Tanggung Jawab Hukum Badan Penyelenggara Jaminan Sosial Kesehatan Terhadap Kebocoran Data Pribadi Peserta

Legal Responsibility of Badan Penyelenggara Jaminan Sosial Kesehatan Regarding Personal Data Leaks of Participants

Abstract

The 2021 alleged breach involving BPJS Kesehatan participants’ data illustrates that victim redress depends not only on criminal prosecution of hackers but also on the liability of the data manager when a protection failure occurs. This article examines BPJS Kesehatan’s legal accountability before and after the enactment of Indonesia’s Personal Data Protection Law (Law No. 27/2022). The analysis focuses on civil liability construction, breach notification duties, and  administrative consequences applicable to data controllers. The findings indicate that, prior to Law No. 27/2022, liability was fragmented across the ITE Law, Government Regulation No. 71/2019, and Ministerial Regulation No. 20/2016, with limited enforcement leverage and remedies largely dependent on proving an unlawful act (tort) in court. After the PDP Law, data subjects’ right to sue and obtain compensation is strengthened, notification obligations become clearer, and more robust administrative sanctions, thereby expanding remedial options and incentivising compliance.