Jakarta, fiskusnews.com:

1. Introduction: Understanding the Imperative of CCTV Penerimaan Negara

The concept of “CCTV Penerimaan Negara,” or State Revenue CCTV, has emerged as a significant proposal aimed at bolstering Indonesia’s fiscal strength through enhanced monitoring of the national tax system. This initiative, championed by former Director General of Taxes, Hadi Poernomo, envisions a comprehensive system for overseeing self-assessment tax reporting and verifying the accuracy of taxpayer declarations. Often referred to as Sistem Monitoring Self Assessment (SMSA) or SIN Pajak (Single Identity Number Pajak), the underlying principle is to establish a robust mechanism for data integration and analysis across various financial and non-financial domains. The fundamental goal is to foster greater transparency within the tax system, thereby mitigating the potential for arbitrary actions by tax officials and ensuring a level playing field for all taxpayers. A core objective of this system is to achieve a higher tax ratio for Indonesia, which could subsequently pave the way for a reduction in overall tax rates.  

The consistent emphasis on transparency and the ambition to elevate the tax ratio suggest that a primary motivation behind the “CCTV Penerimaan Negara” concept is to effectively address the persistent challenges of tax evasion and to optimize the collection of state revenue. By implementing a system designed to monitor and rigorously verify self-reported tax assessments, the inherent discrepancies between declared and actual financial activities can be more readily identified. This enhanced level of transparency is expected to act as a significant deterrent against underreporting of income and other methods of tax avoidance, directly contributing to an improved tax ratio. Furthermore, the long-term vision of potentially lowering tax rates indicates an anticipation that a broader, more compliant tax base can sustain the government’s revenue needs while easing the financial burden on individual taxpayers.

The genesis of this concept dates back to 2004 when the initial design for such a monitoring mechanism was presented, highlighting a long-standing recognition within Indonesia of the necessity for a more effective system to oversee tax collection. The fact that this idea has persisted for nearly two decades and has garnered support across different administrations underscores its perceived importance and the enduring challenges in Indonesian tax administration that it seeks to overcome. This prolonged period of consideration also implies that the full implementation of such a comprehensive system may involve significant complexities and potential obstacles that need careful consideration.  

This self-assessment endeavors to evaluate the “CCTV Penerimaan Negara” system across three critical dimensions: technical infrastructure, operational procedures, and compliance with relevant regulations. Given the sensitive nature of the financial data that this system would handle, a particular emphasis will be placed on the aspects of data privacy and security. Ultimately, a key outcome of this assessment is to pinpoint specific areas of concern and to identify potential avenues for improvement to enhance the system’s effectiveness and integrity.  

Considering that the proposed system is designed to process and analyze extensive amounts of financial data, strict adherence to Indonesia’s data privacy laws, most notably the Personal Data Protection Law (PDP Law) enacted as Law No. 27 of 2022, is of paramount importance. The PDP Law establishes a comprehensive set of principles that govern the processing of personal data, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, integrity, and confidentiality. Moreover, it grants individuals a range of rights concerning their personal data, such as the right to be informed about its processing, the right to access and rectify their data, and the right to request its erasure under certain conditions. The significant emphasis on the PDP Law underscores a crucial compliance requirement for the “CCTV Penerimaan Negara” system. Any system that manages personal financial data within Indonesia must be meticulously designed and operated to ensure full compliance with the provisions of this law. Failure to meet these stringent standards could lead to substantial legal repercussions and significant damage to public trust. Therefore, this self-assessment will thoroughly examine the extent to which the “CCTV Penerimaan Negara” system aligns with the principles and requirements outlined in the PDP Law.  

2. Technical Assessment: Evaluating the System’s Foundation

While the term “CCTV” traditionally evokes the image of video surveillance systems designed for physical security , in the context of “Penerimaan Negara,” it functions as a metaphor for a sophisticated monitoring system focused on financial data related to state revenue. Consequently, the technical assessment of this system must primarily concentrate on the digital infrastructure that would be necessary for the collection, processing, and storage of financial transaction data obtained from a multitude of sources, as indicated in various proposals. This involves evaluating the health and performance of the underlying digital components that support the system’s core functions.  

