Reconstructing Personal Data Protection in Indonesia's Digital Transportation Sector: Liability, Contractual Justice, and Cybersecurity

Siti Mariyam; Ceprudin; Hillan Syamsudhuha Ahmad el Hariz; Georges Olemanu Lohalo

doi:10.23969/litigasi.v27i2.63990

Authors

Siti Mariyam Universitas 17 Agustus 1945 (UNTAG) Semarang
Ceprudin Faculty of Law, Universitas 17 Agustus 1945 (UNTAG) Semarang
Hillan Syamsudhuha Ahmad el Hariz Faculty of Computer Science, Universitas Amikom Purwokerto
Georges Olemanu Lohalo Université de Kinshasa, and Centre de recherche en sciences humaines -CRESH

DOI:

https://doi.org/10.23969/litigasi.v27i2.63990

Keywords:

Personal Data Protection, Digital Transportation, Platform Liability, Exoneration Clauses, Cybersecurity

Abstract

Indonesia's digital transportation sector faces a tension between mobility efficiency and the vulnerability of users' personal data, as application providers characterise themselves as technology platforms while standard electronic contracts may allocate the risk of data breaches to consumers and driver-partners. This study examines how Minister of Transportation Regulation Number 118 of 2018 and Law Number 27 of 2022 concerning Personal Data Protection should be synchronised in determining the responsibility of application providers, to what extent exoneration clauses are compatible with contractual justice and data protection law, and what regulatory architecture should integrate cybersecurity into digital transportation governance. Using normative legal research with statutory and conceptual approaches, the study analyses legislation, literature, and the standard terms and privacy policies of dominant application providers through operational indicators of legal certainty and of commutative, distributive, and procedural justice. The findings demonstrate that regulatory synchronisation strengthens the normative basis for enhanced liability of application providers for personal data breaches, including a reversed burden of proof in consumer claims, and supports a stricter liability regime for high-risk processing as a proposal for future legislation. Exoneration clauses that transfer the provider's liability are void by operation of law without invalidating the whole contract, while personal data may constitute additional economic consideration where their processing exceeds what the transport service requires. The study proposes an Integrated Digital Transportation Data Governance Framework built on regulatory integration, platform accountability, contractual justice, and risk-based cybersecurity governance, including tiered certification, impact assessments, and coordinated supervision.

Downloads

Download data is not yet available.

References

Abdillah, K., Maylissabet, M., & Burhani, N. (2026). Direct-to-Consumer DNA Testing and Nasab in Indonesia: Genetic Privacy and Evidence in Comparative Perspective. Journal of Law and Digital Civilization, 1(2), 97–114. https://doi.org/10.66277/jldc.v1i2.161

Agung, S. F. A. T., & Nasution, M. I. P. (2023). Perlindungan Hukum Terhadap Data Pribadi Konsumen Dalam Melakukan Transaksi Di E-Commerce. Jurnal Ekonomi Manajemen Dan Bisnis (JEMB), 2(1), 5–7. https://doi.org/10.47233/JEMB.V2I1.915

Alderete Peralta, A., Balta-Ozkan, N., & Li, S. (2024). The road not taken yet: A review of cyber security risks in mobility-as-a-service (MaaS) ecosystems and a research agenda. Research in Transportation Business & Management, 56, 101162. https://doi.org/10.1016/J.RTBM.2024.101162

American Law Institute. (1977). Restatement (Second) of Torts. American Law Institute Publishers.

Anggono, B. D., Wahanisa, R., Sari A.P, A. O. V. P., & Adiyatma, S. E. (2025). Interrogating the Legal Foundations of Digital Transformation: Balancing Economic Growth and Social Welfare in the Era of Disruption. Volksgeist: Jurnal Ilmu Hukum dan Konstitusi, 8(1), 191–211. https://doi.org/10.24090/volksgeist.v8i1.12211

Anwar, A. N., Ridwan, U., Qudsiyah, L., Yanti, I., & Sibawaih, I. (2026). Generative Artificial Intelligence and Copyright Law: Rethinking Intellectual Property Protection in the Digital Era. Subsidiarity: Journal of Law and Technology Policy, 1(1). https://e-journal.anharhariz.org/index.php/subsidiarity/article/view/184

Arifin, F. (2021). Pengujian Peraturan Kebijakan dalam Sistem Peradilan di Indonesia. Litigasi, 22(1), 133–156. https://doi.org/10.23969/litigasi.v22i1.3751

Aristotle. (2009). The Nicomachean Ethics (W. D. Ross, Trans.). Oxford University Press.

