Administrative Liability of Government Agencies for Personal Data Breaches in Digital Public Services: A Study of the Personal Data Protection Law

Ardhiwinda A, Vayqueen Humairah Mayangkara, Danish Khaira Syahrain, Rio Efendi

Abstract


Digital transformation in public service delivery has increased the use of electronic systems to collect, store, and process citizens' personal data. This development creates legal responsibilities for government agencies to ensure the security and protection of personal data under their control. This study examines the administrative liability of government agencies as personal data controllers under Law No. 27 of 2022 on Personal Data Protection and Law No. 25 of 2009 on Public Services. It also proposes an administrative sanction-aggravation framework for government agencies that fail to fulfill their personal data protection obligations. This research employs a normative legal method using statutory, conceptual, and case approaches. Legal materials are analyzed qualitatively through grammatical and systematic interpretation. The 2024 ransomware incident involving the Temporary National Data Center (PDNS) is used as an illustration of the application of relevant legal norms. The findings indicate that the PDP Law and the Public Services Law establish complementary liability regimes. The PDP Law regulates the obligations of personal data controllers and processors, while the Public Services Law governs the responsibilities of public service providers and personnel. The determination of liability must be based on the actual functions, processing purposes, system control, and allocation of responsibilities among the parties involved. Furthermore, Article 57 of the PDP Law does not provide sufficiently detailed criteria for aggravating administrative sanctions.


Keywords


administrative liability; personal data; digital public services; personal data protection; data breach; administrative sanctions.

Full Text:

PDF

References


Hadjon, P. M. (1987). Perlindungan hukum bagi rakyat di Indonesia: Sebuah studi tentang prinsip-prinsipnya, penanganannya oleh pengadilan dalam lingkungan peradilan umum dan pembentukan peradilan administrasi negara. Bina Ilmu.

Marzuki, P. M. (2017). Penelitian hukum (Edisi revisi). Kencana.

Ridwan HR. (2018). Hukum administrasi negara. Rajawali Pers.

Solove, D. J. (2008). Understanding privacy. Harvard University Press.

Sugiantari, A., Wiryawan, I. W., Hengki, I. G., Asrita, N. N., & Putra, I. K. (2024). Analisis sanksi hukum atas pertanggungjawaban pemerintah terhadap insiden bocornya data pribadi masyarakat dari Pusat Data Nasional (PDN) Indonesia. Jurnal Hukum Saraswati, 6(2), 728–741. https://ejournal.unmas.ac.id/index.php/JHS/article/view/9979

Yuniarti, S. (2019). Perlindungan hukum data pribadi di Indonesia. Business Economic, Communication, and Social Sciences Journal (BECOSS), 1(1), 147–154. https://doi.org/10.21512/becossjournal.v1i1.6030

Republik Indonesia. (1945). Undang-Undang Dasar Negara Republik Indonesia Tahun 1945.

Republik Indonesia. (2008). Undang-Undang Nomor 37 Tahun 2008 tentang Ombudsman Republik Indonesia.

Republik Indonesia. (2009). Undang-Undang Nomor 25 Tahun 2009 tentang Pelayanan Publik.

Republik Indonesia. (2014). Undang-Undang Nomor 30 Tahun 2014 tentang Administrasi Pemerintahan.

Republik Indonesia. (2018). Peraturan Presiden Nomor 95 Tahun 2018 tentang Sistem Pemerintahan Berbasis Elektronik.

Republik Indonesia. (2019). Peraturan Pemerintah Nomor 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik.

Republik Indonesia. (2021). Peraturan Pemerintah Nomor 94 Tahun 2021 tentang Disiplin Pegawai Negeri Sipil.

Republik Indonesia. (2022). Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi.

Republik Indonesia. (2023). Undang-Undang Nomor 20 Tahun 2023 tentang Aparatur Sipil Negara.

Republik Indonesia. (2024). Undang-Undang Nomor 1 Tahun 2024 tentang Perubahan Kedua atas Undang-Undang Nomor 11 Tahun 2008 tentang Informasi dan Transaksi Elektronik.

Badan Siber dan Sandi Negara. (2024). Informasi dan keterangan resmi mengenai insiden serangan ransomware pada Pusat Data Nasional Sementara 2.

Kementerian Komunikasi dan Informatika. (2024, 24 Juni). BSSN identifikasi Pusat Data Nasional Sementara diserang ransomware.

Kementerian Komunikasi dan Informatika. (2024, 27 Juni). Percepat pemulihan, Kominfo, BSSN dan Telkom operasikan server baru pengganti.




DOI: https://doi.org/10.5281/zenodo.23789800

Refbacks

  • There are currently no refbacks.


Copyright (c) 2026 Ardhiwinda A, Vayqueen Humairah Mayangkara, Danish Khaira Syahrain, Rio Efendi

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

 

Socius: Jurnal Penelitian Ilmu-Ilmu Sosial

ISSN : 3025-6704