The Petitioner during the preliminary hearing for Case No. 102/PUU-XXIV/2026 on the judicial review of Law No. 27 of 2022 on Personal Data Protection, Thursday (4/2/2026). Photo by MKRI/Bay.

---

JAKARTA (MKRI) — Danny Rafael Manurung, a university student, has filed a petition for a judicial review of Article 20 paragraph (2) letter f of Law No. 27 of 2022 on Personal Data Protection (PDP Law) with the Constitutional Court (MK). He argues that the provision, which allows the processing of personal data without the consent of the data subject, creates legal uncertainty as it grants excessively broad interpretative discretion to data controllers in defining what constitutes a “legitimate interest.”

“Personal data forms part of an individual’s identity and dignity, thus falling within the ambit of the right to personal protection. The a quo provision permits the processing of personal data without the consent of the Data Subject based on elastic and ambiguously defined grounds,” Danny stated during the preliminary hearing for Petition No. 102/PUU-XXIV/2026 on Thursday, April 2, 2026, at the Court’s courtroom in Jakarta.

Article 20 paragraph (2) letter f of the PDP Law stipulates that “the processing of Personal Data may be carried out without the consent of the Personal Data Subject in the event of: f. the fulfillment of other legitimate interests, by taking into account the purposes, needs, and balance between the interests of the Personal Data Controller and the rights of the Personal Data Subject.” The Petitioner contends that this provision contravenes Article 28D paragraph (1), Article 28G paragraph (1), and Article 28J paragraph (2) of the 1945 Constitution.

He further argued that the phrase “other legitimate interests” constitutes an open-ended clause that lacks a limiting definition, does not provide measurable and objective parameters, fails to delineate its scope, and offers no predictable criteria for data subjects. In fact, the Court, in several of its rulings, including Decision No. 013-022/PUU-IV/2006 and Decision No. 3/PUU-VIII/2010, has consistently held that vague and multi-interpretable norms are incompatible with the principle of legal certainty and the doctrine of lex certa.

As a consequence, data subjects, including the Petitioner, may lose control over their own personal data. Any restriction on the right to personal protection must not extinguish the very essence of that right, as emphasized by the Court in Decision No. 5/PUU-VIII/2010. Therefore, the a quo norm has the potential to erode the core of the constitutional right to personal protection.

The Petitioner also highlighted that, to date, the independent personal data protection authority mandated by the PDP Law has not been effectively established. As a result, the open-ended norm lacks adequate institutional oversight. Consequently, it fails to meet the standard of permissible rights limitation in a democratic society as required under Article 28J paragraph (2) of the 1945 Constitution, which must satisfy the principles of legitimate aim, necessity, and proportionality.

In his petitum, the Petitioner requests the Court to declare Article 20 paragraph (2) letter f of Law No. 27 of 2022 on Personal Data Protection unconstitutional and conditionally not legally binding insofar as it is not interpreted to mean that “other legitimate interests” must be strictly necessary, proportionate, must not override the fundamental rights and freedoms of the Personal Data Subject, and must be subject to oversight by an independent personal data protection authority. Alternatively, he requests the Court to declare the provision entirely unconstitutional and not legally binding.

The petition was examined by a panel of constitutional justices chaired by Deputy Chief Justice Saldi Isra, with Constitutional Justice Ridwan Mansyur and Constitutional Justice Adies Kadir as panel members. In his advice, Adies suggested that the Petitioner include concrete examples of actual constitutional harm resulting from the implementation of Article 20 paragraph (2) letter f of the PDP Law. “If there are concrete cases, please present them,” Adies remarked.

Before adjourning the hearing, Saldi stated that the Petitioner is granted 14 days to revise the petition. The revised petition, both in softcopy and hardcopy, must be submitted to the Court by Wednesday, April 15, 2026, at 12:00 p.m. WIB.

Author: Mimi Kartika
Editor: Lulu Anjarsari P.
PR: Raisa Ayuditha
Translator: Yuanna Sisilia

Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version will prevail.

Explore the case: Case No. 102/PUU-XXIV/2026

 

---