to Rp30.000.000.000 (thirty billion Rupiah);
Must possess a policy document that addresses compensation guarantees relating to any failures of adequate services;
Must not have previously been involved in any disputes or been declared bankrupt;
Must possess proof of integrity and track records for the directors and commissioners of the Indonesian PSrE;
Must have satisfied the interoperability of Indonesian PSrE requirements in accordance with the standards set by the Ministry;
Must possess a certification practice statement of PSrE in accordance with the Certification Policy of Root PSrE (PSrE Induk);
Must possess the following documents: (i) business plan; (ii) business operations plan; (iii) disaster mitigation plan; (iv) stress test, load test, and penetration test reports for the relevant electronic systems; and
Must submit an Application Letter and PSrE Proposal in the format set out in the appendix of this Regulation.

It is also critical to note that Non-institutional PSrE that possess foreign capital shall comply with foreign investment requirements, including but not limited to the foreign capital ownership limitation according to the prevailing investment laws and Regulation in Indonesia. ⁶

Further, in order to be officially acknowledged as Indonesian PSrE, MOCI Reg 11/2022 sets out 2 (two) stages of the process, which are (i) Potential PSrE stages (Tahapan Calon PSrE); and (ii) Indonesian PSrE stages (Tahapan PSrE Indonesia). These processes are summarized as follows: ⁷

Process for Potential PSrE:

Registration process;
Evaluation of the fulfilment of requirements as Potential PSrE; and
Issuance of acknowledgement decree as Potential PSrE.

Process for Indonesian PSrE:

Fulfilment and evaluation of the requirements for Indonesian PSrE;
Feasibility evaluation by the Certification Agency for PSrE (Lembaga Sertifikasi PSrE – “LS PSrE”);
Issuance of Electronic Certificate for Indonesian PSrE by the Root PSrE; and
Issuance of the acknowledgement decree for Indonesian PSrE by the Minister.

Indonesian PSrE that has already obtained the official acknowledgement as referred above shall be included in the list of Indonesian PSrE published on the Ministry's homepage website. ⁸

Indonesian PSrE Services

MOCI Reg 11/2022 also stipulates additional certified services that can be provided by Indonesian PSrE, which has not been previously regulated under MOCI Reg 11/2018. After gaining a business permit to undergo their business, Indonesian PSrE will be permitted to provide certified services to Electronic Certification applicants such as Indonesian citizens, foreign citizens, legal entities, and institutions.⁹ The certified services as mentioned above are as follows:¹⁰

Electronic Signature (Tanda Tangan Elektronik);
Electronic Sealing (Segel Elektronik);
Electronic Time Stamp (Penanda Waktu Elektronik);
Registered Electronic Delviery Services (Layanan Pengiriman Elektronik Tercatat);
Website Authentication (Autentikasi Situs Web); and
Preservation of Electronic Signature and/or Electronic Sealing (Preservasi Tanda Tangan Elektronik dan/atau Segel Elektronik).

Supervision of Electronic Certification

The Minister supervises the implementation of business activity for both Indonesian PSrE and Foreign PSrE in Indonesia.¹¹ In carrying out such supervision, the Minister may form an Electronic Certification Implementation Supervisor (Pengawas Penyelenggaraan Sertifikasi Elektronik). There are 2 (two) types of the implementation of Electronic Certification supervision: supervision for the management of the Electronic Certification and supervision for the control of the Electronic Certification. In implementing several supervisory authorities to the Electronic Certification, ¹² the role of the Minister can also be delegated to the Director General of the Ministry.

Administrative Sanction Imposition in Electronic Certification Implementation

The enactment of MoCI Reg 11/2022 also clarify the imposition of an administrative sanction for PSrE that was previously regulated on MoCI Reg 11/2018. The Minister is authorized to impose an administrative sanction on PSrE, LS PSrE, and Institutions that fail to comply with the obligations regulated on MoCI Reg 11/2022.

The administrative sanction stipulated in MOCI Reg 11/2022 consists of: ¹³

Written warning;
Temporary suspension of PSrE’s registration and/or business activities;
PSrE’s Access termination; and
Removal from the PSrE list.

The imposition of the above administrative sanctions does not waive the criminal as well as civil responsibilities by PSrE.

Article 1 MoCI Reg 11/2022↩
Ibid.↩
Article 5 MoCI Reg 11/2022↩
Article 1 MoCI Reg 11/2022↩
Article 6 MoCI Reg 11/2022↩
Article 8 MoCI Reg 11/2022↩
Article 9 MoCI Reg 11/2022↩
Article 17 MoCI Reg 11/2022↩
Article 27 MoCI Reg 11/2022↩
Article 33 MoCI Reg 11/2022↩
Article 55 MoCI Reg 11/2022↩
Article 56 MoCI Reg 11/2022↩
Article 68 MoCI Reg 11/2022↩

Article 87 of the Environmental Law
Article 92 of the Environmental Law
Article 91 of the Environmental Law

Disclaimer:
This client update is the property of ARMA Law and intended for providing general information and should not be treated as legal advice, nor shall it be relied upon by any party for any circumstance. ARMA Law has no intention to provide a specific legal advice with regard to this client update.

Authors

Authors