Legal Gaps and Risks in Consumer Data Processing: An Analysis of Indonesian E-Commerce under the Personal Data Protection Law
DOI:
https://doi.org/10.15294/jpcl.v8i2.20081Keywords:
Personal Data Protection, E-Commerce, Data Processing Risks, Indonesian Law, Consumer PrivacyAbstract
The advancement of information and communication technology has significantly eroded traditional privacy boundaries, particularly within Indonesia’s rapidly growing e-commerce sector. The increasing volume and value of online transactions have intensified the collection and processing of consumer personal data, thereby amplifying legal and commercial risks at every stage of data processing. This study aims to analyze the forms of risks arising at each stage of personal data processing on e-commerce websites, as stipulated in Article 16 of Law No. 27 of 2022 on Personal Data Protection, while also identifying existing legal gaps in its implementation. This research adopts a normative juridical approach, employing library-based legal research focused on statutory and conceptual analysis. The findings demonstrate that distinct risks emerge across different stages of personal data processing, both prior to and following data storage by data controllers. Key risks include non-compliant data collection practices, lack of transparency, excessive and unlawful data collection, as well as unauthorized access, disclosure, modification, misuse, destruction, and loss of personal data. These risks are further exacerbated by ambiguities in regulatory provisions, particularly regarding consent standards, accountability mechanisms, and enforcement. This study contributes to the discourse in private and commercial law by offering a stage-based risk mapping of personal data processing within Indonesian e-commerce, highlighting specific regulatory shortcomings under the Personal Data Protection Law. It provides a nuanced understanding of how legal gaps translate into practical vulnerabilities for consumers. The research also proposes practical mitigation measures, including regular system updates and strengthening the capacity of human resources responsible for data processing, to enhance compliance and consumer data protection in Indonesia’s digital economy.
References
Aminah, Sitti, and Herie Saksono. "Digital transformation of the government: A case study in Indonesia." Jurnal Komunikasi: Malaysian Journal of Communication 37, no. 2 (2021): 272-288. https://doi.org/10.17576/jkmjc-2021-3702-17
Ariansyah, Kasmad, et al. "Drivers of and barriers to e-commerce adoption in Indonesia: Individuals’ perspectives and the implications." Telecommunications Policy 45, no. 8 (2021): 102219. https://doi.org/10.1016/j.telpol.2021.102219
Arifin, Ridwan, et al. "Protecting the Consumer Rights in the Digital Economic Era: Future Challenges in Indonesia." Jambura Law Review 3, no. 1 (2021): 135-160. https://doi.org/10.33756/jlr.v3i0.9635
Beck, Ulrich. Risk Society: Towards a New Modernity. Vol. 17. (London: SAGE, 1992).
Bennett, Colin J., and Charles D. Raab. The Governance of Privacy: Policy Instruments in Global Perspective. (London: Routledge, 2017). https://doi.org/10.4324/9781315199269
Business Indonesia. “Report: e-commerce to fuel Indonesia’s digital economy growth to $110 Bn by 2025”, Business Indonesia Report, November 9, 2023. Retrieved from https://business-indonesia.org/news/report-e-commerce-to-fuel-indonesia-s-digital-economy-growth-to-110-bn-by-2025
Cate, Fred H. "The limits of notice and choice." IEEE Security & Privacy 8, no. 2 (2010): 59-62. https://doi.org/10.1109/msp.2010.84
Cavoukian, Ann. "Privacy by Design: Leadership, Methods, and Results." In European Data Protection: Coming of Age. (Dordrecht: Springer Netherlands, 2012), pp. 175-202. https://doi.org/10.1007/978-94-007-5170-5_8
Cheung, Christy MK, and Matthew KO Lee. "Understanding consumer trust in Internet shopping: A multidisciplinary approach." Journal of the American society for Information Science and Technology 57, no. 4 (2006): 479-492. https://doi.org/10.1002/asi.20312
Dinanti, Dinda, et al. "Politics of Law for the Protection of Debtors as Consumers in Fintech based Loaning Services." Unnes Law Journal 6, no. 2 (2020): 427-444. https://doi.org/10.15294/ulj.v6i2.48219
Diniyanto, Ayon, and Heris Suhendar. "How Law Responds to Technological Development?." Unnes Law Journal 6, no. 2 (2020): 405-426. https://doi.org/10.15294/ulj.v6i2.48218
Dokuchaev, Vladimir A., Victoria V. Maklachkova, and V. Yu Statev. "Classification of personal data security threats in information systems." T-Comm-Телекоммуникации и Транспорт (T-Comm-Telecommunications and Transport) 14, no. 1 (2020): 56-60. https://doi.org/10.36724/2072-8735-2020-14-1-56-60
Dwyer, Andrew C., et al. "What can a critical cybersecurity do?." International Political Sociology 16, no. 3 (2022): olac013.
