Samarah: Jurnal Hukum Keluarga dan Hukum Islam Volume 9.
No.
March 2025 ISSN: 2549 Ae 3132.
E-ISSN: 2549 Ae 3167 DOI: 10.
22373/sjhk.
Dispute Resolution Mechanisms in Personal Data Leakages:
An Analysis of OJKAos Role and Functions in Indonesia Lia Sautunnida Universiti Malaya.
Kuala Lumpur.
Malaysia Izura Masdina Mohamed Zakri Universiti Malaya.
Kuala Lumpur.
Malaysia Faisal Ahmadi Institut Islam Ma'arif Jambi.
Indonesia Email: liasautunnida@usk.
Abstract: Personal data protection currently has a significant impact on the development of the digital economy in every country in the world, including Indonesia, especially in the financial industry.
The Indonesian Financial Services Authority or Financial Services Authority (OJK) is the authorized body tasked with protecting financial services customers.
However.
OJK's regulations, roles and functions are limited and varied and seem ambiguous in protecting customer Even though various laws, policies and guidelines have been enforced, leakage or theft of financing customer data still occurs.
This study uses a normative legal method with a statutory approach.
Data was collected by studying literature in the form of legal rules and regulations, articles and studies related to the research focus.
This article concludes that the OJK has not been able to overcome the increasing cases of personal data breaches and has not been able to protect the personal data of its customers.
As such, this article aims to analyze the OJKAos role and function in protecting and maintaining the confidentiality of the customers' data.
Furthermore, there will be an analysis of dispute resolution mechanisms in personal data leakages due to the lack of knowledge and references regarding the litigation process and its consequences, it is tough to assess the efficiency of the legal actions taken by the financial institution to establish a balance between the use of personal data and the rights of individuals to privacy.
This study uses a normative juridical method with a statutory approach and utilizes a literature study.
As a result of this analysis and evaluation, it recommends that the Regulation of OJK No.
77/POJK.
01/2016 be revised because it is no longer compatible with current financial technology Keywords: Financial Services Authority, personal data protection, role and function, financial sector ic Submitted: December 10, 2023 ic Accepted: January 09, 2025 http://jurnal.
ar-raniry.
id/index.
php/samarah icPublished: January 15, 2025 Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
Abstrak: Perlindungan data pribadi saat ini memberikan dampak yang signifikan terhadap perkembangan ekonomi digital di setiap negara di dunia, termasuk Indonesia, khususnya di industri keuangan.
Otoritas Jasa Keuangan Indonesia atau Otoritas Jasa Keuangan (OJK) adalah badan berwenang yang bertugas melindungi pelanggan jasa keuangan.
Namun regulasi, peran, dan fungsi OJK terbatas dan beragam serta terkesan ambigu dalam melindungi data nasabah.
Meskipun berbagai undang-undang, kebijakan, dan pedoman telah ditegakkan, kebocoran atau pencurian data nasabah pembiayaan masih saja terjadi.
Kajian ini menggunakan metode hukum normatif dengan pendekatan perundangundangan.
Data dikumpulkan dengan cara studi literatur berupa aturan hukum dan perundangan-undangan, artikel dan kajian terkait dengan fokus penelitian.
Artikel ini menyimpulkan bahwa bahwa OJK belum mampu mengatasi maraknya kasus pelanggaran data pribadi dan belum mampu melindungi data pribadi Selanjutnya akan dilakukan analisis mekanisme penyelesaian sengketa kebocoran data pribadi karena kurangnya pengetahuan dan referensi mengenai proses litigasi dan konsekuensinya, sulit untuk menilai efisiensi tindakan hukum yang diambil oleh lembaga keuangan untuk menetapkan keseimbangan antara penggunaan data pribadi dan hak individu atas privasi.
Penelitian ini menggunakan metode yuridis normatif dengan pendekatan perundang-undangan dan memanfaatkan studi literatur.
Tulisan ini mengevaluasi beberapa peraturan perundang-undangan yang relevan mengenai peran dan fungsi OJK serta mengamati Layanan Ombudsman Keuangan di Inggris sebagai perbandingan.
Dari hasil analisis dan evaluasi tersebut, direkomendasikan agar Peraturan OJK No.
77/POJK.
01/2016 direvisi karena sudah tidak sesuai lagi dengan perkembangan teknologi keuangan saat ini.
Kata Kunci: Otoritas Jasa Keuangan, perlindungan data pribadi, peran dan fungsi, sektor keuangan Introduction The Financial Services Authority (Otoritas Jasa Keuangan/OJK), was established as a new institution in 2012.
1 The OJK is an independent institution that has the role, function, and authority to regulate laws that provide supervision and regulation of the development of business types in the financial services one of which is by using technological advances, namely Financial Technology (Fin-tec.
2 OJK has such authority as is provided for by the Bella Kharisma, et.
, "The Role of the Financial Services Authority (OJK) in Preventing Illegal Fintech Landing in the COVID-19 Pandemic in Indonesia.
" In International Conference on Human-Computer Interaction, .
, p.
Subir Kumar Roy.
AuConsumer Justice: A Symbol of Economic Prosperity and Social Progressiveness,Ay Hasanuddin Law Review 2.
No.
Abdul Aziz and Iis Nur'aisyah.
"Role of the Financial Services Authority (OJK) to Protect the Community on Illegal Fintech Online Loan Platforms.
" Journal of Research in http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
provisions of Law Number 21 of 20113 concerning the Financial Services Authority (OJK).
According to Tektona.
, et al stated that several authorities, including the Financial Services Authority (OJK).
Bank Indonesia (BI), the Supreme Court, the Ministry of Finance, and LPS .
he Deposit Insurance Corporatio.
, have cited fatwa as the basis for legal codification.
4 The clauses used in the regulations of those institutions have adopted the fatwa's editorial, as stated in the OJK Regulation Number 33/POJK.
