Toward a Victim-Oriented Digital Justice Model: Legal Protection for Personal Data Misuse Under the Personal Data Protection Law
Abstract
This study examines legal protection for victims of personal data misuse in Indonesia within the context of Society 5.0 by addressing three objectives: analyzing existing legal protections under the Personal Data Protection (PDP) Law, identifying gaps between normative regulation and law enforcement practice, and formulating a victim-oriented digital justice model. Using a normative and conceptual approach, this study analyzes Law Number 27 of 2022 and related regulations through qualitative descriptive methods. The findings reveal significant structural weaknesses in Indonesia’s personal data protection regime. Normatively, the PDP Law has not explicitly positioned victims as rights-bearing subjects entitled to restitution, compensation, and digital rehabilitation. Practically, enforcement remains compliance-oriented, relying heavily on administrative sanctions while neglecting victims’ access to justice, redress, and recovery. Institutional fragmentation, limited evidentiary access, and the absence of an independent data protection authority further weaken victim protection. This study proposes a victim-oriented digital justice model that integrates rights-based enforcement, restorative justice principles, and international human rights standards, particularly the UN Basic Principles on Remedy and Reparation. The model emphasizes legal recognition of victims, effective access to justice, and comprehensive redress mechanisms to ensure meaningful protection and restoration of victims’ rights in the digital era.
Keywords
Full Text:
PDFReferences
Button, Mark, Dean Blackbourn, Lisa Sugiura, David Shepherd, Richard Kapend, and Victoria Wang., Victims of cybercrime: Understanding the impact through accounts. In Cybercrime in context: The human factor in victimization, offending, and policing, Cham: Springer International Publishing, 2021;
Bygrave, Lee Andrew., Data privacy law: an international perspective. Oxford, Oxford University Press, 2014;
Doak, Jonathan., Victims' rights, human rights and criminal justice: Reconceiving the role of third parties. London, Bloomsbury Publishing, 2008;
Evans, E. Christine., The right to reparation in international law for victims of armed conflict. No. 91. Cambridge: Cambridge University Press, 2012;
Graham, Mark, and William H. Dutton., eds. Society and the internet: How networks of information and communication are changing our lives. Oxford, Oxford University Press, 2019;
Hildebrandt, Mireille., Law for computer scientists and other folk. Oxford, Oxford University Press, 2020;
Jain, Anil, Ruud Bolle, and Sharath Pankanti., Introduction to biometrics. In Biometrics: personal identification in networked society. Boston, MA: Springer US, 2011;
Kuner, Christopher., Transborder data flows and data privacy law. Oxford, Oxford University Press, 2013;
Mougayar, William., The business blockchain: promise, practice, and application of the next Internet technology. New Jersey, John Wiley & Sons, 2016;
Solove, Daniel J., The digital person: Technology and privacy in the information age. New York, NyU Press, 2004;
Susskind, Richard E., Tomorrow's lawyers: An introduction to your future. Oxford, Oxford University Press, 2023;
Van Boven, Theo., Victims’ Rights to a Remedy and Reparation: The United Nations Principles and Guidelines. In Reparations for Victims of Genocide, War Crimes and Crimes against Humanity. Leiden, Brill Nijhoff, 2020;
Voigt, Paul, and Axel Von dem Bussche., The eu general data protection regulation (gdpr). A practical guide, 1st ed., Cham, Springer International Publishing Vol.10, no.315, 2017;
Zuboff, Shoshana., The age of surveillance capitalism. In Social theory re-wired. Oxfordshire, Routledge, 2023;
