A traffic camera that reads faces, not just plates
On May 22, 2026, at the Traffic Directorate's annual technical planning meeting in Jakarta, Indonesia's national police announced that its Electronic Traffic Law Enforcement (ETLE) camera network now includes a facial-recognition module tied directly to Dukcapil, the civil registry that holds identity records for nearly every Indonesian citizen. Deputy National Police Chief Komjen Pol. Dedi Prasetyo framed it as part of a broader digitalization push, saying digitization is meant to deliver public services that are "faster, transparent, accountable and accessible" (Tribratanews Polri). Two weeks later, Traffic Corps chief Irjen Pol. Agus Suryo Nugroho confirmed the system's operational purpose: catching riders who cover, remove, or swap license plates specifically to dodge electronic tickets, by matching a driver's face against the population database instead of relying on the plate at all (reporting citing Kakorlantas statement, June 6, 2026). Coverage in Indonesian outlets describes cameras that, when a plate can't be read or registration data doesn't match, pull a live facial match and cross-reference it against Dukcapil records in real time (Kumparan).
The case for it — and it's a real one
Plate evasion is a genuine enforcement problem, and Indonesia's is not a hypothetical one: riders regularly fold, mud-cover, or steal plates precisely because the first-generation ETLE system, camera-only and plate-dependent, could be defeated by a five-dollar piece of tape. A biometric backstop closes an obvious loophole, and using data the state already lawfully holds — Dukcapil, not a new commercial face database — is a more defensible design choice than standing up parallel surveillance infrastructure from scratch. Faster, more accurate identification of hit-and-run drivers and unregistered vehicles is a legitimate public-safety interest, and few would argue traffic police should be barred from using modern tools that private companies already deploy for building access or airport check-in.
Where the law actually sits
The friction is that Indonesia's Personal Data Protection Law — UU No. 27/2022, in force since October 17, 2022, with a two-year compliance runway that ended October 17, 2024 — classifies biometric data as one of six categories of "specific personal data" requiring heightened protection, alongside health, genetic, criminal, children's, and financial records (JDIH Kemkomdigi, official law text). Analysis from the Future of Privacy Forum notes the law goes further and specifically restricts facial recognition technology to "security, disaster prevention, or traffic information analysis" purposes, coupled with a public notification requirement — a provision written, it would seem, with exactly this kind of traffic camera in mind (FPF). But that same analysis flags the catch: those specific FRT restrictions don't bind law enforcement, which instead falls under Article 50's broader carve-out for "investigation and prosecution" activity. In practice, Korlantas's system likely sits in the exempted lane, not the notification-and-purpose-limited one built for private and civil use.
That carve-out might be defensible if Indonesia's data protection authority were fully stood up to police it. It reports to the president once operational, with power to investigate violations and impose administrative sanctions — but as of this rollout, its implementing regulations remain unfinished, per FPF's review of the statute. A biometric identification system now runs against the national population registry while the institution Parliament designed to audit exactly this kind of use is still being built.
What proportionate regulation looks like here
The instinct to treat this as a straightforward civil-liberties emergency undersells the actual failure. Indonesia doesn't need to ban face-matching traffic cameras; it needs the law-enforcement exemption to carry its own guardrails instead of riding on a general "investigation and prosecution" clause that predates biometric traffic surveillance.
Three fixes would let the ETLE system keep functioning while closing the gap regulators themselves have flagged. First, Korlantas should publish retention limits for face-match queries that don't result in a citation — a driver whose face is checked and cleared shouldn't have that biometric query sit indefinitely in a traffic database. Second, access logging and an audit trail for who queries Dukcapil through this channel, and why, should be a precondition of the integration, not an afterthought bolted on after a scandal. Third, the government should treat finishing the data protection authority's implementing regulations as a genuine priority rather than a background administrative task — a law with an unfinished regulator is a law that exists mostly on paper for exactly the use cases, like this one, where oversight matters most.
None of this requires Indonesia to forgo a tool that plausibly makes plate-evasion enforcement more effective. It requires matching the power of the tool to the maturity of the oversight around it — proportionality that protects both traffic safety and the privacy interests a properly functioning PDP regime was designed to secure.