04/2019 on the Issuance and Requirements for Sharia Mutual Funds, the Minister of Finance Regulation Number 125/PMK.
08/2018 on the Issuance and Sale of Retail State Sharia Securities in the Domestic Primary Market, the LPS Regulation on the Settlement of Troubled Banks, and the PBI (Bank Indonesia Regulatio.
Number 11/33/PBI/2009 on the Implementation of Good Corporate Governance for Sharia Commercial Banks.
In recent years, numerous lawsuits have been filed by individuals seeking legal redress for losses caused by the loss or theft of their personal information.
However, due to the lack of knowledge regarding the litigation process and its results, it is challenging to assess the effectiveness of the legal actions taken by the financial institution to achieve a balance between the use of personal data and the rights of individuals to privacy.
Related to the dispute settlement mechanism.
OJK has the role and function of protecting customer's rights and OJK also has issued several rules and circular letters in settling the case.
There are general issues with public legal awareness, poor regulation, and law enforcement on personal data protection in Indonesia, especially in the financial sector.
It is thought that up to 1.
3 billion SIM card registration data, which includes population identification numbers, telephone numbers, cellular carriers utilized, and dates of use were leaked and traded on dark sites.
7 This undoubtedly has an impact on the protection of personal data for financial Business and Management 9.
No.
Nurhasanah Nurhasanah and Indra Rahmatullah.
AuFinancial Technology and the Legal Protection of Personal Data: The Case of Malaysia and Indonesia,Ay Al-Risalah: Forum Kajian Hukum dan Sosial Kemasyakatan 20.
No, 2 .
Laws of the Republic Indonesia Number 21 of 2011 About Financial Services Authority.
Rahmadi Indra Tektona, et.
AuThe Act Protection for Islamic Banks in Financing Land and Rubber Plantation Ownership,Ay Samarah: Jurnal Hukum Keluarga dan Hukum Islam 4.
No.
, p.
Erike Anggareni, et.
AuUtilizing the Banking System for Digital Waqf Behavioral Approach of Millennial Muslims,Ay El-Usrah: Jurnal Hukum Keluarga 7.
No.
Muhammad Maksum, et.
AuSharia Service as an Added Value: Response to Sharia Standard in Hospital Service,Ay Samarah: Jurnal Hukum Keluarga dan Hukum Islam 6.
No.
, p.
Shasa Romanosky, et.
AuEmpirical analysis of data breach litigation,Ay Journal of Empirical Legal Studies 11.
No.
, p.
Agus Tri Haryanto.
Polisi Usut Penyalahgunaan NIK Registrasi SIM Card Sembarang.
December https://inet.
com/law-and-policy/d-4337764/polisi-usutpenyalahgunaan-nik-registrasi-sim-card-sembarang.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
institutions' customers.
for example, personal data that was misused by irresponsible banking staff caused harm to customers.
8 The case of Ilham Bintang occurred in 2020, in which he suffered losses at two banks: Commerce International Merchant Bankers/CIMB: IDR.
200 million loss and Indonesian State Bank (Bank Negara Indonesia/BNI): IDR.
83 million los.
In this case, there was an involvement of a related Internet Service Provider (Indosa.
as well as a deceptive Bank employee who had access to the OJK Slik and disclosed the customer's data (ID Number (NIK) and mobile phone numbe.
There are public concerns about the issues, so it was hoped that the government would devote more attention to resolving them and ensuring that there is a specific and comprehensive regulatory framework in place to protect personal data in the financial sector.
To the preceding discussion, this paper looks at first, whether the issues presented affect the potential for disclosure of banking customers' data.
secondly, discusses several applicable laws and regulations on personal data protection, and thirdly, reviews the role and function of the OJK, including whether its main duties and responsibilities were conducted properly by Financial Services Authority (OJK) especially in the security and confidentiality of banking customersAo data in Indonesia.
Several articles discuss the authority possessed by the OJK about its duties and functions as well as explain the challenges OJK faces in handling its primary duties and authorities.
As Atikah wrote in her article10 in Indonesia innovation that OJK must face is to create a balance between increasing financial inclusion and risk management, improving people's understanding of fintech services, and data protection for consumers.
Fintech must collect more consumer data so that the lending and borrowing process becomes more efficient and effective.
The Financial Services Authority's (OJK) role is to supervise and make policy for all financial services activities, including fintech, under Act No.
21/2011, by implementing consumer protection priorities through electronic agreements that refer to Article 1 point 3 of Regulation OJK No.
77/ 2016.
The financial services authority is constantly attempting to encourage the use of fintech system services, as evidenced by POJK No.
13/2018 on Digital Financial Innovations in the Financial Services Sector.
The OJK purposefully created the regulation so that the Khadijah Shahnaz.
Menkominfo Minta Masyarakat Jaga NIK usai Data Kartu SIM Bocor.
September https://teknologi.
com/read/20220904/101/1573835/menkominfo-minta-masyarakat-jaganik-usai-data-kartu-sim-bocor.
https://w.
id/berita/q57zdg328/pembobolan-rekening-ilham-bintangberawal-dari-bocornya-data.
Ika Atikah, "Consumer Protection and Fintech Companies in Indonesia: Innovations and Challenges of The Financial Services Authority.
" Jurnal Hukum dan Peradilan 9, no.
, p.
Hamsir, "Investigation Authorities of Financial Services Authority in Syariah Banking.
" Jurnal Dinamika Hukum 15, no.
, p.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
fintech service system innovates and is registered in OJK as a fintech company that complies with and implements OJK regulations.
According to OJK Circular No.
14/SEOJK.
07/2014,11 consumer personal data and information are the name, address, place of birth, date of birth, age, telephone number, name of the individual's biological mother, information of directors or commissioners in a company .
ncluding their identity document.
and the composition of a company's shareholders.