'Aisy, Firsta Rahadatul, Muhammad Azil Maskur, and A.M Adzkiya' Amiruddin., Establishing Indonesia's personal data protection agency: Comparative administrative sanctions enforcement from Ireland, Australia, and Singapore. Journal of Indonesian Legal Studies Vol.10, no.1, 2025;
Ausloos, Jef., The ‘right to be forgotten’–worth remembering? Computer law & security review Vol.28, no.2, 2012; https://doi.org/10.1016/j.clsr.2012.01.006;
Bachura, Eric, Rohit Valecha, Rui Chen, and H. Raghav Rao., The OPM data breach: An investigation of shared emotional reactions on Twitter. MIS quarterly Vol.46, no.2, 2022; https://doi.org/10.25300/MISQ/2022/15596
Bakare, Seun Solomon, Adekunle Oyeyemi Adeniyi, Chidiogo Uzoamaka Akpuokwe, and Nkechi Emmanuella Eneh., Data privacy laws and compliance: a comparative review of the EU GDPR and USA regulations. IT Research Journal, 2024; DOI:10.51594/csitrj.v5i3.859;
Bennett, Colin J., and Charles D. Raab., Revisiting the governance of privacy: Contemporary policy instruments in global perspective. Regulation & Governance Vol.14, no.3, 2020; https://doi.org/10.1111/rego.12222;
Cavoukian, Ann., Privacy by design: The 7 foundational principles. Information and privacy commissioner of Ontario, Canada Vol.5, no.9, 2009;
Cech, Florian, and Hilda Tellioglu., Impact of the digital transformation: an online real-time delphi study. arXiv preprint arXiv:1904.11411 no.1, 2019; https://doi.org/10.48550/arXiv.1904.11411;
Citron, Danielle Keats, and Daniel J. Solove., Privacy harms. BUL Rev. no.102, 2022;
D'Acquisto, Giuseppe, Josep Domingo-Ferrer, Panayiotis Kikiras, Vicenç Torra, Yves-Alexandre de Montjoye, and Athena Bourka., Privacy by design in big data: an overview of privacy enhancing technologies in the era of big data analytics. arXiv preprint arXiv:1512.06000 no.2, 2015; https://doi.org/10.2824/641480;
De Donno, Michele, Alberto Giaretta, Nicola Dragoni, Antonio Bucchiarone, and Manuel Mazzara., Cyber-storms come from clouds: Security of cloud computing in the IoT era. Future Internet Vol.11, no.6, 2019; https://doi.org/10.3390/fi11060127;
DeMarco, Joseph V., US Federal Trade Commission hosts public forum on facial recognition technology. 2012; https://doi.org/10.1016/j.clsr.2012.01.010;
Enggarsasi, Umi, Nur Khalimatus Sa’diyah, and Pratama Alifiandi Martio., Legal Safeguards for Victims of Data Dissemination Crimes and Cybercrime Protection. Jurnal Hukum Vol.40, no.2, 2024; https://dx.doi.org/10.26532/jh.v40i2.39974;
Garrison, Chlotia, and Clovia Hamilton., A comparative analysis of the EU GDPR to the US’s breach notifications. Information & Communications Technology Law Vol.28, no.1, 2019; https://doi.org/10.1080/13600834.2019.1571473;
Gasser, Urs, and Virgilio AF Almeida., A layered model for AI governance. IEEE Internet Computing Vol.21, no.6, 2017;
Gerber, Paula, Joanna Kyriakakis, and Katie O'Byrne., General Comment 16 on state obligations regarding the impact of the business sector on children's rights: what is its standing, meaning and effect?. Melb. J. Int'l L. no.14, 2013; DOI:10.1109/MIC.2017.4180835;
Greenleaf, Graham., Global data privacy laws 2017: 120 national data privacy laws, including Indonesia and Turkey. Privacy Laws & Business International Report no.145, 2017;
Greenleaf, Graham., Global Data Privacy Laws 2021: Despite COVID Delays, 145 Laws Show GDPR Dominance. Privacy Laws & Business International Report no.169, 2021;
Hasian, Diah Putri, and Annisa Fitria., Pertanggung Jawaban Telkomsel Atas Kebocoran Rahasia Data Pribadi Pengguna Indihome. Arus Jurnal Sosial dan Humaniora Vol.5, no.2, 2025; https://doi.org/10.57250/ajsh.v5i2.1440;