Fiorentina, Prita, et al. "Legal Protection of Consumer Personal Data in Indonesia Fintech Peer-To-Peer Lending Pioneers." Pandecta Research Law Journal 17, no. 2 (2022): 307-312. https://doi.org/10.15294/pandecta.v17i2.40235
Floridi, Luciano. The Ethics of Information. (Oxford: Oxford University Press, 2013).
Gupta, Anjali. "E-Commerce: Role of E-Commerce in today’s business." International Journal of Computing and Corporate Research 4, no. 1 (2014): 1-8.
Haganta, Raphael. "Legal Protection of Personal Data as Privacy Rights of E-Commerce Consumers Amid the Covid-19 Pandemic." Lex Scientia Law Review 4, no. 2 (2020): 77-90.
Hicks, Jacqueline. "A ‘data realm’ for the Global South? Evidence from Indonesia." Third World Quarterly 42, no. 7 (2021): 1417-1435. https://doi.org/10.1080/01436597.2021.1901570
Hidayah, Ardhiana, and Marsitiningsih Marsitiningsih. "Aspek Hukum Perlindungan Data Konsumen E-Commerce." Kosmik Hukum 20, no. 1 (2020): 56-63. https://doi.org/10.30595/kosmikhukum.v20i1.8251
Jansen, Wayne A. "Cloud hooks: Security and privacy issues in cloud computing." 2011 44th Hawaii International Conference on System Sciences. IEEE, 2011. https://doi.org/10.1109/hicss.2011.103
Jusmadi, Rhido. "The Existence of Digital Platforms and the Challenges in Enforcement of Indonesian Competition Law." Unnes Law Journal 9, no. 1 (2023): 183-204. https://doi.org/10.15294/ulj.v9i1.37279
Kuner, Christopher. European Data Privacy Law and Online Business. (Oxford: Clarendon Press, 2003).
Mantzari, Despoina. "Power imbalances in online marketplaces: at the crossroads of competition law and regulation." Research Handbook on the Law and Economics of Competition Enforcement. (London: Edward Elgar Publishing, 2022), pp. 170-192. https://doi.org/10.2139/ssrn.4873444
Marune, Abraham Ethan Martupa Sahat, and Brandon Hartanto. "Strengthening personal data protection, cyber security, and improving public awareness in Indonesia: Progressive legal perspective." International Journal of Business, Economics, and Social Development 2, no. 4 (2021): 143-152. https://doi.org/10.46336/ijbesd.v2i4.170
Mittelstadt, Brent Daniel, et al. "The ethics of algorithms: Mapping the debate." Big Data & Society 3, no. 2 (2016): 1-21. https://doi.org/10.1177/2053951716679679
Mostafa, A. A. "Cyber Crime in Business." International Journal of Academic Research in Business and Social Sciences. 12, no. 6 (2022): 962-972.
Mutiara, Upik, and Romi Maulana. "Perlindungan Data Pribadi Sebagai Bagian dari Hak Asasi Manusia Atas Perlindungan Diri Pribadi." Indonesian Journal of Law and Policy Studies 1, no. 1 (2020): 42-54. https://doi.org/10.31000/ijlp.v1i1.2648
Ningsih, Ayup Suran. "Indonesia Data Protection in the Use of M-Banking, Is It Save?." Jurnal Magister Hukum Udayana (Udayana Master Law Journal) 10, no. 3 (2021): 434-445. https://doi.org/10.24843/jmhu.2021.v10.i03.p01
Nissenbaum, Helen. "Privacy as Contextual Integrity." Washington Law Review 79.1 (2004): 119.
