PMH Lawsuit (Tort)

Originating from Article 1365 of the Indonesian Civil Code (KUHPerdata), which is rooted in Dutch civil law, a PMH (Perbuatan Melawan Hukum) lawsuit is a legal action for an "unlawful act" or tort. For a claim to succeed, four elements must be proven: an unlawful act, fault (negligence or intent), actual damages, and a direct causal link between the act and the damages. Before Indonesia enacted its specific Personal Data Protection Law (UU PDP), PMH lawsuits were the primary civil remedy for individuals seeking compensation for data privacy violations. This concept aligns with the right to compensation under GDPR Article 82 and is a key legal liability within a PIMS (ISO/IEC 27701), requiring assessment under obligations to PII principals (Clause 7.5).

Enterprises must integrate PMH lawsuit risk into their legal and compliance frameworks. Key steps include: 1) **Legal Risk Identification**: Map all processing activities involving Indonesian PII and assess them against the PMH criteria under the Indonesian Civil Code and the new PDP Law. This corresponds to the ISO/IEC 27701 requirement to identify applicable legal obligations. 2) **Develop Incident and Claims Handling Procedures**: Establish a clear protocol for responding to data breaches, including legal notifications, damage assessment, and managing potential PMH claims, operationalizing controls like ISO/IEC 27001's A.16. 3) **Implement Financial Mitigation**: Procure cyber liability insurance that covers tort claims in Indonesia and allocate a legal contingency fund based on risk assessments. By implementing these measures, a company can reduce potential litigation costs by over 20% and improve its audit posture regarding legal compliance.

Taiwanese enterprises face three main challenges. First, **Legal System Disparity**: Unfamiliarity with Indonesia's Dutch-based civil law system, where the interpretation of an "unlawful act" can be broad and unpredictable. Second, **Evidentiary and Damage Calculation Differences**: The burden of proof and methods for assessing damages in Indonesian courts differ from Taiwanese practice, creating financial uncertainty. Third, **Cross-Border Data Transfer Complexity**: Complying with both Indonesian and Taiwanese data transfer regulations is complex; failures can directly trigger PMH lawsuits. To overcome this, firms should engage local Indonesian legal counsel for a gap analysis, implement a unified PIMS based on ISO/IEC 27701 with a specific Indonesian addendum, and conduct regular training and breach simulation drills. Priority actions include securing local legal expertise and mapping data flows within 3 months.

Winners Consulting specializes in PMH Lawsuit (Tort) for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact