Rekonstruksi Yurisprudensi Mahkamah Konstitusi di Era Pengawasan Data

Abstract

Digital transformation has accelerated data-driven governance, enabling public authorities to collect, store, link, and analyze personal data at scale. In this environment, privacy harms are increasingly systemic: they stem not only from isolated intrusions but also from institutional design choices, procedural gaps, and power asymmetries between individuals and data-controlling entities. This article reconstructs Indonesia’s Constitutional Court (Mahkamah Konstitusi, MK) jurisprudence on privacy and personal data protection to (i) map the evolution of constitutional standards, (ii) assess argumentative consistency across key rulings, and (iii) formulate a reform agenda for data governance compatible with democratic rule-of-law principles. Methodologically, the study is doctrinal and case-based, combining close reading of judgments with normative analysis. It clusters MK decisions into three domains: (a) wiretapping and communications interception; (b) the acquisition of electronic evidence; and (c) personal data protection after the enactment of the Personal Data Protection Act (UU PDP). The findings indicate a shift from an infringement-based approach—focused on whether a specific interference is lawful—toward a governance-based approach that evaluates whether legal frameworks provide adequate safeguards through system architecture, oversight, and accountability mechanisms. Decision No. 5/PUU-VIII/2010 strengthens the legality principle by requiring wiretapping powers to be grounded in statute. Decision No. 20/PUU-XIV/2016 embeds due process by conditioning evidentiary validity on lawful data acquisition. Decision No. 151/PUU-XXII/2024 affirms personal data protection as a constitutional interest that demands risk-based governance, independent supervision, and enforceable accountability. Building on these trends, the article proposes a set of Minimum Constitutional Safeguards (MCS) as an operational checklist: clear legal basis, purpose limitation, data minimization, storage/retention limits, logging and auditability, independent supervisory authority, and accessible remedies. Practically, the study recommends harmonizing fragmented sectoral regulations, strengthening the independence of the data protection supervisor, and mainstreaming privacy-by-design and algorithmic transparency so that MK’s constitutional signals translate into effective protections in Indonesia’s digital ecosystem.