RECORDING AND DISSEMINATING VIDEOS OF INDIVIDUALS WITHOUT CONSENT: WHAT DOES INDONESIAN LAW SAY?
The rapid development of social media has made it increasingly easy to record and share photographs or videos. However, where a recording depicts an identifiable individual and is subsequently disseminated without that individual’s consent, such conduct may give rise to legal issues, particularly from the perspective of personal data protection.
Facial Images as Personal Data
Pursuant to Article 1 point 1 of Law No. 27 of 2022 on Personal Data Protection (“PDP Law”), Personal Data means data relating to an individual who is identified or identifiable, either independently or in combination with other information, directly or indirectly, through electronic or non-electronic systems.
The PDP Law classifies Personal Data into two categories, namely general Personal Data and specific Personal Data.
One category of specific Personal Data is biometric data. The Elucidation of Article 4 paragraph (2) letter b of the PDP Law explains that biometric data refers to data relating to an individual’s physical, physiological, or behavioral characteristics that enable the unique identification of that individual, such as facial images or dactyloscopic data. Biometric data also encompasses an individual’s unique characteristics, including fingerprints, retinal scans, and DNA samples.
Accordingly, an individual’s facial image contained in a photograph or recording that enables the identification of such individual may constitute Personal Data and, where it possesses characteristics that enable unique identification, may qualify as biometric data.
An individual to whom Personal Data relates is referred to as a Personal Data Subject and is entitled to various rights protected under the PDP Law.
Rights of Personal Data Subjects over Recordings Depicting Them
The PDP Law grants Personal Data Subjects the right to obtain information regarding the clarity of identity, the legal basis of interest, the purpose of requesting and using Personal Data, and the accountability of the party requesting or controlling such Personal Data.
In addition, Personal Data Subjects have the right to terminate the processing, erase, and/or destroy Personal Data concerning them, subject to the applicable laws and regulations.
In principle, a Personal Data Controller is required to erase Personal Data where:
- the Personal Data is no longer necessary for achieving the purpose of its processing;
- the Personal Data Subject has withdrawn his or her consent to the processing;
- the Personal Data Subject has submitted a request for erasure; or
- the Personal Data was obtained and/or processed unlawfully.
Accordingly, an individual whose face or identity appears in certain content may, in principle, have legal grounds to request the termination of processing or removal of such content, subject to the requirements stipulated under the PDP Law.
Does Recording an Individual Without Consent Violate the PDP Law?
Under the PDP Law, activities involving the acquisition, collection, processing, analysis, storage, rectification, updating, display, publication, transfer, dissemination, disclosure, and/or erasure or destruction of Personal Data constitute Personal Data Processing.
Accordingly, recording an individual and, in particular, using or disseminating a recording containing that individual’s Personal Data may fall within the scope of Personal Data Processing.
Any Personal Data Processing must have a valid legal basis for processing, as stipulated under Article 20 of the PDP Law.
One such legal basis is the explicit valid consent of the Personal Data Subject for one or more specific purposes that have been communicated by the Personal Data Controller to the Personal Data Subject.
Such consent must be provided in writing or in recorded form and may be given electronically or non-electronically. Consent must also be obtained freely, specifically, in an informed manner, and unambiguously.
Prior to obtaining such consent, the Personal Data Controller is also required to provide the Personal Data Subject with relevant information regarding the processing of Personal Data in a concise, transparent, and easily understandable manner and in accordance with the relevant Personal Data Processing activities.
Nevertheless, consent is not the sole legal basis for Personal Data Processing. Article 20 of the PDP Law recognizes several other lawful bases for processing. Therefore, whether a particular recording or dissemination constitutes a violation of the PDP Law must be assessed by considering the purpose and context of the processing, the party carrying out such processing, and whether a valid legal basis for the processing exists.
Prohibition against Unlawful Disclosure of Personal Data
The PDP Law provides criminal law protection against the unlawful disclosure of Personal Data.
Article 65 paragraph (2) of the PDP Law essentially prohibits any person from unlawfully disclosing Personal Data that does not belong to them.
A violation of this provision may give rise to criminal liability in accordance with the criminal provisions stipulated under the PDP Law.