Audina Sukmawan, Y., Damayanti, D., HBasri, J., & Selatan, K. (2025). Metode Penelitian Hukum Normatif dan Empiris sebagai Strategi Penguatan Perspektif Kajian Ilmu Hukum. Notary Law Journal, 4(3), 114–128. https://doi.org/10.32801/NOLAJ.V4I3.116

Bachelet, V. (2024). ‘Pay-or-Consent’ and Emerging Trends in Digital Contract Law. European Review of Private Law, 32(5), 773–802. https://doi.org/10.54648/ERPL2024047

Benuf, K., & Azhar, M. (2020). Metodologi Penelitian Hukum sebagai Instrumen Mengurai Permasalahan Hukum Kontemporer. Gema Keadilan, 7(1), 20–33. https://doi.org/10.14710/GK.2020.7504

Cameron, L. D. (2024). The Making of the “Good Bad” Job: How Algorithmic Management Manufactures Consent Through Constant and Confined Choices. Administrative Science Quarterly, 69(2), 458–514. https://doi.org/10.1177/00018392241236163

Chavez, S., Anahue, J., & Ticona, W. (2024). Implementation of an ISMS Based on ISO/IEC 27001:2022 to Improve Information Security in the Internet Services Sector. Proceedings of the 14th International Conference on Cloud Computing, Data Science and Engineering, Confluence 2024, 184–189. https://doi.org/10.1109/CONFLUENCE60223.2024.10463392

Desril, R., & Santoso, M. A. (2026). Legal Protection in App-Based Transportation Partnerships and Consumers in Indonesia. Kosmik Hukum, 26(1), 202–216. https://doi.org/10.30595/KOSMIKHUKUM.V26I1.28769

Fikri, M., & Rusdiana, S. (2023). Ruang Lingkup Perlindungan Data Pribadi: Kajian Hukum Posistif Indonesia. Ganesha Law Review, 5(1), 39–57. https://doi.org/10.23887/GLR.V5I1.2237

Findrikova, D., & Kubina, M. (2026). Implementation of Information Security Management System in Transport Company. Transportation Research Procedia, 93, 916–922. https://doi.org/10.1016/J.TRPRO.2025.12.023

Firdaus, M. (2025). Dialektika Keadilan, Kepastian, Kemanfaatan Hukum dalam Perspektif Gustav Radbruch pada Hukum Indonesia. Jurnal Kajian Hukum Dan Kebijakan Publik, 3(1), 357–367. https://doi.org/10.62379/QY4B6Z80

Guggenberger, N. (2025). Consent as Friction. Boston College Law Review, 66(2), 353–421. https://doi.org/10.70167/CHOQ9209

Hamzah, A. S., Husni, L., & Arba, A. (2026). Harmonizing Labor and Anti-Trafficking Laws for the Protection of Indonesian Migrant Workers: Toward Legal Certainty and Substantive Justice. Volksgeist: Jurnal Ilmu Hukum dan Konstitusi, 9(2), 397–422. https://doi.org/10.24090/volksgeist.v9i2.15939

Hariyanto, H. (2022). Risk-Based Business License and Problems Arising After the Job Creation Act. Jurnal IUS Kajian Hukum dan Keadilan, 10(2), 354–366. https://doi.org/10.29303/ius.v10i2.1082

Hariyanto, H., Meidina, A. R., & Azizah, M. (2024). Decentralization and the Fulfilments of Children’s Rights: Challenges and Opportunities for Local Government in Indonesia. Lex Scientia Law Review, 8(2), 677–706. https://doi.org/10.15294/lslr.v8i2.14373

Hariyanto, H., Yeyeng, A. T., Kapugu, B. A., Arowosaiye, Y. I., & Tajuddin, M. S. (2025). Democratization of Village Autonomy in the Construction of Indonesian Administrative Law: Is It Possible? Jurnal Media Hukum, 32(2), 190–209. https://doi.org/10.18196/jmh.v32i2.25216

Hariz, H. S. S., Kunarti, S., & Zaman, A. R. B. (2026). Digital Surveillance and the Right to Privacy: A Comparative Study between Indonesia and the European Union. Subsidiarity: Journal of Law and Technology Policy, 1(1). https://e-journal.anharhariz.org/index.php/subsidiarity/article/view/181

Hosnah, A. U., Latif, N., Juliandi, A., Desiana, A. R., & Ma’aruf, R. M. I. (2025). Analisis Perlindungan Data Pribadi dalam Implementasi Undang-Undang Nomor 27 Tahun 2022 di Era Artificial Intelligence. QAWIUN: Jurnal Penelitian Dan Pengabdian Masyarakat, 1(2).