The technical assessment should consider the critical need for “real-time monitoring” of financial data flows. This necessitates the implementation of robust systems capable of capturing and analyzing data as it is generated. The potential integration of advanced technologies such as artificial intelligence (AI) and cloud computing solutions could play a pivotal role in enabling this real-time analysis and enhancing the system’s overall efficiency. Furthermore, given the anticipated scale and complexity of the data involved, the system’s capacity to effectively manage and process “big data” originating from diverse entities is a fundamental technical consideration.  

The overall design of the “CCTV Penerimaan Negara” system and the seamless integration of its various components and data sources are crucial for its success. A key aspect of this is the “link and match” concept , which aims to integrate data from numerous entities, including ministries, institutions, agencies, regional governments, and financial institutions. The technical architecture must facilitate the mandatory connection of the electronic systems of all these Indonesian entities to the central tax system. Moreover, the scalability of the system is paramount to ensure its ability to handle the ever-increasing volumes of financial data and transactions without compromising performance or reliability. The potential integration of the “CCTV Penerimaan Negara” system with the existing Core Tax Administration System (CTAS) , which serves as a primary digital platform for tax-related processes in Indonesia, also warrants careful technical consideration to avoid redundancies and ensure interoperability. The role of a “Single Identity Number (SIN) Pajak” in facilitating this data integration and providing a unified view of taxpayer information should also be a key focus of the technical architecture assessment.  

Given the highly sensitive nature of the financial data processed by the “CCTV Penerimaan Negara” system, a comprehensive and robust data security framework is absolutely essential. This technical assessment must include an in-depth analysis of the security measures that have been or will be implemented to safeguard the confidentiality, integrity, and availability of this critical information. This evaluation should encompass the use of strong encryption techniques to protect data both in transit and at rest, the implementation of stringent access control mechanisms to prevent unauthorized access, and the establishment of comprehensive audit logs to track system activities and detect potential security breaches. The system’s overall resilience against a wide range of cyber threats, including malware attacks, phishing attempts, and sophisticated data breaches , needs to be thoroughly assessed. Furthermore, the technical infrastructure must incorporate mechanisms to ensure the accuracy and completeness of the data, preventing unauthorized modifications or tampering that could compromise the integrity of the system. Compliance with all relevant Indonesian regulations pertaining to electronic systems and data security is a non-negotiable aspect of the technical design and implementation. The technical assessment should also specifically address the security implications associated with the mandatory access to financial data held by Financial Service Institutions (LJK) and other financial entities , as well as the crucial role of digital certificates in ensuring secure authentication and authorization within the system.  

3. Operational Assessment: Analyzing the Effectiveness of Procedures

The operational assessment of the “CCTV Penerimaan Negara” system involves a thorough analysis of the effectiveness of the procedures that govern its day-to-day functioning. This includes evaluating the processes for monitoring financial data, responding to security incidents, managing user access, and ensuring proper data retention.

Effective monitoring procedures are fundamental to achieving the objectives of the “CCTV Penerimaan Negara” system. This assessment must examine the processes for the continuous observation of financial data and transactions to identify potential discrepancies or irregularities. The utilization of real-time dashboards and alert systems for the timely detection of anomalies or suspicious activities is a critical operational aspect. Furthermore, the assessment should evaluate the extent to which the system employs behavior analysis techniques, potentially leveraging AI or other sophisticated analytical tools , to identify patterns indicative of tax evasion or other illicit financial activities. Given the stated goal of tracking both domestic and international financial transactions of Indonesian citizens , the operational scope of the monitoring procedures must be carefully considered. A key aspect of the operational assessment is to determine precisely how the “link and match” concept is practically implemented within the monitoring procedures. The success of the “CCTV Penerimaan Negara” system hinges on its ability to effectively integrate and compare data originating from a multitude of diverse sources. Therefore, the operational procedures must clearly delineate the steps involved in this data integration process, the methodologies used to identify inconsistencies or discrepancies, and the specific triggers that initiate further investigation or other appropriate actions.  

