Optimization of Personal Data Rights Protection in Artificial Intelligence Era Under Indonesia’s Cybersecurity Law

Abstract

The unclear regulation regarding Artificial Intelligence (AI) in Law Number 27 of 2022 concerning Personal Data Protection (UU PDP) poses significant challenges in personal data protection in Indonesia, especially in automatic data processing, algorithm transparency, and accountability for AI-based decisions. The current PDP Law focuses on general data protection without explicitly regulating how AI can process, store, and use personal data, thus creating legal loopholes that can be exploited by various parties. The main risks that arise include data exploitation without consent, information leakage, data scraping, and discrimination due to algorithmic bias that may harm certain individuals or groups. In addition, the black box problem phenomenon in AI-based decision-making further complicates legal accountability because the system works in a complex and difficult-to-understand way. Without strict regulations, certain companies or entities can use AI to make decisions that impact individuals without transparency or legal mechanisms that allow data subjects to sue or request explanations. Compared to the EU General Data Protection Regulation (GDPR) which has set transparency and accountability of AI systems laws, the PDP Law has yet to adopt concepts such as Explainable AI (XAI), which ensures that AI decisions can be understood by humans. Therefore, this study highlights the urgency of strengthening personal data protection regulations that cover the use of AI by referring to global practices to create a balance between technological innovation and the protection of individual rights.