Inventory of Legal Bases Regarding Sanctions for The Publication of Personal Data in Population Administration

Abstract

The massive digital transformation within the bureaucracy and the recurrence of various violations of residents’ data protection rights demand legal certainty in the enforcement of personal data protection laws in Indonesia. This study aims to inventory and analyze personal data protection laws in civil registration services, analyze the limits of the authority of the Directorate General of Population and Civil Registration (Ditjen Dukcapil) from the perspective of personal data protection as a Data Controller, and compare administrative, criminal, and civil sanctions for the unlawful publication of population data. This legal research employs a normative legal research method using both a legal and a conceptual approach. The findings indicate that data protection laws in population administration services are currently in a legal transition phase, with incomplete alignment between the sectoral regulations of the old Population Administration Law and the Personal Data Protection Law (PDP Law). Although technical standardization has been regulated in Minister of Home Affairs Regulation No. 57 of 2021 on the SMKI for Civil Registration based on SNI ISO/IEC 27001, overlapping standards still frequently occur in practice. The legal status of the Directorate General of Civil Registration and Population (Ditjen Dukcapil) has shifted to that of a Public Sector Data Controller subject to strict accountability, where the expansion of data utilization must adhere to the principle of privacy by design. An inventory of legal sanctions reveals overlapping penalties with significant disparities in penalties between the Civil Registration Law, the Personal Data Protection Law (PDP Law), and the Electronic Information and Transactions Law. This conflict of norms must be resolved by applying the principle of lex posterior derogat legi priori. Synchronizing severe criminal penalties, tiered administrative fines, and the restoration of victims’ rights through Article 1365 of the Civil Code constitutes a robust legal system to protect citizens’ personal data, mitigate the national data breach crisis, and uphold Indonesia’s sovereignty over population data