The earlier OJK regulations are also clarified by this circular.
It now requires financial sector business players (PUJK), such as banks, to explain to customers the goals and consequences of providing written consent to the use of personal data and/or information by banks, third parties, or related companies.
Currently, the Indonesian Financial Service Authority (OJK) shares the fin-tech category in 5 categories as follows: .
Fin-tech engaged in payment, transfer, and remittance.
Equity-based crowd and loan-based funding: .
Fintech engaged in investment and financial management.
Insurance fin-tech Marketplace fin-tech.
Marketplace fin-tech.
As observed by Noptabi, et.
, in their study on the legal protection of personal data of financial technology (Fintec.
, which is based on online loans in terms of the Consumer Protection Act,14 they found that legal protection of consumer personal data has been regulated by the Financial Services Authority (OJK) Circular and the Regulation of the Minister of Communication and Information concerning confidentiality, integrity and security of consumer personal data or information and the legal consequences of personal data violation, which is regulated in Article 47 of the Authority Regulation.
Financial Services Number 77/POJK.
01/2016 is an administrative sanction, then there is the Personal Data Protection Bill will regulate criminal sanctions.
10 That The study made it clear that the legal protection of consumer personal data has been regulated by the Financial Services Authority (OJK) Circular, the Regulation of the Minister of Communication and Information concerning confidentiality, integrity, and security of consumer personal data or information and the legal consequences of personal data violation, is regulated in Article 47 of the Authority Regulation.
Financial Services Number 77/POJK.
01/2016 is an administrative sanction, the personal data protection bill will regulate criminal sanctions.
Circular Letter of OJK Number 14/SEOJK.
07/2014 Article 1 Paragraph 1.
Circular Letter of OJK Number 14/SEOJK.
07/2014 Article 2 Paragraph 6 letter a.
Dian Purnama Anugrah and Masitoh Indriani, "Data Protection in Financial Technology Services (A Study in Indonesian Legal Perspectiv.
," Sriwijaya Law Review 2, no.
, p.
Iim Saputra Noptabi, et.
, "Legal Protection of Personal Data Financial Technology Based Online Loans from The Consumer Protection Act.
" Walisongo Law Review 4, no.
Abdul Nasser Hasibuan.
AuThe Role of Company Characteristics in the Quality of Financial Reporting in Indonesian,Ay Jurnal Ilmiah Peuradeun 10.
No.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
In the research conducted by Susanto stipulated that with the passage of Law No.
21/2011, the Financial Services Authority was established, with supervisory authority over all financial service providers, including banking, which was previously supervised by the central bank.
This includes ensuring the confidentiality of customers' personal information.
This provision was later reaffirmed by OJK Regulation (POJK) No.
1/POJK.
07/2013 concerning Consumer Protection in the Financial Services Sector, which emphasizes in point Article 2 letter .
that the basic consumer protection principles that OJK must follow are based on the principles of confidentiality and security of consumer data/information.
This POJK includes a special chapter that governs consumer protection oversight in the financial services sector, which is entirely under the authority of the OJK.
It clearly shows that OJK has played a significant role in protecting personal data in the financial system in Indonesia.
OJK even has a more comprehensive list of consumer personal data and/or information that needs to be kept private in OJK Circular Letter Number 14/SEOJK.
07/2014 concerning Confidentiality and Security of Consumer Personal Data and/or Information.
Mangku, et.
al, in their article stated that Law No.
21 of 2011 concerning the Financial Services Authority (OJK).
According to this law, the OJK has supervisory authority over all financial service providers, including banks that were previously supervised by the central bank.
This law is one of the few controls covering the confidentiality of a customer's data.
This provision was later reinforced by OJK Regulation (POJK) No.
1/ POJK.
07 /2013 concerning consumer protection in the financial services sector.
In this.
Article 2D stated that the basic principles of consumer protection that the OJK must embrace are based on the principles of confidentiality and the security of consumer data.
Aziz.
et, al.
stipulated that the Financial Services Authority (OJK) provides supervision and regulation of the development of types of businesses in the financial services sector in Indonesia.
OJK has a very important role in protecting the public against illegal fintech online lending platforms (Peer to Peer Lending.
This study showed that OJK's role and responsibility is not simply protecting customers in the banking industry but also includes concerns on lending and borrowing practices.
The Financial Services Authority's (OJK) responsibility for defending the public from fraudulent fintech online lending platforms (Peer-to-peer lendin.
Online loans are becoming more and more Deny Susanto, "Sharia-Based Legal Formula for Personal Data Protection in The Financial Services Industry Post-Covid-19 Pandemic," BULLET: Jurnal Multidisiplin Ilmu 1, no.
, p.
Muhammad Khaeruddin Hamsin, et,al.
AuSharia E-Wallet: The Issue of Sharia Compliance and Data Protection,Ay al-Manahij: Jurnal Kajian Hukum Islam 17.
No.
Dewa Gede Sudika Mangku, et.
, "The Personal Data Protection of Internet Users in Indonesia.
" Journal of Southwest Jiaotong University 56, no.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
prevalent because of the COVID-19 pandemic, hence OJK plays a critical role in preventing and protecting the public from such loans.
So far, very little research has been conducted on the preventative measures of customer data leakage, which causes material losses for banking Furthermore, legal settlements for customer data leaks seem to be Therefore, this article explores the following research questions.
constitutes banking customersAo data, and what is the applicable legal basis governing it, how is legal protection for banking customers related to personal data theft and what are the legal theories governing the protection of personal Whether OJK is an independent body able to assist and solve the leakage of personal data cases in the banking sector.
This study uses a normative legal method with a statutory approach.
Data was collected by studying literature in the form of legal rules and regulations, articles and studies related to the research Personal Data Leakage Regulation in the Banking Sector Referring to the Circular Letter of the Financial Services Authority Number 14/SEOJK.
