Indonesian unicorns unite
Creation of a supercharged super-app GoTo brings personal data protection into sharp focus.
The recent mega-merger of the Indonesian super-apps Gojek and Tokopedia -- essential fixtures in the daily lives of tens of millions of people -- has lent new urgency to the need for better personal data protection in the country.
Analysts say the biggest business tie-up in Indonesian history should prompt lawmakers to speed up deliberation of the personal data protection bill, given that such protection is almost nonexistent now. Leaks are rampant, and citizens' data has become a hot commodity offered for sale in online marketplaces.
Gojek, which started as a ride-hailing app and expanded to offer various on-demand mobile services including delivery, and the e-commerce platform Tokopedia, which offers financial services in addition to online shopping, announced on May 17 that they had agreed to merge and form the GoTo Group.
The deal "marks the largest ever business combination in Indonesia and the largest between two Asia-based internet media and services companies to date", the two companies said in a statement.
Sources told Reuters that GoTo would seek additional funding of US$2 billion prior to holding an initial public offering of shares that could value the new company at up to $40 billion.
The two companies combined generated 1.8 billion transactions worth $22 billion in 2020 across an online ecosystem that accounts for about 2% of Indonesia's $1-trillion GDP. The merged entity will have more than 100 million monthly active users, at least two million registered drivers, and over 11 million merchant partners.
But with great power comes great responsibility, and that includes ensuring that GoTo can properly protect the massive amounts of data it collects, said cybersecurity expert Pratama Persadha.
"It should be noted that both platforms have had unfavourable experiences with their information systems," Mr Persadha said in a statement to Asia Focus.
In mid-2020, Tokopedia had a massive leak of data of its 91 million users, and there have been reports of fraud linked to Gojek's financial arm, Gopay. The latter could also be vulnerable to theft from users' e-wallets, in addition to risks of personal data leaks unless the platform has a really solid security system, Mr Persadha added.
Indonesia's existing Information and Electronic Transaction Law, as well as other ministerial regulations, are insufficient to protect users' data at a time when super-apps are becoming essential to daily life, said Nailul Huda, head of the Center of Innovation and Digital Economy at the Jakarta-based Institute for Development of Economics and Finance (Indef).
"Lawmakers need to move faster to deliberate the personal data protection bill to keep up with the fast-growing digital economy," Mr Huda told Asia Focus.
Parliament has included the bill on its priority list for this year, but it is not clear how long it will take before lawmakers pass it.
According to the National Cyber and Encryption Agency, there were 2,549 cases of information theft that were used for fraud, and 79,439 accounts affected by data breaches last year.
The merger of Gojek and Tokopedia -- each backed by global heavyweight investors -- comes amid a surge of competition in the ride-hailing and food delivery markets in Southeast Asia. Stay-at-home pandemic restrictions have fed huge demand for food delivery, e-commerce and e-payments.
GoTo says it will become the first platform in Asean to combine three business lines -- e-commerce by Tokopedia, on-demand by Gojek, and financial services by GoTo Financial -- in a single ecosystem. The company also said it would continue to focus on the other Southeast Asian countries -- Vietnam, Singapore and Thailand -- where Gojek already operates.
Gojek CEO and co-founder Kevin Aluwi said the merger of "two like-minded companies" placed them in a "unique position to meet all of a consumer's daily needs", with the support of the region's densest and fastest mobility network.
The two companies first began working together in 2015, with Gojek drivers delivering goods purchased from merchants on Tokopedia.
Tokopedia co-founder William Tanuwijaya said the new company would be the "go-to" ecosystem for consumers, promising innovations for speedier and more affordable deliveries.
"Our goal has always been to build a company that creates social impact at scale, levelling the playing field for small businesses and giving consumers equal access to goods and services across the country," he said.
Gojek co-CEO Andre Soelistyo will serve as CEO role of the merged entity, with Tokopedia's Patrick Cao serving as GoTo group president.
One of Gojek's co-founders, Nadiem Makarim, left the company in 2019 to join President Joko Widodo's cabinet as minister of education and culture. His ministerial portfolio was recently expanded to include research and technology.
According to the merger announcement, the GoTo group's investors include Alibaba Group, Astra International, BlackRock, Capital Group, DST, Facebook, Google, JD.com, KKR, Northstar, Pacific Century Group, PayPal, Provident, Sequoia Capital India, SoftBank Vision Fund 1, Telkomsel, Temasek, Tencent, Visa, and Warburg Pincus.