Junaedi, Asep Mahbub., Urgensi perlindungan data pribadi dalam era digital: analisis Undang-Undang nomor 27 Tahun 2022 tentang perlindungan data pribadi. Knowledge: Jurnal Inovasi Hasil Penelitian dan Pengembangan Vol.5, no.2, 2025; https://doi.org/10.51878/knowledge.v5i2.5269;
Kumalaratri, Giosita., Urgency of the Personal Data Protection Bill on Privacy Rights in Indonesia. Jurnal Hukum Vol.37, no.1, 2021;
Latifah, Emmy, Anis H. Bajrektarevic, and Moch Najib Imanullah., The shifting of alternative dispute resolution: From Traditional form to the online dispute resolution. Brawijaya Law Journal Vol.6, no.1, 2019;
Lesmana, Desta, Mochammmad Afifuddin, and Agus Adriyanto., Challenges and cybersecurity threats in digital economic transformation. International Journal of Humanities Education and Social Sciences (IJHESS) Vol.2, no.6, 2023;
Livingstone, Sonia, and Amanda Third., Children and young people’s rights in the digital age: An emerging agenda. New media & society Vol.19, no.5, 2017; https://doi.org/10.1177/1461444816686318 ;
Livingstone, Sonia, and Ellen Helsper., Gradations in digital inclusion: Children, young people and the digital divide. New media & society Vol.9, no.4, 2007; https://doi.org/10.1177/1461444807080335;
Lyon, David., Surveillance, Snowden, and big data: Capacities, consequences, critique. Big data & society Vol.1, no.2, 2014; https://doi.org/10.1177/2053951714541861;
Martin, Kirsten, and Katie Shilton., Why experience matters to privacy: How context‐based experience moderates consumer privacy expectations for mobile applications. Journal of the Association for Information Science and Technology Vol.67, no.8, 2016; https://doi.org/10.1002/asi.23500;
Narvaez Rojas, Carolina, Gustavo Adolfo Alomia Peñafiel, Diego Fernando Loaiza Buitrago, and Carlos Andrés Tavera Romero., Society 5.0: A Japanese concept for a superintelligent society. Sustainability Vol.13, no.12, 2021; https://doi.org/10.3390/su13126567;
Nugroho, Andriyanto Adhi, Atik Winanti, and Surahmad Surahmad., Personal Data Protection in Indonesia: Legal Perspective. International Journal of Multicultural and Multireligious Understanding Vol.7, no.7, 2020;
Panjaitan, Hulman, Junimart Girsang, Moermahadi Soerja Djanegara, and Md Hasnath Kabir Fahim., Strengthening Consumer Protection in Digital Transactions: A Legal Perspective on Click-Wrap Agreements Under the Consumer Protection Law. Jurnal Hukum UNISSULA Vol.41, no.3, 2025; https://dx.doi.org/10.26532/jh.v41i3.47262;
Park, Yong Jin., Digital literacy and privacy behavior online. Communication research Vol.40, no.2, 2013; https://doi.org/10.1177/0093650211418338;
Purba, Yedija Otniel, and Agus Mauluddin., Kejahatan siber dan kebijakan identitas kependudukan digital: Sebuah studi tentang potensi pencurian data online. JCIC: Jurnal CIC Lembaga Riset dan Konsultan Sosial Vol.5, no.2, 2023; https://doi.org/10.51486/jbo.v5i2.113;
Rocher, Luc, Julien M. Hendrickx, and Yves-Alexandre De Montjoye., Estimating the success of re-identifications in incomplete datasets using generative models. Nature communications Vol.10, no.1, 2019; https://doi.org/10.1038/s41467-019-10933-3;
Rosadi, Sinta Dewi., Protecting privacy on personal data in digital economic era: Legal framework in Indonesia. Brawijaya Law Journal Vol.5, no.1, 2018;
Safinatunnajah, Awalia, Mahrus Ali, and Papontee Teeraphan., Compliance of the Subjective Terms of Detention in Criminal Procedure with International Covenant on Civil and Political Rights. Lex Publica Vol.9, no.2, 2022; https://doi.org/10.58829/lp.9.2.2022.88-101;
Said, Zahidah Mohamad, and Mohamad Fadli Zolkipli., Internet of Things (IoT): A Study of Security Issues and Challenges. Int. J. Recent Contributions Eng. Sci. IT Vol.10, no.2, 2022; https://doi.org/10.3991/ijes.v10i02.29301;
Sari, Yesi Nurmantiyas, Rizal Nugroho, and Al Khanif., Land acquisition for public interests: A review from the human rights context. Indon. JLS Vol.1 2020; 23;
