Perlindungan Hukum dan Kepastian Hukum Terhadap Perdagangan Data Pribadi dalam UU PDP

Abstract

Article 20 of the Personal Data Protection Law (UU PDP) normatively regulates the protection of data subjects and constitutes a key provision emphasizing the principle of consent as the legal basis for the processing of personal data for commercial purposes. This norm safeguards individual privacy rights, including the validity of explicit consent, the right to withdraw consent, and the responsibility of data controllers. Furthermore, Articles 65–70 of the UU PDP substantively regulate various forms of criminal violations in the context of personal data protection, including the acquisition, disclosure, processing, falsification, and illegal use of personal data, demonstrating the state’s commitment to providing criminal law protection against personal data breaches. This study employs doctrinal legal research with a descriptive-normative approach to address two main issues. First, it aims to examine and identify the legal protection of personal data trading under the UU PDP. Second, it seeks to analyze and identify the legal certainty of personal data trading as regulated by the UU PDP. Although Article 20 of the UU PDP is intended to provide strong protection against the commercial use of personal data, the provision still gives rise to legal uncertainty due to the lack of clear regulation of several crucial aspects. Similarly, Articles 65–70 contain significant legal uncertainties, particularly with regard to the elements of criminal offenses, forms of harm, corporate criminal liability, overlap with other regulations, and the absence of clear enforcement mechanisms and implementing institutions.