Protecting Biometric Data in Digital Transactions: Assessing the Adequacy of Indonesia’s Personal Data Protection Regime

Ayu Mega Harahap; Juwita Hana Situmorang; Dimas Ilyas Situmorang

Authors

Ayu Mega Harahap Universitas Pancasila Author
Juwita Hana Situmorang Universitas Pancasila Author
Dimas Ilyas Situmorang Universitas Pancasila Author

Keywords:

Biometric Data, Digital Transactions, Personal Data Protection, Privacy by Design, Data Subject Rights

Abstract

Purpose - This study assesses the adequacy of Indonesia's personal data protection regime for biometric data used in digital transactions, focusing on consent, transparency, retention, deletion, security, accountability, and data subject rights. Methodology - A qualitative socio-legal design involved 24 participants from user, legal-compliance, cybersecurity-biometric, academic, legal-practice, and civil-society groups. The study also reviewed 14 documents from eight digital service providers and applied thematic analysis using rights-based and privacy-by-design frameworks. Findings - Indonesia's Personal Data Protection Law provides a significant normative foundation, but operational protection remains uneven. Consent was often formal rather than substantively informed, disclosure of retention and third-party processing was limited, and data subject rights were difficult to exercise. Organizations showed stronger cybersecurity maturity than privacy-by-design implementation, while institutional supervision and biometric-specific guidance remained underdeveloped. Implications - Regulators and digital service providers should strengthen biometric-specific consent, transparency, retention and deletion standards, privacy impact assessments, processor accountability, and accessible rights mechanisms. Originality - The study assesses biometric protection through the combined interaction of law, institutions, technological design, and user experience.

References

Alfaaiz, M. G. (2025). Perbandingan regulasi perlindungan data pribadi antara Indonesia dan Singapura dalam konteks kasus Worldcoin. Journal Equitable, 10(3). https://doi.org/10.37859/jeq.v10i3.9241

Arman, S. M., Yang, T., Shahed, S., Al Mazroa, A., Attiah, A., & Mohaisen, L. (2024). A comprehensive survey for privacy-preserving biometrics: Recent approaches, challenges, and future directions. Computers, Materials & Continua, 78(2), 2087–2110. https://doi.org/10.32604/cmc.2024.047870

Bezas, K., & Filippidou, F. (2023). Anti-spoofing methods in face recognition. The Indonesian Journal of Computer Science, 12(3). https://doi.org/10.33022/ijcs.v12i3.3198

Beya, B., Hanslo, M., & Hanslo, R. (2024). The face of surveillance: A systematic review of ethical and legal implications in public facial recognition. Proceedings of the International Conference on Intelligent and Innovative Computing Applications. https://doi.org/10.59200/iconic.2024.010

Budiman, R. (2023). The development of personal data protection law in Indonesia: Challenges and prospects for the implementation of Law No. 27 of 2022. Jurnal Smart Hukum, 2(1), 24–36. https://doi.org/10.55299/jsh.v2i1.1352

Darnela, L., & Rusdiana, E. (2025). Public legal awareness and the effectiveness of Indonesia's Personal Data Protection Law: Bridging normative framework and privacy paradox. Supremasi Hukum: Jurnal Kajian Ilmu Hukum, 14(1), 1–28. https://doi.org/10.14421/2gg2rp29

DP, A. A., Mamonto, A. A. N., Amiq, B., Rambe, K. M., & Syahputra, A. R. (2023). Facial recognition technology: A multinational analysis of regulatory framework, ethics, and legal implications in security and privacy. International Journal of Science and Society, 5(4), 498–510. https://doi.org/10.54783/ijsoc.v5i4.808

Fitriyanti, F., Devty, S., Putri, S., & Thora, R. E. (2024). Securing personal data in e-KYC: Vital for digital economy growth. Diponegoro Law Review, 9(1), 104–120. https://doi.org/10.14710/dilrev.9.1.2024.104-120