Robust incident response and management protocols are essential for maintaining the security and availability of the system. This assessment should evaluate the established procedures for identifying, classifying, and effectively responding to various security incidents or system failures that may occur. Given the sensitive nature of the data handled, the procedures for data breach notification, as mandated by the PDP Law , must be thoroughly examined to ensure they are comprehensive and compliant. Furthermore, the assessment should review the disaster recovery and business continuity plans that are in place to ensure the system’s continuous availability and minimize disruptions in the event of unforeseen circumstances. Best practices for IT monitoring systems emphasize the critical importance of having clearly defined alerting and troubleshooting procedures, along with well-established escalation policies to ensure that issues are addressed promptly and efficiently. These best practices should be carefully considered within the operational assessment of the “CCTV Penerimaan Negara” system.  

Effective user access control and management are crucial for preventing unauthorized access to sensitive financial data. This assessment should review the policies and procedures that govern the granting, management, and regular auditing of user access rights to the system. The implementation of role-based access control, which ensures that users are granted only the necessary permissions to perform their duties, and the principle of least privilege, which further restricts access to the minimum required, should be evaluated. The processes for user authentication, verifying the identity of users, and authorization, determining what actions users are permitted to perform within the system, must also be thoroughly assessed. Considering the system’s objective of providing tax authorities with access to financial data from various institutions , the operational procedures for managing these access rights and ensuring accountability are particularly important. The Coretax system, a key component of Indonesia’s tax administration infrastructure, highlights the significance of registered PICs (Person in Charge) who are equipped with digital certificates for accessing tax administration systems. This model of access control and authentication may offer valuable insights for the operational assessment of the “CCTV Penerimaan Negara” system.  

Finally, the operational assessment must address the critical aspects of data retention and management. This involves examining the established policies and practices for the storage, archiving, and secure disposal of the collected financial data in strict accordance with the requirements of the PDP Law and other relevant Indonesian regulations. The defined retention periods for different categories of financial data must be evaluated to ensure they meet legal and operational requirements while minimizing unnecessary data storage. Furthermore, the assessment should review the procedures for the secure deletion or anonymization of data when it is no longer required for its original purpose, ensuring that sensitive information is handled responsibly throughout its lifecycle.  

4. Compliance Assessment: Ensuring Adherence to Regulations and Policies

A critical component of the self-assessment is a thorough evaluation of the “CCTV Penerimaan Negara” system’s compliance with the complex web of Indonesian laws, government regulations, and internal policies. This compliance assessment will focus on adherence to data privacy regulations, the broader regulatory and legal framework governing electronic systems and tax administration, and the alignment of the system with internal organizational policies.

The cornerstone of the compliance assessment is a comprehensive evaluation of the system’s adherence to the Indonesian Personal Data Protection Law (PDP Law). This involves scrutinizing the system’s design and operational procedures to ensure they align with the fundamental principles of the PDP Law, including obtaining valid consent for data processing, minimizing the collection and retention of personal data, limiting data processing to specified and legitimate purposes, implementing robust security measures to protect data integrity and confidentiality, and respecting the rights of data subjects. The assessment should specifically analyze the implementation of data protection impact assessments (DPIAs) for any data processing activities that carry a high potential risk to individuals’ privacy rights. Furthermore, if the scale and nature of data processing within the “CCTV Penerimaan Negara” system necessitate the appointment of a Data Protection Officer (DPO) , the assessment should evaluate the DPO’s role, responsibilities, and effectiveness in ensuring ongoing compliance. The mechanisms established for handling inquiries, requests, and complaints from data subjects regarding their personal data must also be carefully examined. If the system involves the transfer of personal data across Indonesian borders , the assessment must verify that such transfers comply with the specific requirements outlined in the PDP Law. While not directly applicable, guidance from other jurisdictions, such as the Philippine National Privacy Commission’s circulars and advisories on CCTV systems and the Irish Data Protection Commissioner’s guidance on CCTV use , underscore the universal importance of transparency through clear notices, robust security protocols, and well-defined procedures for handling access requests in any monitoring system that processes personal data. These international examples serve as valuable benchmarks for the “CCTV Penerimaan Negara” system’s data privacy compliance efforts.  

