Petitioner Danny Rafael Manurung presenting the revised petition. Photo by MKRI/Panji.

---

JAKARTA (MKRI) — Danny Rafael Manurung, a university student, presented revisions to his petition for a judicial review of Article 20 paragraph (2) letter f of Law No. 27 of 2022 on Personal Data Protection (PDP Law) before the Constitutional Court (MK). In Case No. 102/PUU-XXIV/2026, he requested the Court to ensure that any provision allowing the processing of personal data without the data subject’s consent must be grounded in a clear legal basis, measurable parameters, and must not set aside the rights and freedoms of the personal data subject.

“The revisions have complied with the instructions of the Panel of Justices,” Danny said during a hearing at the Court’s panel courtroom in Jakarta on Wednesday (April 15, 2026).

This position is reflected in his revised petitum. The Petitioner requests the Court to declare the phrase “other legitimate interests” in Article 20 paragraph (2) letter f of the PDP Law as contrary to the 1945 Constitution and conditionally unconstitutional, insofar as it is not interpreted to mean that “other legitimate interests must have a clear basis, measurable parameters, and must not disregard the rights and freedoms of the personal data subject.”

Also read: Petitioner Challenges Consent Exception in Personal Data Processing

Article 20 paragraph (2) letter f of the PDP Law stipulates that “Personal Data Processing may be carried out without the consent of the Personal Data Subject in the event of: f. the fulfillment of other legitimate interests by taking into account the purpose, necessity, and balance between the interests of the Personal Data Controller and the rights of the Personal Data Subject.” The Petitioner argues that this provision contradicts Article 28D paragraph (1), Article 28G paragraph (1), and Article 28J paragraph (2) of the 1945 Constitution.

He argued that allowing personal data processing without consent creates legal uncertainty, as it gives overly broad discretion to data controllers to determine what constitutes “legitimate interests.” He further explained that the phrase “other legitimate interests” constitutes an open-ended clause that lacks a definitive definition, objective and measurable parameters, clear scope limitations, and predictable criteria for data subjects. In fact, the Court has affirmed in several decisions—among others Decision No. 013-022/PUU-IV/2006 and Decision No. 3/PUU-VIII/2010—that ambiguous and multi-interpretable norms are inconsistent with the principle of legal certainty and the doctrine of lex certa.

As a result, data subjects, including the Petitioner, may lose control over their personal data. Any restriction on the right to personal protection must not eliminate the essence of that right, as emphasized by the Court in Decision No. 5/PUU-VIII/2010. Therefore, the a quo provision has the potential to erode the core of the constitutional right to personal protection.

The Petitioner further noted that, to date, the independent personal data protection authority mandated by the PDP Law has not been effectively established. Consequently, the open-ended norm lacks adequate institutional oversight. As such, the provision does not meet the standard for limiting rights in a democratic society as required under Article 28J paragraph (2) of the 1945 Constitution, which requires the fulfillment of the principles of legitimate aim, necessity, and proportionality.

Author: Mimi Kartika
Editor: Lulu Anjarsari P.
PR: Raisa Ayuditha M.
Translator: Yuanna Sisilia

Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version will prevail.

Explore the case:  102/PUU-XXIV/2026

---