Girsang, S. Y. B. (2024). Pentingnya regulasi khusus sistem face recognition technology sebagai produk artificial intelligence dalam peningkatan keamanan dan penegakan hukum di Indonesia. Nommensen Journal of Legal Opinion, 5(2), 86–98. https://doi.org/10.51622/njlo.v5i2.1817

Gunawan, I. (2024). Upaya preventif dan represif dalam penanggulangan kebocoran data pada penyelenggaraan pinjaman online. Officium Notarium, 4(1), 25–49. https://doi.org/10.20885/JON.vol4.iss1.art3

Günay, B. (2023). Biometrische Daten aus der Perspektive der DSGVO. Datenschutz und Datensicherheit, 47(2), 96–99. https://doi.org/10.1007/s11623-023-1724-x

Guo, C., You, L., Li, X., Hu, G., Wang, S., & Cao, C. (2024). A novel biometric authentication scheme with privacy protection based on SVM and ZKP. Computers & Security, 144, 103995. https://doi.org/10.1016/j.cose.2024.103995

Gusnan, Z. K., & Utomo, R. G. (2024). Factors affecting user's acceptance of adopting biometrics technologies using the TAM model. Jurnal Teknik Informatika, 5(4). https://doi.org/10.52436/1.jutif.2024.5.4.2249

Hasan, M. R., Guest, R. M., & Deravi, F. (2023). Presentation-level privacy protection techniques for automated face recognition: A survey. ACM Computing Surveys, 56(13s), Article 286. https://doi.org/10.1145/3583135

Judijanto, L., Solapari, N., & Putra, I. (2024). An analysis of the gap between data protection regulations and privacy rights implementation in Indonesia. The Easta Journal Law and Human Rights, 3(1), 20–29. https://doi.org/10.58812/eslhr.v3i01.351

Karnedi, G., & Alam, R. G. (2025). Evaluasi regulasi perlindungan data pribadi di Indonesia: Komparasi dengan GDPR Uni Eropa. El-Mujtama: Jurnal Pengabdian Masyarakat, 5(3), 610–622. https://doi.org/10.47467/elmujtama.v5i3.8549

Kavoliūnaitė-Ragauskienė, E. (2024). Right to privacy and data protection concerns raised by the development and usage of face recognition technologies in the European Union. Journal of Human Rights Practice, 16(2), 658–674. https://doi.org/10.1093/jhuman/huad065

Kumalasari, R. A. D., Rahardjo, K., Kusumawati, A., & Sunarti. (2024). Biometric-based self-service technology adoption by older adult: Empirical evidence from pension fund sector in Indonesia. Cogent Business & Management, 11(1), 2325543. https://doi.org/10.1080/23311975.2024.2325543

Kusyanti, A., Catherina, H. P. A., Effendrik, P., Santoso, N., & Ekowati, N. S. (2024). “Risky or trustworthy?”: User behavior towards biometric authentication method. Procedia Computer Science, 234, 428–435. https://doi.org/10.1016/j.procs.2024.03.024

Melzi, P., Rathgeb, C., Tolosana, R., Vera-Rodriguez, R., & Busch, C. (2024). An overview of privacy-enhancing technologies in biometric recognition. ACM Computing Surveys, 56(12), Article 310, 1–28. https://doi.org/10.1145/3664596

Mordini, E. (2023). Biometric privacy protection: What is this thing called privacy? IET Biometrics, 12. https://doi.org/10.1049/bme2.12111

Natamiharja, R., & Setiawan, I. (2024). Guarding privacy in the digital age: A comparative analysis of data protection strategies in Indonesia and France. Jambe Law Journal, 7(1), 233–251. https://doi.org/10.22437/home.v7i1.349

Onesi-Ozigagun, O., Ololade, Y. J., Eyo-Udo, N. L., & Ogundipe, D. O. (2024). AI-driven biometrics for secure fintech: Pioneering safety and trust. International Journal of Engineering Research Updates, 6(2). https://doi.org/10.53430/ijeru.2024.6.2.0023