Kadolkar, I., Kepes, S., & Subramony, M. (2025). Algorithmic management in the gig economy: A systematic review and research integration. Journal of Organizational Behavior, 46(7), 1057–1080. https://doi.org/10.1002/JOB.2831

Karjalainen, T. (2022). All Talk, No Action? The Effect of the GDPR Accountability Principle on the EU Data Protection Paradigm. European Data Protection Law Review, 8(1), 19–30. https://doi.org/10.21552/EDPL/2022/1/6

Kitsios, F., Chatzidimitriou, E., & Kamariotou, M. (2023). The ISO/IEC 27001 Information Security Management Standard: How to Extract Value from Data in the IT Sector. Sustainability, 15(7), 5828. https://doi.org/10.3390/SU15075828

Lintvedt, M. N. (2022). Putting a price on data protection infringement. International Data Privacy Law, 12(1), 1–15. https://doi.org/10.1093/IDPL/IPAB024

Made, I., Praditya, D. A., Gede, B., Rama, A., Agung, A., Ngurah, A., Gorda, S. R., Gede, I., & Kurniawan, A. (2025). Perlindungan Hukum Data Pribadi Pengguna Layanan Transportasi Digital Dalam Perspektif Perbandingan Hukum. Jurnal Yustitia, 19(2), 13–30. https://doi.org/10.62279/YUSTITIA.V21I2.1623

Made, N., Putri, D. G., Luh, N., Mahendrawati, M., & Ujianti, P. (2024). Perlindungan Hukum Terhadap Data Pribadi Warga Negara Indonesia Berdasarkan Undang-Undang Nomor 27 Tahun 2022. Jurnal Preferensi Hukum, 5(2), 240–245. https://doi.org/10.22225/jph.5.2.2024.240-245

Mariyam, S. (2019a). Bentuk Perusahaan Jasa Angkutan Sewa Khusus menurut Peraturan Menteri Perhubungan Nomor 118 Tahun 2018. Jurnal Ilmiah Hukum dan Dinamika Masyarakat, 17(1). https://doi.org/10.56444/HDM.V17I1.1282

Mariyam, S. (2019b). Tinjauan Yuridis Jasa Angkutan Umum dengan Aplikasi Berbasis Teknologi Informasi (Perspektif Hukum Bisnis). Jurnal Ilmiah Hukum dan Dinamika Masyarakat, 16(2). https://doi.org/10.56444/HDM.V16I2.1009

Mariyam, S., Febriharini, M. P., Krismiyarsi, & Karyono, H. (2026). Between Efficiency and Risk: Data Security in Digital Transportation and the Legal Liability of Platform Providers. Jurnal Ilmu Hukum Tambun Bungai, 11(1), 737–749. https://doi.org/10.61394/JIHTB.V11I1.634

Mashchenko, O., & Radiev, D. (2023). Institutional Environment of the Digital Economy Sector. Baltic Journal of Economic Studies, 9(5), 169–175. https://doi.org/10.30525/2256-0742/2023-9-5-169-175

Metin, B., Yey, N. E., & Wynn, M. (2026). Addressing Data Protection Impact Assessment (DPIA) Implementation Challenges in AI-Driven Digitalisation: A Systematic Review and PDCA-Based Governance Framework. Information, 17(7), 679. https://doi.org/10.3390/INFO17070679

Microsoft. (2024). Microsoft Digital Defense Report 2024. Microsoft Corporation.

Muthoifin, M., Elbanna, M., & Afiyah, I. (2026). Legal Oversight in Digital Marketplaces: A Bibliometric Analysis and Systematic Literature Review of Research Trends and Gaps. Volksgeist: Jurnal Ilmu Hukum dan Konstitusi, 9(1), 145–174. https://doi.org/10.24090/volksgeist.v9i1.15587

Novalius, F. (2017, May 12). Survei YLKI, 84,1% Masyarakat Pilih Transportasi Online. Okezone Economy. https://economy.okezone.com/read/2017/05/12/320/1689169/survei-ylki-84-1-masyarakat-pilih-transportasi-online

OECD. (2026). Towards international coherence of cybersecurity regulations. OECD Digital Economy Papers. https://doi.org/10.1787/BD1F199A-EN

Olasehinde, D. O., Bamisile, O., Ejiyi, C. J., Zhang, G., Cai, D., Li, J., Wei, L., & Huang, Q. (2026). Cybersecurity in cyber-physical power systems: analyzing vulnerabilities, threats, and control structures. Cluster Computing, 29(3), 133. https://doi.org/10.1007/S10586-025-05894-W