07/2014 on the confidentiality and security of data and/or personal information of consumers, personal data that must be protected are as follows: .
Individual data that include name, address, age, date of birth, phone number, and information related to the name of the birth mother.
Company data that contain information about the name, company address, phone number, board of directors, shareholders, identification evidenced by the board of directorsAo I.
card or passport, and a certificate of residence permit for The enactment of Law No.
21 of 2011 on Financial Services Authority .
ereinafter OJK) in 2011 marked the birth of the agency in charge and authorized to carry out supervision, inspection, and investigation in the financial services The authority is listed in the provisions of Article 9, which is to supervise, inspect, and investigate consumer protection, and other actions against Financial Services Institutions, perpetrators, and/or financial services activities.
Article 31 of the OJK Law, stipulates that the protection of consumers and the public in the financial services sector is regulated by OJK regulations.
On the order of Article Abdul Azis and Iis NurAoaisyah, "Role of the Financial Services Authority (OJK) to Protect the Community on Illegal Fintech Online Loan Platforms.
" Journal of Research in Business and Management .
Fithriatus Shalihah and Roos Niza Mohd Shariff.
"Identifying Barriers to Data Protection and Investor Privacy in Equity Crowdfunding: Experiences from Indonesia and Malaysia.
" UUM Journal of Legal Studies 13, no.
, p.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
31 of this article, a regulation in the field of consumer protection was also With OJK Law, the unification of regulation and supervision of the financial services sector was formed.
The authority was previously exercised by the Ministry of Finance.
Bank Indonesia.
Capital Market Supervisory Agency, and financial institutions.
This study discusses the legal concept of the authority to regulate and supervise financial institutions in the banking sector by the Financial Services Authority (OJK) and Bank Indonesia.
Although laws and regulations explicitly describe the role and function of OJK towards the protection of customer data, there are still many cases of irresponsible people trying to abuse customer personal data in the field.
People may also receive calls, texts, or e-mails from people they don't know, offering credit cards, insurance, or loans, among other things, even though they never give their personal information to anyone.
Of course, customers/consumers feel Thus, the enactment of Law No.
21 of 2011 on Financial Services Authority (OJK) in 2011 marked the birth of the agency in charge and authorized to carry out supervision, inspection, and investigation in the financial services The authority was previously exercised by the Ministry of Finance.
Bank Indonesia.
Capital Market Supervisory Agency, and financial institutions.
When it comes to the security of personal data in the banking industry there are numerous legislations regulating personal data protection.
Without a doubt, the banking sector has the legal responsibility to protect the data of its banking customers.
The civil requirement arises from the fact that the relationship between the customers and the bank is both a fiduciary and a confidential one, implying that both trust and confidentiality are moral obligations.
Given that the bank is a community trust institution .
iduciary financial institutio.
, it has a highly noble vision and mission as an entity charged with achieving the goal of enhancing people's living conditions.
The basis of the bank's relationship with the client is the trust or fiduciary relationship, which states that the bank must consider the interests of customers, both depositors and fund users, in addition to its own.
Contracts and other agreements can create a fiduciary duty, as can be a connection between two people.
Customers and banks have a relationship, thus if Desak Putu Dewi Kasih, and Putu Devi Yustisia Utami.
"Standard Contract on Banking Sector: Regulation and Description in Internal Banking Regulations.
" Jurnal Magister Hukum Udayana 10, no.
, p.
Asep Hary et.
, "Authority of Banking Supervision and Regulation by Bank Indonesia and Financial Services Authority (OJK).
" YURISDIKSI: Jurnal Wacana Hukum Dan Sains 14, no.
, p.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
a bank affects a consumer by engaging in risky or unethical behavior, that bank could be held liable for a breach of fiduciary duty.
In the banking system, if a party is found guilty of violating the personal data of banking customers, such as stealing personal data and then hacking the customer's savings book, the punishments are based on the applicable criminal 22 Criminal provisions relating to bank secrecy are regulated in Article 47 which reads: ".
Anyone without a written order or permission from the Management of Bank Indonesia as referred to in Article 41.
Article 41A, and Article 42, deliberately forces the bank or Affiliated Party to provide information as referred to in Article 40, is punishable by imprisonment of at least 2 .
years and a maximum of 4 .
years and a fine of at least IDR.
10,000,000,000.
en billion rupia.
and a maximum of IDR.
200,000.
000,000.
wo hundred billion rupia.
Members of the Board of Commissioners.
Directors, bank employees, or other Affiliated Parties who knowingly provide information that must be kept confidential under Article 40, shall be punished with imprisonment of at least 2 .
years and a maximum of 4 .
years and a fine of at least.
minimum of IDR 4,000,000,000.
our billion rupia.
and a maximum of IDR 8,000,000,000.
ight billion rupia.
Ay, and Article 40 paragraph .
of the Banking Law has been amended based on the Decision of the Constitutional Court No.
64 / PUU-X / 2012 dated 27 July 2012, to become: AuBanks are required to keep information regarding their depositing customers and their deposits confidential, except in the cases referred to in Article 41.
Article 41A.
Article 42.
Article 43.
Article 44, and Article 44A as well as for judicial interests regarding joint assets in divorce cases Ay.
Article 1 number 18 of the Banking Law states that Aubank secrecy is a contractual relationship between a bank and a debtor client that includes an implied term that the bank is required to keep information about the debtor customer confidentialAy.
24 As it also related to Article 1 number 28 stipulates that AuBank secrecy refers to all information about depositors and their depositsAy.
This is supported by the principle of agreement, as defined in Article 1339 of the Inka Candra Kharizma, "The Bank Liability for The Loss of Customer Funds (Supreme Court Decision No.
41 PK/Pdt/2.
" .
Hendrik Agus Sutiawan, et.