Beyond the PDP Law, the compliance assessment must also encompass an analysis of the system’s adherence to other relevant laws and government regulations. This includes the Electronic Information and Transactions (ITE) Law (UU ITE) , which governs various aspects of electronic transactions and information management, and Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions , which provides more detailed guidelines for the operation and security of electronic systems. Furthermore, the assessment needs to consider the numerous regulations specifically related to tax administration and the management of financial data in Indonesia. If the “CCTV Penerimaan Negara” system is designed to integrate with or operate in conjunction with the Core Tax Administration System (CTAS) , compliance with the specific regulations governing CTAS is also essential. The compliance assessment must therefore consider the intricate relationship between the overarching data privacy regulations and the sector-specific regulations that govern financial data and tax administration in Indonesia. While the PDP Law establishes a broad framework for personal data protection, other regulations may contain specific requirements that are particularly relevant to the financial sector and tax-related data. Ensuring that the “CCTV Penerimaan Negara” system adheres to all applicable layers of this legal framework is crucial for its legitimacy and long-term sustainability.  

Finally, the compliance assessment should evaluate the extent to which the “CCTV Penerimaan Negara” system aligns with the internal policies and standards of the implementing organization. This includes assessing its conformity with established guidelines for data security, procedures for handling sensitive information, and protocols for user access control. It is also important to determine whether these internal policies are themselves consistent with all relevant external regulations and legal requirements.

5. Identifying Pain Points and Recommendations for Improvement

Identifying existing pain points and formulating actionable recommendations for improvement are crucial steps in the self-assessment process. A systematic approach to gathering information and analyzing potential issues will enable the identification of areas where the “CCTV Penerimaan Negara” system may be underperforming or facing challenges.

Several methodologies can be employed to identify pain points within the system. Conducting surveys or distributing questionnaires to users and other relevant stakeholders can provide valuable insights into their experiences and perceptions of the system’s effectiveness and usability. Interviews with key personnel involved in the day-to-day operation and management of the system can offer deeper understanding of existing challenges and potential areas for concern. Analyzing system logs and audit trails can help identify technical issues, performance bottlenecks, or unusual activity patterns. Reviewing incident reports and problem management records can reveal recurring issues or areas where the system has experienced failures or security breaches. Furthermore, depending on the sensitivity and criticality of the system, conducting penetration testing or vulnerability assessments can proactively identify potential security weaknesses that need to be addressed.

Once pain points have been identified through these various methods, it is essential to analyze them systematically. This involves categorizing the issues based on their primary domain, such as technical infrastructure, operational procedures, or compliance with regulations. Prioritizing the identified issues based on their potential impact on the system’s overall effectiveness in achieving its objectives, the security of the sensitive financial data it handles, and compliance with relevant legal and regulatory requirements is also crucial. A thorough analysis should also seek to understand the underlying root causes of each identified pain point to ensure that recommendations for improvement address the fundamental issues rather than just the symptoms.

The culmination of this process is the development of detailed and actionable recommendations for improvement. These recommendations should be specific, clearly outlining the proposed changes or actions, and measurable, allowing for the assessment of their effectiveness once implemented. They should address the pain points identified across the technical, operational, and compliance domains, suggesting concrete steps to enhance the system’s performance, security, and regulatory adherence. In formulating these recommendations, it is beneficial to consider best practices for assessing digital revenue monitoring systems and evaluating the effectiveness of government digital systems more broadly. Drawing upon established evaluation frameworks for tax administration systems, such as the Tax Administration Diagnostic Assessment Tool (TADAT) and the insights provided by the OECD’s work on tax administration , can also provide valuable guidance in identifying areas for improvement. Furthermore, the self-assessment should take into account any challenges that have been observed during the implementation or transition to related systems, such as the Coretax system, particularly concerning issues related to accessibility and authorization. These real-world experiences can provide valuable lessons learned that can inform the recommendations for enhancing the “CCTV Penerimaan Negara” system.  