Ohm, Paul. "Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization." UCLA Law Review 57, no. 6 (2010).
Poernomo, Sri Lestari. "Transformative Justice, Protection of Consumer Personal Data in Online Loan Business in Indonesia." Russian Law Journal 11, no. 3 (2023): 559-570. https://doi.org/10.52783/rlj.v11i3.1196
Pohan, Tia Deja, and Muhammad Irwan Padli Nasution. "Perlindungan Hukum Data Pribadi Konsumen dalam Platform E-Commerce." Sammajiva: Jurnal Penelitian Bisnis dan Manajemen 1, no. 3 (2023): 42-48. https://doi.org/10.47861/sammajiva.v1i3.336
Prastyanti, Rina Arum, et al. "Law and personal data: Offering strategies for consumer protection in new normal situation in Indonesia." Jurnal Jurisprudence 11, no. 1 (2022): 82-99. https://doi.org/10.23917/jurisprudence.v11i1.14756
Purba, Bonaraja, et al. "Transformasi Hukum E-Commerce di Indonesia: Analisis dan Solusi Permasalahan." Jurnal Sosial Humaniora Sigli 6, no. 2 (2023): 373-383. https://doi.org/10.47647/jsh.v6i2.1570
Putri, Deanne Destriani Firmansyah, and Muhammad Helmi Fahrozi. "Upaya Pencegahan Kebocoran Data Konsumen Melalui Pengesahan RUU Perlindungan Data Pribadi (Studi Kasus E-Commerce Bhinneka. Com)." Borneo Law Review 5, no. 1 (2021): 46-68. https://doi.org/10.35334/bolrev.v5i1.2014
Rahman, Yogi Muhammad, Aflah Haora, and Elsa Nurfitriani Sutansi. "Personal Data Protection In The Era Of Globalization (Indonesia Perspective)." Tirtayasa Journal of International Law 2, no. 1 (2023): 15-30. https://doi.org/10.51825/tjil.v2i1.19603
Republic of Indonesia. Undang-Undang Nomor Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi. (Jakarta: sekretariat Negara, 2022). Available online at https://jdih.komdigi.go.id/produk_hukum/view/id/832/t/undangundang+nomor+27+tahun+2022
Saimima, Ika Dewi Sartika, and Valentino Gola Patria. "The Fintech Phenomenon: Protection of Consumer Privacy Data in Online Lending." Jurnal Kajian Ilmiah 21, no. 2 (2021): 185-194. https://doi.org/10.31599/jki.v21i2.564
Salam, U., et al. "Indonesia case study: Rapid technological change–challenges and opportunities." Pathways for Prosperity Commission Background Paper Series 1, no. 1 (2018): 2009-2019.
Saly, Jeane Neltje, et al. "Analisis Perlindungan Data Pribadi Terkait UU No. 27 Tahun 2022." Jurnal Serina Sosial Humaniora 1, no. 3 (2023): 145-153.