Palupy, H. E., Nawing, R., & Susantijo, S. (2026). Personal Data Protection Governance in the Asia Pacific Region: A Review of the Scope, Effectiveness, and Legal Challenges. Volksgeist: Jurnal Ilmu Hukum dan Konstitusi, 9(1), 197–225. https://doi.org/10.24090/volksgeist.v9i1.15362

Rejeki, S. K. (2026). Analisis Yuridis terhadap Perlindungan Hak Privasi dalam Komunikasi Digital Berdasarkan Undang-Undang Pelindungan Data Pribadi di Indonesia. Al-Zayn: Jurnal Ilmu Sosial & Hukum, 4(2), 7607–7621. https://doi.org/10.61104/ALZ.V4I2.5682

Sanjaya, S., Alfani, I. P., & Sinaga, S. (2026). Keabsahan Kontrak Elektronik dalam Hukum Perdata Indonesia: Tantangan dan Perlindungan Hukum. Jurnal Hukum Mimbar Justitia, 12(1), 232–250. https://doi.org/10.35194/JHMJ.V12I1.6135

Sari, D. P., Safa, M. S., & Fahlevi, A. R. (2026). Perlindungan Hukum Konsumen dalam Transaksi E-Commerce di Indonesia: Perspektif Hukum Perdata dan Undang-Undang Perlindungan Konsumen. RIGGS: Journal of Artificial Intelligence and Digital Business, 5(1), 6311–6318. https://doi.org/10.31004/riggs.v5i1.6942

Satria, I. G. S. (2025). Perlindungan Hak Pekerja Gig Economy melalui Perspektif Hukum Ketenagakerjaan. Nomos: Jurnal Penelitian Ilmu Hukum, 5(1), 127–134. https://doi.org/10.56393/NOMOS.V5I1.2723

Sepriadi, O., Zulfikar, P., Ghifari, S. Al, Budi, U., & Ridwan. (2026). Hubungan Hukum Kontrak Elektronik dengan Keamanan Transaksi Digital. Berajah Journal, 6(3), 867–873. https://doi.org/10.47353/BJ.V6I3.534

Stewart, A., & Williams, P. (2023). Regulating the Fairness of Work Contracts in the Gig Economy. Federal Law Review, 51(4), 466–486. https://doi.org/10.1177/0067205X231205049

Suhartana, L. W. P., Asikin, Z., Haq, L. M. H., & Azizah, M. (2025). Risk-Based Mining Investment in the Framework of Fair Legal Certainty. Volksgeist: Jurnal Ilmu Hukum dan Konstitusi, 8(1), 63–85. https://doi.org/10.24090/volksgeist.v8i1.12894

Teichmann, F. M. J., & Wittmann, C. (2023). When is a law firm liable for a data breach? An exploration into the legal liability of ransomware and cybersecurity. Journal of Financial Crime, 30(6), 1491–1498. https://doi.org/10.1108/JFC-04-2022-0093

Wijaya, E., Rahardiansyah, T., & Notoprayitno, M. I. (2025). Dimensi Sosio-Legal dalam Pengaturan Transportasi Publik Berbasis Aplikasi. MIMBAR KEADILAN: Jurnal Ilmu Hukum, 209–216. https://doi.org/10.5139.vol1iss6pp209

Yuspin, W., Rajput, T., Bal, A. B., Wardiono, K., & Absori. (2024). The Regulations of the Supervisory Officer Personal Data Protection-Based Accountability Principle. BESTUUR, 12(1), 49–68. https://doi.org/10.20961/BESTUUR.V12I1.89742

Zakiyah, N., Ulum, B., Rahmat, H., & Ahmad, A. R. bin. (2026). Digital Registration and the Invisible Child: Protecting Children of Unregistered Migrant Marriages in Malaysia. Journal of Law and Digital Civilization, 1(2), 115–134. https://doi.org/10.66277/jldc.v1i2.31

Zhang, J. (2024). Analysis and Solution of the Governance Dilemma of Infringement of Car-Hailing Platforms under Sharing Economy. Frontiers in Business, Economics and Management, 15(2), 107–110. https://doi.org/10.54097/9G1AM937

Zhang, W., & Zhong, S. (2022). Data Legal Supervision of Online Car-Hailing Platform Based on Big Data Technology and Edge Computing. Wireless Communications and Mobile Computing, 2022(1), 5298152. https://doi.org/10.1155/2022/5298152

Zhou, Z. (2022). Research on Legal Issues in Safety Incidents of Ride-hailing and Their Coping Mechanisms. Academic Journal of Humanities & Social Sciences, 5(4), 95–105. https://doi.org/10.25236/AJHSS.2022.050416