Priyantiwi, R. D., & Hufron. (2025). Ensuring legal protection of personal data in Indonesia's digital identity system. Justitia Jurnal Hukum, 9(2). https://doi.org/10.30651/justitia.v9i2.27113

Putri, D. T. (2025). Regulating digital privacy in Indonesia: The practice of data subject rights and controller duties in the FotoYu app. Istinbath: Jurnal Hukum, 22(2), 230–262. https://doi.org/10.32332/istinbath.v22i02.art01

Qandeel, M. (2024). Facial recognition technology: Regulations, rights and the rule of law. Frontiers in Big Data, 7, 1354659. https://doi.org/10.3389/fdata.2024.1354659

Rahman, F., & Mulyani, C. K. (2025). Minimising unnecessary restrictions on cross-border data flows? Indonesia's position and challenges post personal data protection act enactment. International Review of Law, Computers & Technology, 39(2), 281–300. https://doi.org/10.1080/13600869.2024.2359901

Razi, F., Tuasikal, H., & Markus, D. P. (2024). Implementation and challenges of the Personal Data Protection Law in Indonesia. Jurnal Indonesia Sosial Teknologi, 5(12), 6559–6565. https://doi.org/10.59141/jist.v5i12.1285

Salko, M., Firc, A., & Malinka, K. (2024). Security implications of deepfakes in face authentication. Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing, 1376–1384. https://doi.org/10.1145/3605098.3635953

Sembiring, P. E., Ramli, A. M., & Rafianti, L. (2024). Implementasi desain privasi sebagai pelindungan privasi atas data biometrik. Veritas et Justitia, 10(1), 127–152. https://doi.org/10.25123/vej.v10i1.7622

Sriman, J., Thapar, P., Alyas, A. A., & Singh, U. (2024). Unlocking security: A comprehensive exploration of biometric authentication techniques. 2024 14th International Conference on Cloud Computing, Data Science & Engineering (Confluence). https://doi.org/10.1109/CONFLUENCE60223.2024.10463322

Syailendra, M. R., Lie, G., & Sudiro, A. (2024). Personal data protection law in Indonesia: Challenges and opportunities. Indonesia Law Review, 14(2), Article 4. https://doi.org/10.15742/ilrev.v14n2.4

Taufiq, M., & Kenyo, A. S. (2025). The legal protection of personal data in the digital era: A comparative study of Indonesian law and the GDPR. International Journal of Business, Law, and Education, 6(2), 1260–1268. https://doi.org/10.56442/ijble.v6i2.1178

Vásquez Cerna, J. J., Solano Quincho, L. M., & Mendoza de los Santos, A. C. (2023). La vulnerabilidad de las tecnologías biométricas en la autenticación. Ingeniería Investiga, 5, e866. https://doi.org/10.47796/ing.v5i0.866

Wang, X., Wu, Y. C., Zhou, M., & Fu, H. (2024). Beyond surveillance: Privacy, ethics, and regulations in face recognition technology. Frontiers in Big Data, 7, 1337465. https://doi.org/10.3389/fdata.2024.1337465

Yang, W., Wang, S., Cui, H., Tang, Z., & Li, Y. (2023). A review of homomorphic encryption for privacy-preserving biometrics. Sensors, 23(7), 3566. https://doi.org/10.3390/s23073566

Yusliwidaka, A., Abqa, M. A. R., & Wardana, K. A. (2024). A discourse of personal data protection: How Indonesia responsible under domestic and international law? Pandecta Research Law Journal, 19(2), 453–482. https://doi.org/10.15294/pandecta.v19i2.13279

Zuwanda, Z. S., Judijanto, L., Khuan, H., & Triyantoro, A. (2024). Normative study of Law No. 27 of 2022 on the protection of personal data and its impact on the fintech industry in Indonesia. West Science Law and Human Rights, 2(4), 421–428. https://doi.org/10.58812/wslhr.v2i04.1367