, "Perlindungan Nasabah Terkait Praktik Pembukaan Rahasia Bank oleh Pegawai Bank dalam Proses Penegakan Hukum Tindak Pidana Pencucian Uang Dihubungkan dengan Asas Kepastian Hukum.
" Jurnal Hukum & Pembangunan 48, no.
, p.
Andi Aina Ilmih, "Law Enforcement and Prevention of Banking Criminal Actions in Indonesia.
" Turkish Journal of Computer and Mathematics Education 12, no.
, p.
Article 1 Number 18 of Banking Laws of the Republic of Indonesia Number 7 Year 1992 as Amended with Law Number 10 Year 1998.
Article 1 Number 28 of Banking Laws of the Republic of Indonesia Number 7 Year 1992 as Amended with Law Number 10 Year 1998.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
Civil Code, which states that Auan agreement is binding not only on items that are specified in it, but also on everything that is needed by propriety, tradition, or law according to the nature of the agreementAy.
26 Meanwhile.
Article 40 governs the responsibility to protect bank secrecy, except in the cases referred to in Articles 41, 41A, 42, 44, and 44A.
Banking Law Number 10 Year 1998 Chapter I.
General Provisions on Article 1 stated several explanations regarding customer data.
27 Based on the above Banking Law regulations, it is clear that personal data protection is not specifically regulated in the Banking Law.
Customer personal data, on the other hand, is still classified as something that must be kept confidential when conducting business or transactions in the banking sector.
Because the bank and the customer have a contractual relationship, the bank must protect the customer's Banking activities between the bank and its customers are handled under the Fiduciary Principle.
If the bank can ensure that all information about the consumer will be kept confidential, society will commit to saving his money to the bank.
To retain client faith in the bank's ability to conduct business, the secrecy principle must be followed.
The bank secrecy concept is a type of commitment and bank protection in the storage of customers' data.
28 The rule of law of bank secrecy is a rule that places the bank as the party that is obliged to take care of all information related to depositors and their deposits.
Therefore, the banking sector has the authority to protect the data of its banking customers.
The bank must keep bank secrecy that is governed by both civil and criminal law.
If a party is found guilty of violating the personal data of banking customers, such as stealing personal data and then hacking the customer's savings book, the punishments are based on the applicable criminal laws.
Banking activities between a bank and its customers are handled by the Fiduciary Principle.
Because the bank and the customer have a contractual relationship, the bank must protect the customer's interests.
Customer personal data is still classified as something that must be kept confidential.
Establishment.
Role.
Function and Authority of OJK The Financial Services Authority OJK is defined as a state institution with functions and obligations related to the implementation of an integrated system of financial services industry regulation and supervision.
30 The establishment of the Article 1339 of the Civil Code.
Article 1 of Banking Law No.
10 Year 1998 Chapter 1.
Marnia Rani, "Perlindungan Otoritas Jasa keuangan Terhadap kerahasiaan dan keamanan data pribadi Nasabah Bank.
" Jurnal Selat 2, no.
, p.
Reggy Ryan Syahputra Najoan Theo, "Proses Dan Akibat Hukum Membuka Rahasia Bank.
" Lex Privatum 3, no.
Marihot Simanjuntak and Wiwik Sri Widiarty, "The Role of The Financial Services Authority (OJK) In Fostering and Supervising the Insurance Industry Associated with The http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
OJK began with concern from numerous parties over the supervision powers of Bank Indonesia.
The establishment of financial services authorities is motivated by three factors: the rise of the service sector of financial services in Indonesia, cross-sectoral financial services industry challenges, and the mission of Law No.
3 of 2004 regarding Bank Indonesia (Article .
about Bank Indonesia is a response to the Asian crisis that happened in 1997-1998, which had a significant impact on Indonesia, particularly the banking industry.
OJK was founded to take over the job of Capital Market and Financial Institution Supervisory Agency (Bappepam-LK), so that OJK may execute comprehensive control over financial institutions, from monitoring and regulation to investigating emerging cases of corruption.
32 Based on Article 1 Paragraph .
of the Law Number 21 of 2011, the Financial Services Authority (OJK) is an independent and free institution from the interference of the other party, which has functions, duties, and authorities regulation, supervision, inspection, and investigation as intended with this law.
There are 3 duties of OJK:
Regulating and supervising financial service activities, both in the banking and non-banking sectors.
Regulating and supervising financial service activities in the Capital Market sector.
Regulating and supervising financial service activities in the Insurance.
Pension Fund.
Financing Institutions, and Other Financial Institutions sectors.
Several authorities of OJK in regulatory and supervisory duties:
Establish laws and regulations in the financial services industry.
Create and establish regulations on supervision in the financial services industry.
Create and establish policies regarding the implementation of OJK .
Regulate the procedures for determining statutory managers in financial service institutions.
Regulates the organizational structure and infrastructure, as well as the management of assets and liabilities.
Availability OJK Contributions Indonesia's Economic Development Construction.
" International Journal of Environmental.
Sustainability, and Social Science 3, no.
, p.
Azis Abdul and Iis NurAoaisyah, "Role of the Financial Services Authority (OJK) to Protect the Community on Illegal Fintech Online Loan Platforms.
" Journal of Research in Business and Management .
Uu Nurul Huda.
AuThe Effect of Cancellation of Regional Regulations on Retribution Toward Regional Financial Regency In West Java,Ay De Jure: Jurnal Hukum dan Syariah 12.
No.
Yulia Hesti, "Analisis Yuridis Tujuan dan Kewenangan Otoritas Jasa Keuangan (OJK) Dalam Lembaga Perbankan di Indonesia.
" Pranata Hukum 13, no.
Article 1 Paragraph .
of the Law Number 21 of 2011 http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
Create and stipulate regulations on procedures for imposing sanctions based on the prevailing laws and regulations in the financial services .
Create and establish policies regarding procedures for the supervision of the financial services industry.