Key Tables for the Report:

Table 1: Compliance Checklist for Data Privacy

Requirement of Indonesian PDP Law	Compliant	Partially Compliant	Non-Compliant	Evidence/Notes
Lawful basis for processing
Explicit consent (if applicable)
Purpose limitation
Data minimization
Accuracy
Integrity and confidentiality
Data subject rights
Data breach notification
Cross-border data transfer (if applicable)
Implementation of DPIAs
Appointment of DPO (if required)

Table 2: Technical Assessment Criteria

Technical Aspect	Criteria	Assessment Findings	Notes
Data Capture	Completeness, Accuracy, Reliability
Network Infrastructure	Stability, Bandwidth, Security, Resilience
Storage	Capacity, Scalability, Security, Accessibility
Data Security	Encryption, Access Controls, Audit Logs
System Integration	Interoperability, Data Flow, Scalability
Performance Monitoring	Uptime, Latency, Error Rates

Table 3: Operational Procedure Evaluation

Operational Procedure	Evaluation Criteria	Assessment Results	Recommendations
Monitoring	Real-time analysis, Anomaly detection, Scope
Incident Response	Clarity of protocols, Response times, Effectiveness
User Access Management	Role-based access, Authentication, Authorization
Data Retention	Compliance with regulations, Defined periods
Data Deletion/Anonymization	Security, Effectiveness

6. Conclusion

The self-assessment of the “CCTV Penerimaan Negara” system reveals a complex undertaking with significant potential to enhance Indonesia’s state revenue through improved tax compliance and reduced evasion. The metaphorical use of “CCTV” to represent a comprehensive digital monitoring system for financial data underscores the ambition to achieve greater transparency and accountability within the tax administration framework. The historical context of this proposal, spanning several administrations, highlights the enduring need for such a system to address persistent challenges in revenue collection.

The technical assessment emphasizes the necessity for a robust and scalable digital infrastructure capable of handling vast amounts of financial data in real-time. Integration with existing systems like CTAS and the potential implementation of a unified identifier such as SIN Pajak are critical technical considerations. Paramount among these is the establishment of a comprehensive data security framework to protect the sensitive financial information from unauthorized access and cyber threats, aligning with national regulations and international best practices.

Operationally, the effectiveness of the system hinges on the design and implementation of robust monitoring procedures that leverage data integration and analytical tools to identify anomalies and potential instances of non-compliance. Clear protocols for incident response, user access management, and data retention, all while adhering to legal and regulatory requirements, are essential for the system’s smooth and secure operation.

Compliance with Indonesia’s data privacy laws, particularly the PDP Law, forms a cornerstone of the system’s legitimacy and sustainability. Adherence to the principles of data protection, respect for data subject rights, and the implementation of necessary safeguards are non-negotiable. Furthermore, the system must comply with the broader legal and regulatory landscape governing electronic systems, transactions, and tax administration in Indonesia.

Identifying pain points through systematic feedback mechanisms and rigorous analysis will be crucial for the continuous improvement of the “CCTV Penerimaan Negara” system. By addressing these challenges with specific and actionable recommendations, the system can evolve to become a more effective tool for optimizing state revenue and fostering a culture of tax compliance in Indonesia. The insights gained from this self-assessment will provide a valuable foundation for future development and implementation efforts, ensuring that the “CCTV Penerimaan Negara” system serves its intended purpose of strengthening the nation’s fiscal health and promoting economic equity.

Reporter: Marshanda Gita – Pertapsi Muda