BPJS Kesehatan in May 2021 experienced a leak of 279 million personal data of its
users, the leak of personal data was carried out by a hacker, namely Kotz, the leaked
personal data contained names, telephone numbers, addresses, salaries to population
data, the personal data was traded on the raid forum or darkweb. Personal data that
is leaked should be protected as stipulated in Law No. 27 of 2022 concerning Personal
Data Protection, because personal data is part of human rights relating to individual
privacy rights, with the leakage of personal data BPJS Kesehatan users can be held
legally responsible, therefore this study aims to find out how the form of BPJS
Kesehatan legal liability for leaking personal data of its users. Through normative
research methods with a legal norm approach, the author concludes that BPJS
Kesehatan can be held liable for Administrative law, namely sanctions of written
warnings, temporary termination, deletion or destruction of personal data and or
administrative fines, Civil legal liability, namely BPJS Kesehatan can be asked for
compensation for leaking personal data of users and criminal legal liability BPJS
Kesehatan can be subject to imprisonment or fines.