OJK can carry out supervision, examination, investigation, consumer protection, and other actions against Financial Services Institutions.
Provide administrative sanctions to parties who violate the laws and regulations in the financial services sector.
OJK has the authority to issue and/or revoke business licenses, ratifications, and other stipulations in the laws and regulations in the financial services sector.
It can be concluded that the Financial Services Authority (OJK) was established to take over the job of the Capital Market and Financial Institution Supervisory Agency (Bappepam-LK).
and is a state institution that is independent and free from interference from other parties in carrying out its duties.
It may execute comprehensive control over the financial services industry .
uch as Capital Market.
Insurance.
Pension funds, financial institutions, and other financial service providers, from monitoring and regulation to investigating emerging cases of corruption.
Rules and Policies of OJK related to Banking CustomerAos Personal Data Based on the author's examination of the OJK's function and authority, it can be determined that the OJK's obligations and authorities relating to the protection of banking customers' data are not clearly stated explicitly in several current applicable legislation and regulations.
This is quite unreasonable given that one of the initial reasons for the establishment of OJK was to protect banking customer data as part of financial services.
The duties of the OJK regarding customer personal data seem to be highlighted more in terms of what should be done in the case of a breach than in terms of what should be done to avoid one.
For instance, when addressing client losses caused by account breaches.
OJK has to protect the interests of consumers and the public in the form of refunds of customer deposits as stated in Article 4 of Law Number 21 of 2011 concerning the Financial Services Authority and POJK Number 1/POJK.
07/2013.
In addition to that OJK also has supervisory duties in the banking sector so OJK is fully responsible for banking operational activities that are detrimental to the public, one of which is the OJK has the authority to give a warning to the bank if there https://w.
com/vid/finansial/pengertianojk.
html#pengertian_ojk_otorit as_jasa_keuangan.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
are deviations in activities that need to be corrected immediately.
35 Also related to the duties of OJK as mentioned above on point g that OJK can carry out supervision, examination, investigation, consumer protection, and other actions against Financial Services Institutions.
In its implementation.
OJK provides customer complaint services to provide legal defense to protect against losses incurred, including in the form of warnings to banks and requests to provide compensation in the form of refunds of customersAo deposits lost.
Then OJK will create a mechanism for resolving the complaint by taking certain action toward the bank directly.
Furthermore.
OJK's responsibility begins with the provision of complaint services and settlement mechanisms through lawsuits, while in terms of sanctions.
OJK is still weak and has not been able to provide firmness and coercion and to ensure the Bank provides compensation appropriately to customers.
36 This situation is still a duty for the Indonesian government to strengthen the position of the OJK to carry out its role optimally and to represent the public interest in the future.
OJK is not able to function on its own to provide legal redress to customers, so it requires the involvement of the Deposit Insurance Corporation to cooperate and coordinate with banks to return lost customer deposits.
The Deposit Insurance Corporation aims to provide guarantees for the safety of customer funds and ensure bank payment obligations for customer losses.
If the bank is legally proven guilty and fails to protect the consumer, the Deposit Insurance Institution will issue a guarantee of compensation in the form of a customer return.
The client must be able to demonstrate in his complaint that the bank was negligent in performing its duty to preserve the customer's funds, resulting in serious damage.
The Deposit Insurance Corporation will only pay out a maximum of 2 billion rupiah in compensation.
If reviewed further, there is a weakness in the legal protection as a result of the maximum limit of compensation of only around 2 billion rupiah, this situation raises the question of how legal protection and refund guarantee for customers who have losses of more than the maximum limit of 2 billion.
Unfortunately, they will only get a partial refund of the total losses suffered, while the remaining funds will not get a refund except by filing a new lawsuit or taking the arbitration legal settlement.
In addition, the funds guaranteed by the Deposit Insurance Corporation are only in the form of refunding previous savings money, giro, and deposit only, while the institution has not guaranteed funds in the form Rizky Maharani Prastita, "Peran OJK Dalam Proses Pengembalian Dana Nasabah Bank Yang Hilang Dan Keseuaiannya Dalam Perspektif Islam.
" Al-Irfan: Journal of Arabic Literature and Islamic Studies 1, no.
, p.
Rizky Maharani Prastita, "Peran OJK Dalam Proses Pengembalian Dana, p.
Istiqlaliyah Tri Utami and Muhammad Taufiq, "Analisis Yuridis Kasus Pembobolan Rekening pada Bank Mandiri.
" Jurnal Ilmiah Living Law 10, no.
, p.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
of mutual funds.
38 Even though mutual funds are also one type of deposit that is in demand by many customers due to minimal risk, this type of deposit should also be regulated for public protection by the government to provide full guarantees to customers from losses caused by account breaches.
Meanwhile, there is further scrutinization regarding the liability for the loss of customers' accounts under the authority of Bank Indonesia as the regulator and supervisor of the banking system.
In carrying out this responsibility.
Bank Indonesia has the authority to impose sanctions.
However, before imposing sanctions on guilty banks.
Bank Indonesia has provided a Banking Mediation forum to bring customers together with troubled banks to determine the best dispute resolution mechanism offered for both parties.
This banking mediation service is used when the customer does not get legal certainty from the bank for the financial losses refund that are being experienced, such as when the customer having difficulty proving that the bank is guilty and difficult to get compensation rights from the bank.
However, it should be noted further that the banking mediation forum is only useful for bringing together customers and banks to review the disputes that are fundamentally arising to produce a mutual 39 In addition, the main function of this banking mediation service is to minimize the risk of confusion in the courts and prioritize the element of deliberation to reach out agreement between customers and banks.
To sum up, the OJK's obligations and authorities relating to the protection of banking customers' data are not specified in the current applicable regulation.
This is quite unreasonable given that one of the initial reasons for its establishment was to protect banking customer data as part of financial services.
