Circular Letter of the Financial Services Authority Number 14/SEOJK.07/2014 Concerning Confidentiality and Security of Consumer Personal Data and/or Information

To:
The Board of Directors or Management of Financial Service Business Actors, At Your Location

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 14/SEOJK.07/2014

CONCERNING

CONFIDENTIALITY AND SECURITY OF CONSUMER PERSONAL DATA AND/OR INFORMATION

In light of the implementation of Financial Services Authority Regulation Number 1/POJK.07/2013 concerning Consumer Protection in the Financial Services Sector (State Gazette of the Republic of Indonesia Year 2013 Number 118, Supplement to the State Gazette of the Republic of Indonesia Number 5431), it is necessary to regulate provisions regarding guidelines for the implementation of the principles of Confidentiality and Security of Consumer Personal Data and/or Information as regulated in Article 2 letter d, Article 31, and Article 49 in the Financial Services Authority Circular Letter as follows:

I. GENERAL PROVISIONS

In this Circular Letter of the Financial Services Authority, the following terms are defined:

1. Consumer Personal Data and/or Information is data and/or information, which includes the following:
   a. Individuals:

   1. name;
   2. address;
   3. date of birth and/or age;
   4. telephone number; and/or
   5. mother's maiden name.
      b. Corporations:
   6. name;
   7. address;
   8. telephone number;
   9. composition of directors and commissioners including identity documents such as Identity Cards/passports/residence permits; and/or
   10. composition of shareholders.

2. Financial Service Business Actors, hereinafter abbreviated as FSBA, are Commercial Banks, Rural Banks, Securities Companies, Investment Advisors, Custodian Banks, Pension Funds, Insurance Companies, Reinsurance Companies, Financing Companies, Pawnshops, and Guarantee Companies, both those conducting conventional business activities and those conducting Sharia business activities.

3. Consumer means parties who place their funds and/or utilize available services at FSBA, including customers at Banking, investors at the Capital Market, policyholders at Insurance, and participants at Pension Funds, based on laws and regulations in the financial services sector.

II. PROTECTION OF CONSUMER PERSONAL DATA AND/OR INFORMATION

1. FSBA is prohibited from providing consumer personal data and/or information to third parties in any manner.

2. The prohibition as referred to in item 1 is excepted in cases where:
   a. The Consumer provides written consent; and/or b. It is mandated by laws and regulations.

3. In the event that the Consumer provides written consent as referred to in item 2 letter a, FSBA may provide Consumer Personal Data and/or Information with the obligation to ensure that the third party does not provide and/or use Consumer Personal Data and/or Information for purposes other than those agreed upon between the FSBA and the third party.

4. The procedure for written consent from the Consumer may be stated in forms such as:
   a. a choice of agree or disagree; or b. providing a consent mark, in documents and/or product and/or service agreements.

5. In the event that FSBA obtains personal data and/or information of an individual and/or a group of people from another party and FSBA will use such data and/or information to carry out its activities, FSBA must have a written statement that the other party has obtained written consent from the individual and/or group of people to provide the personal data and/or information in question to any party including FSBA.

6. FSBA is required to establish written policies and procedures regarding the use of Consumer Personal Data and/or Information which at a minimum contain:
   a. explaining in writing and/or orally to the Consumer regarding the purpose and consequences of providing written consent and the provision and/or dissemination of Consumer Personal Data and/or Information as referred to in item 2 letter a; and b. requesting written consent from the Consumer in the event that FSBA will provide and/or disseminate Consumer Personal Data and/or Information to third parties for any purpose, unless otherwise stipulated in applicable laws and regulations.

7. The written policies and procedures as referred to in item 6 must be incorporated into standard operating procedures regarding the use of Consumer Personal Data and/or Information as follows:
   a. officials and/or officers of FSBA explain in writing and/or orally regarding the purpose and consequences of the Consumer's written consent related to the provision and/or dissemination of Consumer Personal Data and/or Information that:

   1. it will only be used for the internal interests of FSBA and/or in accordance with laws and regulations; and/or
   2. it will be provided and/or disseminated to other parties upon the Consumer's written consent.
      b. in the event of providing and disseminating to other parties, the officials and/or officers of FSBA:
   3. provide explanations to the Consumer regarding the purpose and consequences of providing and/or disseminating Consumer Personal Data and/or Information; and
   4. submit a written statement that FSBA has obtained written consent from the Consumer.
      c. officials and/or officers of FSBA request written consent from the Consumer in accordance with the provisions as referred to in item 4.

III. OTHER PROVISIONS

Upon the implementation of this Circular Letter of the Financial Services Authority, FSBA that adjusts clauses in documents and/or product and/or service agreements regulating the use of Consumer Personal Data and/or Information in accordance with the provisions in this Circular Letter of the Financial Services Authority, must create an action plan approved by the Supervision Division of each respective FSBA.

IV. TRANSITIONAL PROVISIONS

1. Every clause in documents and/or product and/or service agreements regulating the use of Consumer Personal Data and/or Information that existed prior to the implementation of this Circular Letter of the Financial Services Authority must be adjusted to the provisions in this Circular Letter of the Financial Services Authority.

2. FSBA is required to submit notification of clause adjustments as referred to in item 1 to the Consumer.

3. FSBA is required to send the notification as referred to in item 2 since the implementation of this Circular Letter of the Financial Services Authority through communication media accessible by the Consumer or that has been previously agreed upon with the Consumer.

V. CLOSING PROVISIONS

This Circular Letter of the Financial Services Authority shall take effect on the date it is established.

To ensure that everyone knows this, it is ordered to announce this Circular Letter of the Financial Services Authority by placing it in the State Gazette of the Republic of Indonesia.

Established in Jakarta
On 20 August 2014

MEMBER OF THE BOARD OF COMMISSIONERS FOR
EDUCATION AND CONSUMER PROTECTION,

Signed,
KUSUMANINGTUTI S. SOETIONO

STATE GAZETTE OF THE REPUBLIC OF INDONESIA NUMBER 70 DATED 2 SEPTEMBER 2014

Copy in accordance with the original
Director of Law 1
Department of Law,

Signed,
Tini Kustini