Introduction

How do I handle the issue of background checks, including those involving sensitive personal data such as criminal records?

Indonesia does not have a single comprehensive law governing personal data protection. The relevant laws and regulations are scattered throughout various central and sectoral regulations, with the Electronic Information and Transactions Law (“EIT Law”) as the principal law. Pursuant to the current legal framework, the written consent of the individual whose personal data is collected and/or utilized through electronic media is required. This consent must be provided in the Indonesian language. If a foreign individual is involved, the consent can be made in bilingual form with the prevailing language agreed between the parties. The above does not prejudice the possibility of obtaining the consent by other means, such as in an employment application or employment agreement.

Note that the Indonesian parliament is discussing a Personal Data Protection Bill that is targeted for enactment in 2022. One of the key points in publicly accessible draft of the bill is that it would affect personal data irrespective of whether the data is processed through electronic or non-electronic means. The current legal framework only covers personal data processed by electronic means. It is also worth noting that while the bill is included in the 2022 Priority National Legislation Program, there is no assurance that it will be passed into law this year or the coming years.

With respect to the handling of sensitive information such as criminal records as part of a pre-employment background check, we first note that there is no statutory duty requiring job candidates or employees to inform employers of any criminal records they may have, nor is there a legal prohibition on employers requesting this information. Employees can be placed under a contractual duty to disclose their criminal records by including this obligation in the terms of their signed employment contract, in a separate undertaking, or in the company regulations. And job candidates can be required to disclose their criminal records as part of the application process, provided that the company obtains the candidate’s express written consent as discussed above.

Employers may require the submission of a Police Records Statement Letter (Surat Keterangan Catatan Kepolisian or “SKCK”) as part of the application process. An SKCK is basically an official letter issued by the Indonesian National Police regarding the relevant individual’s involvement in any past or ongoing criminal activities. It is common for companies in Indonesia to require an SKCK as part of the hiring process.

Are there particular issues in checking candidates’ social media profiles?

Information obtained from the public domain, such as social media, does not constitute protected personal data that must be kept confidential. Hence, issues pertaining to the protection of personal data collected from social media should be remote. We view it unlikely that any other issues might emerge insofar as the information obtained from social media is used in a way that does not constitute a violation of prevailing laws and regulations. For instance, using the obtained information for any illegal purposes, such as fraud or document forgery, is subject to criminal penalties.

Can I ask candidates about their covid19 vaccination status?

The prevailing laws and regulations in Indonesia are silent on this matter. Employers may argue that this information is required to comply with the Indonesian Manpower Law, which requires employers to protect the welfare, safety and health, both mental and  physical, of their employees. Requesting proof of Covid-19 vaccination may be considered as protecting the health and safety of everyone in the work environment by helping to prevent the transmission of Covid-19 among employees.

Practically speaking, it is also common practice for office buildings in Jakarta to require all visitors, including employees who work in the building, to provide proof of vaccination before entering the building. Considering our discussion above, it is possible for employers to require the same, especially during the pandemic.

Are employees entitled to lie or to omit information; if information is subsequently found to be false, what can I do?

Principally, employees are obliged to disclose their relevant information truthfully. Employees may be placed under a contractual duty to truthfully disclose all relevant information, either under the terms of their employment agreement, in a separate undertaking, or in the employer’s company regulations. Any violation of this oblgation could result in disciplinary action being taken agains the employees, subject to the terms provided in the employment agreement, separate undertaking, or company regulations, and the prevailing laws and regulations. We note that the types of disciplinary action normally taken depend on the seriousness of the violation as governed under the employment agreement or company regulations.

How should I deal with the personal data of unsuccessful candidates?

Indonesian data protection law in general requires that personal data be stored in encrypted form in the electronic system for at least five years or as may be regulated otherwise. Personal data may be erased from the system once five years has elapsed and so long as the erasure is permitted by law, unless the personal data is still being utilized for the original purpose it was collected. In any case, a person can request the erasure of their personal data subject to the provisions of prevailing laws and regulations.

Given the foregoing, we view that the personal data of candidates obtained by an employer electronically can be stored accordingly, regardless of whether or not the candidates are employed. The employer in this case shall be responsible for the security of the stored personal data. Practically speaking, it is common for the personal data of unsuccessful candidates, i.e., their curricula vitae and supporting documents, to be kept by companies for possible future employment consideration.

Summary

Indonesia does not as of this writing have a single comprehensive personal data protection law. Currently, personal data protection is principally governed by the EIT Law and its implementing regulations, and this current legal framework only affects personal data processed by electronic means. Employers that collect and process the personal data of job candidates or employees by electronic means must obtain the prior consent of the candidate or employee for the collection and use of their personal data.

The collection of personal data and the assurance of that personal data’s truthfulness can be agreed contractually between employer and employee/candidate in the employment agreement, a separate undertaking, or the company regulations. Employers may utilize the personal data or any information of employees or job candidates insofar it is made use of as agreed by consent and does not constitute a violation of prevailing laws and regulations.