Therefore, uploading or disseminating a recording of an individual without a valid legal basis for processing may result in legal consequences where such conduct satisfies the elements of unlawful disclosure of Personal Data.
Consent under the Electronic Information and Transactions Law
The protection of Personal Data used through electronic media is also related to the provisions of the Electronic Information and Transactions Law (“EIT Law”), as amended.
In principle, the use of information through electronic media involving an individual’s Personal Data must comply with the applicable statutory provisions governing Personal Data protection.
Accordingly, the use of an individual’s recording on social media should not only be assessed under the PDP Law but also in light of other relevant provisions governing electronic systems and transactions.
Right to Request Erasure and Compensation
Where an individual considers that his or her Personal Data has been processed unlawfully, the PDP Law grants the Personal Data Subject a number of rights, including the right to request the termination of processing and erasure of Personal Data, subject to the applicable laws and regulations.
Furthermore, a Personal Data Subject has the right to file a claim and receive compensation for violations involving the processing of his or her Personal Data.
In submitting a claim for compensation, the Personal Data Subject should provide relevant information and supporting evidence, including his or her identity, data or documents supporting the claim, and information concerning the relationship between the Personal Data Subject and the party carrying out the Personal Data Processing.
If the claim for compensation is rejected or the parties fail to reach an agreement regarding compensation, the Personal Data Subject may pursue a legal claim in accordance with the mechanisms prescribed under the applicable laws and regulations.
Demanding Money in Exchange for Removing a Video: Could It Constitute Criminal Threats?
The legal implications become more serious where the party who records or disseminates the content subsequently demands a sum of money from the victim as a condition for removing or taking down such content.
Such conduct may be assessed under the provisions concerning the criminal offense of threats (pengancaman) under Law No. 1 of 2023 on the Criminal Code (“New Criminal Code”), which has been effective since 2 January 2026.
Pursuant to Article 483 of Law No. 1 of 2023, a person may be subject to criminal liability for threats where, with the intent to unlawfully benefit himself/herself or another person, by means of a threat of defamation, written defamation, or disclosure of a secret, such person compels another person to:
- surrender property that wholly or partly belongs to such person or another person; or
- provide a debt, acknowledge a debt, or discharge a receivable.
The offense constitutes a complaint-based offense (delik aduan), meaning that prosecution may only be initiated upon a complaint filed by the victim.
The Elucidation of Article 483 of the New Criminal Code essentially distinguishes the offense of threats from extortion based on the nature of the coercion employed. In the case of threats, the means of coercion are generally non-physical or psychological in nature, such as threats of defamation or disclosure of a secret.
Accordingly, where a person threatens to continue disseminating, disclose, or maintain content that may be detrimental to the victim unless the victim pays a certain sum of money, such conduct may be assessed as the criminal offense of threats, provided that all elements of Article 483 of the New Criminal Code are satisfied.
Conclusion
In principle, an individual’s facial image or recording that enables such individual to be identified constitutes information that may fall within the scope of Personal Data. Where such characteristics are used to enable the unique identification of an individual, such data may qualify as biometric data, which constitutes specific Personal Data.
The recording, display, disclosure, and dissemination of Personal Data constitute forms of Personal Data Processing. Accordingly, any party carrying out such processing must have a valid legal basis for processing as required under the PDP Law. Explicit consent constitutes one such legal basis, but it is not the only lawful basis for processing recognized under the PDP Law.
Where Personal Data is obtained, used, or disseminated unlawfully, the Personal Data Subject may exercise his or her rights under the PDP Law, including requesting the termination of processing or erasure of the Personal Data and seeking compensation in accordance with the applicable laws and regulations.
Furthermore, where the dissemination of content is accompanied by a demand for money and a threat of defamation or disclosure of a secret as a means of coercing the victim, such conduct may also give rise to criminal liability under the provisions concerning threats under the New Criminal Code.
Legal Basis
- Law No. 27 of 2022 on Personal Data Protection;
- Law No. 11 of 2008 on Electronic Information and Transactions, as amended, most recently by Law No. 1 of 2024;
- Law No. 1 of 2023 on the Criminal Code;
- Law No. 1 of 2026 on Criminal Penalty Adjustments; and
- Government Regulation No. 33 of 2026 on the Implementing Regulation of Law No. 27 of 2022 on Personal Data Protection.
