A Real Enforcement Problem
Indonesia's Traffic Corps (Korlantas Polri) recorded 16,812 license-plate violations through its Electronic Traffic Law Enforcement (ETLE) camera network in the first half of 2026, with motorcycles accounting for 77.24% of the total, according to Korlantas Polri's own release (korlantas.polri.go.id, reported in detail by Antara and Detik). Most of those violations, per Korlantas director Brigjen Pol. I Made Agus Prasatya, involve riders covering, removing, or forging plates specifically to dodge ETLE cameras, evade Jakarta's odd-even traffic rules, or erase a trail after a hit-and-run.
To close that loophole, Korlantas has now layered facial recognition onto ETLE: cameras that already photograph drivers at intersections and toll gates run those faces against Dukcapil, the Directorate General of Population and Civil Registration's national identity database. A vehicle whose plate doesn't match its registration — because it's been swapped, obscured, or removed — no longer breaks the enforcement chain. The driver's face closes it instead.
Steelmanning the Rollout
The policy case here is stronger than the reflexive "surveillance creep" framing suggests. Plate fraud isn't a victimless workaround — Indonesian law already treats it as a serious offense, with missing plates punishable by up to two months' imprisonment or a Rp500,000 fine and forged plates carrying up to six years under Article 391 of the Criminal Code (Detik). A system that lets offenders evade even that framework by defeating a camera with a $2 piece of tape isn't neutral — it's a subsidy for exactly the drivers most likely to be uninsured, unlicensed, or fleeing a collision. Matching faces to population records to correctly identify a hit-and-run suspect, rather than issuing a fine to whoever happens to own the vehicle on paper, is a defensible use of biometric matching: it's narrow, tied to an already-documented traffic offense, and arguably more accurate than plate-based enforcement alone. Officials have also framed it as a last resort rather than a dragnet — Prasatya said Korlantas takes "no pride in enforcement," calling it an alternative used only after compliance efforts fail.
The Gap It Exposes
The problem isn't the use case — it's that Indonesia has no facial-recognition-specific law to bound it. The Personal Data Protection Law (UU No. 27/2022, enacted October 17, 2022) does classify biometric data as "specific personal data" requiring heightened protection alongside health, genetic, and criminal-record data (official law text via Kemenko Infrastruktur's JDIH). But that statute is a general data-protection framework, not a facial-recognition statute — it says biometric data needs stronger safeguards without specifying what a lawful law-enforcement facial-recognition system must do: how long matched images and Dukcapil query logs are retained, who at Korlantas or Dukcapil can access the match pipeline, what accuracy threshold triggers a human review before a notice is issued, or how a wrongly flagged driver contests a match. Indonesia's data protection authority, still being stood up under the 2022 law, has not published facial-recognition-specific guidance, and no dedicated FRT statute exists to fill the space UU PDP leaves open.
That gap matters more, not less, because the underlying database is compulsory and near-universal: Dukcapil holds identity records for essentially every adult citizen, linked to the national ID (KTP) required for nearly all formal transactions. A traffic-enforcement pipeline built on top of that database isn't opt-in in any meaningful sense — it's the same infrastructure that could, without new legislation, be repointed at protest footage, checkpoint cameras, or any other camera network the state operates. The reason facial-recognition-specific rules matter separately from general data-protection law is precisely to prevent that kind of silent scope creep: a system justified and built for one purpose (matching plates to faces for traffic fines) running on infrastructure with no statutory lock limiting it to that purpose.
What Proportionate Oversight Looks Like
None of this argues for banning the tool. Plate-evasion enforcement is a legitimate, bounded application, and other jurisdictions — the UK's ongoing live facial recognition disputes being one current example, where civil society groups this month called on Nottinghamshire Police to halt a rollout pending clearer legal safeguards (EFF) — show what happens when deployment outpaces statute on both sides of the debate. The fix isn't to strip Korlantas of a tool that plausibly reduces plate fraud and hit-and-run evasion; it's for Indonesia's legislature or its data protection authority to publish binding, FRT-specific rules before the next deployment: fixed retention limits on matched biometric data, an audit trail for every Dukcapil query, and a statutory purpose limitation that keeps a traffic camera a traffic camera. Proportionate regulation means matching the rule to the risk — and a national identity database wired into live camera feeds is exactly the risk category that shouldn't run on inference from a five-year-old general statute.