Sears, Christopher R., and Daniel R. Cunningham., Individual differences in psychological stress associated with data breach experiences. Journal of Cybersecurity and Privacy Vol.4, no.3, 2024;
https://doi.org/10.3390/jcp4030028;
Shahrullah, Rina Shahriyani, Jihyun Park, and Irwansyah Irwansyah., Examining personal data protection law of Indonesia and South Korea: The privacy rights fulfilment. Hasanuddin Law Review Vol.10, no.1, 2025; DOI:10.20956/halrev.v10i1.5016;
Sholehuddin, Nawal, Surianom Miskam, Farah Mohd Shahwahid, Tuan Nurhafiza Raja Abdul Aziz, and Naqibah Mansor., A Comparative Legal Analysis on Personal Data Protection Laws in Selected ASEAN Countries: Analisis Perundangan Perbandingan Undang-undang Perlindungan Data Peribadi di Negara-negara ASEAN. Journal of Muwafaqat Vol.7, no.1, 2024; https://doi.org/10.53840/muwafaqat.v7i1.166;
Spanca, Fiona, and Armend Salihu. "Unveiling the Consequences of Data Breaches: Risks, Impacts, and Mitigation in the Digital Age." In 2024 International Conference on Electrical, Communication and Computer Engineering (ICECCE). New York, IEEE, 2024;
Stefani, Eduardo, Ivanir Costa, Marcos Antonio Gaspar, Roberto de Souza Goes, Rogerio Carlos Monteiro, Breno Ribeiro Petrili, and Alexandre de Paula Pereira., Information Security Risk Framework for Digital Transformation Technologies. Systems Vol.13, no.1, 2025; https://doi.org/10.3390/systems13010037;
Subashini, Subashini, and Veeraruna Kavitha., A survey on security issues in service delivery models of cloud computing. Journal of network and computer applications Vol.34, no.1, 2011; https://doi.org/10.1016/j.jnca.2010.07.006;
Sukerta, Putu Aryan Darma, and Andri Sutrisno., Personal Data Protection in ASEAN: A Critical Comparison between Indonesia's and Malaysia's Legal Frameworks. Constitutional Law Review no.3, 2024; https://doi.org/10.30863/clr.v3i2.5605;
Sun, Luyao., Overview of regulations on cross border data flow. Academic Journal of Science and Technology Vol.8, no.1, 2023;
Sutomo, Deni Anggreani., The Impact of Digital Transformation on Economic Growth in Developing Countries: A Case Study of Indonesia. Innovative: Journal Of Social Science Research Vol.5, no.3, 2025; https://doi.org/10.31004/innovative.v5i3.19670;
Taylor, Linnet., What is data justice? The case for connecting digital rights and freedoms globally. Big Data & Society Vol.4, no.2, 2017; https://doi.org/10.1177/2053951717736335;
Tene, Omer, and Jules Polonetsky., Big data for all: Privacy and user control in the age of analytics. Nw. J. Tech. & Intell. Prop. Vol.11, no.2, 2012;
Tufekci, Zeynep., Algorithmic harms beyond Facebook and Google: Emergent challenges of computational agency. Colo. Tech. LJ no.13, 2015;
Van Boven, Theo., The United Nations basic principles and guidelines on the right to a remedy and reparation for victims of gross violations of international human rights law and serious violations of international humanitarian law. United Nations Audiovisual Library of International Law no. 7, 2010;
Waiganjo, Iyaloo N., and Linekela S. Nandjenda., Unveiling Insider Threats: Examining Vulnerabilities in an Organizational Structure: A Case Study of NamPost. Open Access Library Journal Vol.12, no.1, 2025;
Widiatedja, I. Gusti Ngurah Parikesit, and Neha Mishra., Establishing an independent data protection authority in Indonesia: a future–forward perspective. International Review of Law, Computers & Technology Vol.37, no.3, 2023; https://doi.org/10.1080/13600869.2022.2155793;
Bhatt, Charukeshi, and Anirudh Burman., Data Protection Regulation in the Global South. Carnegie Endowment for International Peace, February 21, 2024; https://carnegieendowment.org/posts/2024/02/data-protection-regulation-in-the-global-south?lang=en. Accessed October 2, 2025;