The Indonesian government still must strengthen the position of the OJK.
The Deposit Insurance Corporation aims to provide guarantees for the safety of customer funds and ensure bank payment obligations for customer losses.
If the bank is legally proven guilty and fails to protect the consumer, the Deposit Insurance Institution will issue a guarantee of compensation in the form of a customer return.
Mutual funds are also one type of deposit that is in demand by many customers due to minimal Next, this type of deposit should also be regulated for public protection by the government.
There is further scrutinize regarding the liability for the loss of customers' accounts under the authority of Bank Indonesia.
Cases on Personal Data Leakages The following cases show the importance of proper protection of customerAos data, as the consequences of its breach can be severe.
In some cases.
Istiqlaliyah Tri Utami and Muhammad Taufiq.
"Analisis Yuridis Kasus Pembobolan.
Istiqlaliyah Tri Utami and Muhammad Taufiq.
"Analisis Yuridis Kasus Pembobolan, http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
such as the case, when a senior journalist.
Ilham Bintang, had his account breached, the Bank objected to paying compensation for the amount claimed by the customer and the OJK, which consisted namely the amount of the lost deposit Instead, the bank filed an anti-loss obligation by paying half or below the amount of the customerAo lost funds, so he had to file a new lawsuit to the Court to demand that the bank provide full compensation by the amount of the lost deposit funds to get his money back, as what was his right.
In the case above, there were at least two factors that caused the leakage of customer personal data.
These factors can be classified into internal and external factors.
On internal factors, the leakage of customer data occurs due to unscrupulous and irresponsible bank employees who trade the customer's data to third parties.
As for the external factors, according to Kartika Wirjoatmodjo.
President Director of PT Bank Mandiri, the leakage of customer personal data can occur whenever a large number of transactions made by customers at merchants .
ellers of goods/service.
with non-cash payments using debit cards or electronic trading transactions .
-commerc.
This is because some merchants have a capture .
tool, whereby the customer's cards are sometimes double-swiped, at EDC (Electronic Data Captur.
machines and merchant machines.
The second swipe on the merchant's machine can record the customer's identity even though the swipe can only be done on the EDC machine.
Thus.
Kartika advised the public to be more careful when registering accounts on e-commerce sites that include a lot of personal data, because the more data that is circulating in various places, the greater the chances are for personal data leakage.
Based on a case study conducted at PT Bank Pembangunan Daerah Jawa Timur Tbk,41 it is found that regarding the accountability of banks in their execution, the banks apply the principle of responsibility with limitations.
Due to this limitation of liability, the bank will not be entirely liable for account breaches that occur due to circumstances other than its negligence.
However, it takes significant work to demonstrate a bank's negligence.
If it is further considered, the customer will be held responsible for his negligence if he is unable to adequately explain the process of his account breaches.
There are several provisions and requirements under which the bank will apply limited liability as follows:
The Bank will only be responsible for customers who have the completeness and accuracy of personal document files by the orders, so https://money.
com/read/2017/03/25/171500226/dirut.
Devanto.
Satrio Pradana, and Munawar Kholil.
"Perlindungan Hukum Nasabah Dalam Transaksi Melalui Internet Banking (Studi di PT Bank Pembangunan Daerah Jawa Timur Tbk.
)," Jurnal Privat Law 6, no.
, p.
https://w.
com/tech/20211022114132-37-285776/data-nasabahbank-jatim-diduga-bocor-dijual-rp-35-miliar http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
customers are required to check the completeness of the files before making a complaint because the bank will not be responsible for the impact of negligence and vagueness/inaccuracy of data/information from The customer is required to report if there is a condition where the customer cannot use the Internet banking PIN to the bank before receiving a written notification letter of the breaches from the investigation.
The bank will not be responsible for the misuse of the registration password/User ID and PIN, so the bank is exempt from the claim for it.
The abuse is under the responsibility of the Token holder, namely the customer himself.
The responsibility of the banking party for the protection of the customer's data and account is very limited, while there is a lot of responsibility imposed on the customer for negligence or the impact of incomprehension of the use of Internet banking.
This certainly creates a gap in legal protection between banks and customers because if it is further assessed responsibility with this restriction cannot be applied optimally and must be accompanied by the principle of presumption of always being responsible as stipulated in the ConsumersAo Protection Law (UUPK).
This principle of presumption of always being responsible is useful for avoiding unilateral release actions by the bank so that the customer is not the only one responsible for the losses he suffers and is ensured to obtain legal certainty from the competent authorities.
Unfortunately, this principle is often not applied in the initial agreement between the bank and the customer so if there is a breach of account, it is difficult for the customer to ask for compensation from the bank because there are restrictions on liability agreed upon the beginning of the account opening 44 As a result, if the customer is unable to claim compensation from the bank, they can refer to OJK for assistance in reclaiming their rights/money as stipulated in Law No.
21 of 2011 regarding authorities of OJK in regulatory and supervisory duties that: point .
OJK can carry out supervision, examination, investigation, and consumer protection, and other actions against Financial Services Institutions and point .
Provide administrative sanctions to parties who violate the laws and regulations in the financial services sector.
Not only the above cases, personal data about customers is widely disseminated among businesses that use direct telephone marketing which can be situations such as a phone call to give direct offers of financial products .
nsurance, business capital, and unsecured loan.
The people in Indonesia have Reggy Ryan Syahputra Najoan Theo, "Proses Dan Akibat Hukum, p.
Reggy Ryan Syahputra Najoan Theo, "Proses Dan Akibat Hukum, p.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
recently complained and argued that such activities are telemarketing activities which are classified as direct marketing.
Such telemarketing practice is done without prior public approval and can cause several issues.
one of which is the transfer of personal data from customers or the public, which is not following ethical principles.
45 When this occurs, the public ought to be able to direct their complaints of such intrusive telemarketing operations to the Financial Services Authority (OJK) by referring to Regulation of Financial Services Authority Number: 1/POJK.