Santoso, Edy. "Opportunities and challenges: e-commerce in Indonesia from a legal perspective." Jurnal Penelitian Hukum De Jure 22, no. 3 (2022): 395-410. https://doi.org/10.30641/dejure.2022.v22.395-410
Sarangi, Unmana. "Information economy and data protection laws: a global perspective." International Journal of Business and Management Research 6, no. 2 (2018): 15-35. https://doi.org/10.37391/ijbmr.060203
Sari, Chatrin Intan. "Consumer protection on illegal drugs cases in Indonesia." Indonesia Media Law Review 1, no. 1 (2022): 63-80. https://doi.org/10.15294/imrev.v1i1.56678
Schoorman, F. David, Roger C. Mayer, and James H. Davis. "Organizational trust: Philosophical perspectives and conceptual definitions." Academy of Management Review 21, no. 2 (1996): 337-340. https://doi.org/10.5465/amr.1996.27003218
Sikder, Abu Sayed, and Joe Allen. "An In-depth Exploration of Emerging Technologies and Ethical Considerations in Cross-border E-commerce: A Comprehensive Analysis of Privacy, Data Protection, Intellectual Property Rights, and Consumer Protection in the context of Bangladesh." International Journal of Imminent Science & Technology. 1, no. 1 (2023): 116-137. https://doi.org/10.70774/ijist.v1i1.15
Sirait, Ningrum Natasya. "E-commerce growth and development, impact, and challenges in Indonesia." Neoclassical Legal Review: Journal of Law and Contemporary Issues 1.2 (2022): 54-72. https://doi.org/10.32734/nlr.v1i1.9603
Smith, Rhys, and Jianhua Shao. "Privacy and e-commerce: a consumer-centric perspective." Electronic Commerce Research 7, no. 2 (2007): 89-116. https://doi.org/10.1007/s10660-007-9002-9
Solove, Daniel J. Understanding Privacy. (Harvard, MA: Harvard University Press, 2010).
Spalević, Žaklina, and Kosana Vićentijević. "GDPR and challenges of personal data protection." The European Journal of Applied Economics 19, no. 1 (2022): 55-65. https://doi.org/10.5937/ejae19-36596
Sudarwanto, Al Sentot, and Dona Budi Budi Kharisma. "Comparative study of personal data protection regulations in Indonesia, Hong Kong and Malaysia." Journal of Financial Crime 29, no. 4 (2022): 1443-1457. https://doi.org/10.1108/jfc-09-2021-0193
Tjipto, Felix Pratama, et al. "Consumer Protection Law: The Case Study of Grabtoko Company in Indonesian E-Commerce Transactions." Journal of Private and Commercial Law 5, no. 2 (2021): 120-140. https://doi.org/10.15294/jpcl.v5i2.32161
Tufekci, Zeynep. "Algorithmic Harms Beyond Facebook and Google: Emergent Challenges of Computational Agency." Colorado Technology Law Journal 13, no. 2 (2015): 203.
Vance, Anthony, and Mikko T. Siponen. "IS security policy violations: A rational choice perspective." Journal of Organizational and End User Computing (JOEUC) 24, no. 1 (2012): 21-41. https://doi.org/10.4018/joeuc.2012010102
Wagner, Julian. "The transfer of personal data to third countries under the GDPR: when does a recipient country provide an adequate level of protection?." International Data Privacy Law 8, no. 4 (2018): 318-337. https://doi.org/10.1093/idpl/ipy008
Xing, Zhongwei. "The impacts of Information and Communications Technology (ICT) and E-commerce on bilateral trade flows." International Economics and Economic Policy 15, no. 3 (2018): 565-586. https://doi.org/10.1007/s10368-017-0375-5
Zuboff, Shoshana. "The Age of Surveillance Capitalism." In Social Theory Re-wired. (London: Routledge, 2023), pp. 203-213. https://doi.org/10.4324/9781003320609-27
Downloads
Published
Article ID
20081Issue
Section
License
Copyright (c) 2024 Tegar Islami Putra, Adinda Zeranica Putri Fakhis, Anisa Tussaleha, Mahima Umaela Firdhausya, Muhammad Hilmi Naufal Aflah, Souad Ahmed Ezzerouali, Mohamed Cheick Banane (Author)
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
The Journal of Private and Commercial Law adheres to the principles of the Directory of Open Access Journals (DOAJ) by providing immediate, free, and open access to all published content. All articles are published under the Creative Commons Attribution-NonCommercial 4.0 International License (CC BY-NC 4.0). Under this license, users are permitted to read, download, copy, distribute, and adapt the published works in any medium or format, provided that appropriate credit is given to the original author(s) and source, a link to the license is included, and any changes made are clearly indicated. The use of the material is strictly limited to non-commercial purposes only.
Authors retain copyright of their work without any restriction. The journal does not transfer copyright from authors; instead, authors grant the journal the right of first publication while maintaining full ownership of their intellectual property. This ensures that authors preserve their rights while enabling wide dissemination and accessibility of their research in accordance with open access principles and DOAJ standards.
