Regulating Digital Privacy in Indonesia: The Practice of Data Subject Rights and Controller Duties in the FotoYu App

Abstrak

The practice of personal data protection in artificial intelligence (AI)-based marketplace applications that utilize facial recognition technology (FRT) in Indonesia has not been comprehensively studied. This study analyzes the implementation of data subject rights and the fulfillment of data controller obligations by FotoYu under Law Number 27 of 2022 concerning Personal Data Protection (PDP Law). This study employs a normative juridical method, utilizing primary legal sources such as legislation, secondary sources including scholarly literature and doctrine, and tertiary materials as supporting references. The findings indicate that FotoYu and its Creators have not fully met the core obligations of data controllers, particularly regarding explicit consent, transparency, and effective data deletion mechanisms. Additional challenges arise from inaccurate FRT performance, limited regulatory frameworks on FRT and AI, the absence of implementing regulations for the PDP Law, and a lack of a dedicated data protection authority. This study contributes by providing a normative interpretation of PDP Law provisions in the context of AI-based FRT platforms and offers policy recommendations, including strengthening regulations specific to FRT and AI, accelerating PDP Law implementation regulations, and establishing an independent data protection authority to ensure effective oversight and law enforcement in Indonesia.