07/2013 about Financial Services Sector on Customer Protection.
In most cases, customers have begun to be overwhelmed by settlement mechanisms that not only take a long time but are also costly.
As such, most would not be willing to continue with the action or even bring it to court.
As a result, the turnover of deposit funds in half of the total deposits lost is reluctantly Bank IndonesiaAos protection and supervision are still very weak because they cannot force banks to provide full compensation to customers.
so, customer rights have yet to be fully realized.
In other cases, customers need help from several other institutions such as the OJK and the Indonesian Consumer Institution Foundation (Yayasan Lembaga Konsumen Indonesia/YLKI) to fight for their financial compensation rights because the banking mediation forum is only an intermediary to determine the guilty party and will carry out compensation.
Meanwhile, the amount of such compensation will be handed over to each party according to the agreement.
this case, the bank has the potential to raise objections to pay all losses and will only pay half of it, so customers need help from OJK and YLKI to mediate with the bank and reach a wise agreement.
However, this is a difficult step to carry, in its implementation the customer must file a new lawsuit with the court to demand that the bank return all amount of the customer's funds that have been completely lost in the form of compensation.
This settlement mechanism does have the potential guarantee to provide a refund of deposits to the customer if the trial is won by the customer.
However, it is necessary to pay attention to the efforts to resolve cases that are numerous, pedantic, and inconvenient for customers who are still unfamiliar with the courts' procedure flow, while also wasting time and money to pay expensive trial costs, not to mention the existence of injunctive relief and pauses at every stage in the court, which further delays the flow of dispute resolution.
So that if it is reviewed further, in the end, the responsibility of proof and efforts to refund deposits is more burdened on customers to prove negligence of the bank in front of Judges Gemma Roach, "Consumer Perceptions of Mobile Phone Marketing: A Direct Marketing Innovation.
" Direct marketing: an international journal 3.
No.
https://w.
id/en/regulasi/otoritas-jasa-keuangan/peraturanojk/Documents/954.
http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
to obtain legal certainty and protection.
The government should be more dexterous by providing compliant facilities that are easily accessible and understandable to customers so that at some point customers become victims of account breaches, there is a fast dispute resolution flow, and easy to be followed by the affected customers.
Article 1365 of the Civil Code also controlled the measures/lawsuits that a victim might take.
Under Article 1365 of the Civil Code, a victim can file a claim for compensation against parties who utilize personal data without consent (KUH Perdat.
48 Based on Article 1365 of the Civil Code, the type of complaint filed is a lawsuit against the law against parties who utilize personal data without The concept of liability, in terms of the contractual connection between banking customers and financial services providers, is essentially a type of legal As a result of the interaction, self-responsibility emerged.
This engagement either is the result of a contract or is mandated by law.
Both parties have rights and obligations under an agreement, which are closely tied to A contractual connection is the most significant relationship between a bank and a customer from a legal standpoint.
Almost all clients, whether debtors, depositors, or non-debtor/non-depositor customers, were The provisions found in the third book of the Civil Code, which deals with engagement, were applied to the contractual connection between the consumer and the bank.
It can be concluded that based on the above description, role, function, guidelines and power of OJK have been mandated through Law No.
21/2011,
OJK Regulation (POJK) No.
1/POJK.
07/2013 in point Article 2 letter .
OJK Circular Letter Number 14/SEOJK.
07/2014 and POJK No.
77/POJK.
01/2016
concerning Information Technology-Based Lending and Borrowing Services (LPMUBTI).
POJK No.
13/POJK.
01/2018 concerning Digital Financial Innovation in the Financial Services Sector.
Yet, this independent body has not been able to settle or resolve any of the cases involving the leaking of personal data in the banking industry.
There were several rules and mechanisms customers may take, however, the applicable legal settlement was too overwhelming, complicated, and time-consuming.
OJK appears to be sharp downward and blunt It shows clearly that the role and function of OJK were not conducted optimally.
People would find it difficult to seek justice and compensation for the losses they have suffered.
Article 32 of the Minister of Communication and Information Technology 20/2016 reaffirms the litigation for this loss.
Article 1365 of the Civil Code stated that: AuEvery conduct that breaks the law .
nrechtmatige daa.
and causes harm to others obligates the person who caused the loss to compensate for the loss.
Ay http://jurnal.
ar-raniry.
id/index.
php/samarah Dispute Resolution Mechanisms in Personal Data Leakages Lia Sautunnida, et.
DOI: 10.
22373/sjhk.
Conclusion To sum up, based on the above description, the role, function, guidelines, and power of OJK have been mandated through Law No.
21/2011.
OJK
Regulation (POJK) No.
1/POJK.
07/2013 in point Article 2 letter .
OJK Circular Letter Number 14/SEOJK.
07/2014, and POJK No.
77/POJK.
01/2016
concerning Information Technology-Based Lending and Borrowing Services.
However, this independent body has not been able to settle or resolve any of the issues concerning personal data leaks in the banking industry.
OJK seems to be blunt upward and sharp downward.
OJK's role and function were not conducted effectively.
People would find it difficult to seek justice and compensation for the losses they have suffered.
Furthermore, there is an urgent need for the Financial Services Authority Regulation (OJK) No.
77/POJK.
01/2016 to be revised because it is incompatible with current financial technology development, as well as an amendment to the current relevant laws on the financial services industry in Indonesia.
As a result, this study should help customers understand their rights when it comes to personal data protection.
Such knowledge is critical in preventing other parties from abusing or misusing their consent and personal data.
It will shed some light on current banking industry practices for protecting personal data, observe and analyze the full extent of legal compliance, and detect any weaknesses in personal data management.
As a result, the findings of this study will aid in the improvement of banks and OJK's role and regulations, particularly in the protection of banking customers' data.
References