Regulating Facial Recognition Technology under the Indonesian Privacy and Data Protection Frameworks: The Pacing Problem?

The incentive behind artificial intelligence is to develop computers that can perform complex tasks that could only be performed by humans. One of the embodiments is facial recognition that is utilised in a commercial context to law enforcement. This technology could endanger the fundamental rights of an individual; the right to privacy and the right for personal data protection. The terms privacy and data protection should not be used interchangeably since privacy refers to what extent interferences against an individual can be justified, whereas data protection covers protection against unlawful processing of one’s personal data. In Indonesia, the regulatory frameworks on privacy and data protection are still widely fragmented. European Convention on Human Rights (ECHR) and General Data Protection Regulation (GDPR) in the European Union have become prime examples for privacy and data protection frameworks. Therefore, this paper uses a doctrinal methodology to analyse the regulatory gaps in the current Indonesian privacy and data protection frameworks, by taking into account the ECHR and GDPR. It can be concluded that facial recognition highlights the pacing problem in Indonesia data governance. There should be exhaustive lists for limitations against interferences on privacy and newly unified regulation on data protection.