ANALISIS KETERBATASAN PENGATURAN PASAL 21 UNDANG-UNDANG PERLINDUNGAN DATA PRIBADI DALAM MENGATASI PELANGGARAN PRIVASI PADA PRAKTIK PENAGIHAN PINJAMAN ONLINE.

Abstract

The rapid growth of online lending services has intensified personal data processing, particularly in debt collection practices that raise privacy concerns. This study analyzes the regulation of personal data processing purposes under Indonesia's Personal Data Protection Law (Law Number 27 of 2022, with particular emphasis on Article 21, in relation to online lending services and examines the implications of its regulatory limitations for legal accountability in cases of personal data misuse during debt collection. This research employs a normative legal method using statutory, conceptual, comparative, and case approaches. Legal materials were analyzed prescriptively. The study yields two principal findings. First, Article 21 requires data controllers to notify data subjects of processing purposes but does not explicitly integrate this obligation with Articles 27 and 28, allowing formal compliance without ensuring adherence to the principle of purpose limitation. Second, this normative gap creates legal uncertainty in determining purpose limitation violations, potential moral hazard within the controller–processor accountability framework, and ineffective law enforcement due to the absence of implementing Government Regulations and the incomplete operationalization of the personal data protection supervisory authority. This study recommends integrating Articles 21, 27, and 28, issuing implementing regulations, and strengthening accountability mechanisms for controllers and processors in online lending debt collection.