LEGAL RESPONSIBILITY OF THE HEALTH SOCIAL SECURITY ADMINISTRATING AGENCY (BPJS) FOR FAILURES OF PARTICIPANTS PERSONAL DATA

Abstract

Law Number 24 of 2011 concerning the Social Security Administering Agency is the government's commitment to providing optimal services in the health sector. The implementation of Social Security is mandatory. BPJS Health as a data controller manages membership data which is personal data and is vulnerable to data leaks, as the results of a survey conducted in 2021 showed that 28.7% of Indonesian people had experience of misuse of personal data. This research discusses the legal responsibility of BPJS Health according to the PDP Law as well as from a civil law perspective in the event of a personal data failure.

This research aims to analyze the legal accountability of BPJS Health both according to the PDP Law and from a civil law perspective. This research was carried out using normative research methods by dissecting, exploring legal sources and exploring literature that is appropriate to the research object. The conclusion of this research is that BPJS Health as a data controller must comply with the provisions of the PDP Law and fulfill its responsibilities based on the obligations that must be fulfilled including providing compensation related to the participant's right to file a lawsuit if the data controller is proven to have violated data protection principles. as well as provisions providing administrative sanctions for data controllers. From a civil law perspective, BPJS Health as a matter of public law and as a data controller can be held responsible for losses arising from failure of personal data of BPJS Health participants.