Organisation for Economic Co-operation and Development., Digital transformation in the age of COVID-19: Building resilience and bridging divides. OECD Policy Responses to Coronavirus COVID-19, 2020, https://img.lalr.co/cms/2020/11/27173400/digital-economy-outlook-covid.pdf. Accessed September 27, 2025;
Tisné, Martin., The Data Delusion: Protecting Individual Data Isn’t Enough When the Harm Is Collective. Edited by Marietje Schaake. Luminate, July 2020. https://luminategroup.com/storage/1023/The-Data-Delusion---July-2020.pdf. Accessed October 2, 2025;
UNESCO., Japan Pushing Ahead with Society 5.0 to Overcome Chronic Social Challenges, UNESCO, February 21, 2019. https://www.unesco.org/en/articles/japan-pushing-ahead-society-50-overcome-chronic-social-challenges, Accessed October 2, 2025;
United Nations Office on Drugs and Crime., Good practices in protecting victims of cybercrime. United Nations Office on Drugs and Crime, 2020. https://www.unodc.org/. Accessed October 2, 2025;
Waranggani, Arundati Swastika. Data BPJS Kesehatan Bocor, Risiko Keamanan Data Pribadi Mengancam. Cloud Computing Indonesia. May 25, 2021. https://event.cloudcomputing.id/berita/data-bpjs-kesehatan-bocor-ancam-masyarakat. Accessed October 2, 2025;
Aditya Widya Putri., Data pribadi terserak, nasib sial masyarakat hadapi kebocoran data. Katadata.co.id. July 31, 2023. https://katadata.co.id/indepth/telaah/64c725ca09e2e/data-pribadi-terserak-nasib-sial-masyarakat-hadapi-kebocoran-data. Accessed October 2, 2025;
BBC Indonesia, BPJS Kesehatan: Data ratusan juta peserta diduga bocor - Otomatis yang dirugikan masyarakat, kata pakar, BBC News Indonesia, May 21, 2021, https://www.bbc.com/indonesia/indonesia-57196905. Accessed October 2, 2025;
Mediana., There have only been three criminal cases of personal data protection violations. Kompas.id. August 20, 2024. https://www.kompas.id/artikel/en-baru-ada-tiga-kasus-pidana-pelanggaran-pelindungan-data-pribadi. Accessed October 2, 2025;
Puspita Sari, Rita., RI masuk 10 besar kebocoran data, hampir 94,22 juta akun bocor. CSIRT Indonesia. November 29, 2024. https://csirt.or.id/berita/ri-masuk-10-besar-kebocoran-data. Accessed October 2, 2025;
Wijaya, Ahmad., Kebocoran data jadi ancaman serius merugikan individu dan perusahaan. ANTARA News. May 23, 2024. https://www.antaranews.com/berita/4118397/kebocoran-data-jadi-ancaman-serius-merugikan-individu-dan-perusahaan. Accessed October 2, 2025;
Keswani, Vijay, and L. Elisa Celis., Algorithmic Fairness from the Perspective of Legal Anti-discrimination Principles. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, vol.7, 2024;
Nasution, Vivi Indra Amelia, Isna Yuliani, Tora Akadira, and Eha Saleha., Transforming Governance: Indonesia's Digital Leap. In Proceedings of the 6th Open Society Conference (OSC 2024). vol. 894. Berlin, Springer Nature, 2024;
Nurse, Jason RC, Nikki Williams, Emily Collins, Niki Panteli, John Blythe, and Ben Koppelman., Remote working pre-and post-COVID-19: an analysis of new threats and risks to security and privacy. In International Conference on Human-Computer Interaction. Cham, Springer International Publishing, 2021;
Wong, Richmond Y., and Deirdre K. Mulligan., Bringing design to the privacy table: Broadening design in privacy by design through the lens of HCI. In Proceedings of the 2019 CHI conference on human factors in computing systems, 2019.
DOI: http://dx.doi.org/10.26532/jh.v42i2.48829
Refbacks
- There are currently no refbacks.
License URL: https://creativecommons.org/licenses/by/4.0
Jurnal Hukum Indexed by :
 | Jurnal Hukum | |
| Faculty of Law, Unissula | Copyright of Jurnal Hukum | |
| Jalan Kaligawe Raya KM.4, Terboyo Kulon, Genuk, | ISSN 1412-2723 ( Print )e-ISSN 2723-6668 ( Online ) | |
| Semarang, Central Java, Indonesia, 50112 |