Liability of Business Actors for the Protection of Consumer Personal Data

Introduction: In the field of digital economy transactions, especially information technology-based loan and borrowing agreements, the importance of personal data is increasing. Even so, consumer data protection is still not adequately handled, raising concerns about the many cases of personal data breaches that actually cause losses to consumers with illegal access to consumer personal data. The birth of the Personal Data Protection Law and various regulations related to personal data protection and information technology-based lending and borrowing services is a serious step by the government to provide protection and security of consumers' personal data.Purposes of the Research: This research aims to examine and analyze the legal protection of consumers' personal data in information-based lending agreements, as well as the legal implications of the dissemination of consumers' personal data in technology-based lending agreements.Methods of the Research: The method used in this research is the normative juridical method with a legislative approach and a conceptual approach. The legal materials used are primary, secondary, and tertiary legal materials. These legal materials are analyzed qualitatively to address the issues being studied.Results Main Findings of the Research: The research results show that legal protection of consumers' personal data in technology-based lending agreements in Indonesia is currently well-regulated through Law Number 27 of 2022 on Personal Data Protection (PDP Law) and various related regulations. Although these regulations are comprehensive, their implementation still faces various challenges, particularly regarding the awareness and understanding of business actors and consumers about the importance of personal data protection. Supervision by the Financial Services Authority (OJK) and related institutions needs to be strengthened, and improvements in technology infrastructure and human resources are required to support effective implementation. Legal implications of personal data breaches affect both consumers and business actors. Consumers' rights to security and comfort are not met due to personal data breaches. Business actors who do not comply with their obligations and responsibilities regarding the protection of consumers' personal data may face various legal implications, such as loss of consumer trust, financial losses, administrative and criminal sanctions, service termination by the government, and a decrease in company value.

Problem setting. In order to build an innovative society, it is necessary to develop legal norms and regulators aimed at protecting privacy and controlling personal data. In addition, the need to ensure effective and reliable protection of personal data in the conditions of rapid technological development, globalization and the growing threat of cybercrime is becoming more urgent. The need for the development of legal norms, the introduction of innovative technologies and the raising of public awareness become important tasks for ensuring privacy and protection of personal data. The study also aims to identify and analyze the main challenges facing the field of personal data protection, such as cybercrime, hacker attacks, globalization and cross borders. Legal norms and regulations aimed at protecting privacy are also analyzed, as well as the potential opportunities of new technologies that can increase the level of protection of personal data. Аnalysis of recent researches and publications. The problems of legal protection of personal data have recently become the subject of research by an increasing number of scientists, both lawyers and representatives of other fields of knowledge. In particular, such scientists as: S. Hlibko, T. Egorova-Lutchenko, K. Yefremova, O. Korvat, V. Kokhan, M. Haustova devote their attention to the study of these issues. etc. Purpose of the research is to develop possible ways of legal protection of personal data in view of today’s challenges related to this issue. The article aims to consider the development of technologies and the growth of the volume of personal data as the main factors affecting the need for effective protection of privacy and security of this data. The article is aimed at expanding the understanding of the problem and providing recommendations for improving the protection of privacy and security of personal data in the future. article’s main body. According to the preamble to the Agreement between Ukraine and the European Union on the participation of Ukraine in the European Union program “Digital Europe” (2021-2027), the important supporting role of digital infrastructure, including in the field of cyber security, is recognized to ensure inextricably linked transformation processes and digital leadership of the European Union. The purpose of concluding the Agreement is to establish mutually beneficial cooperation in order to strengthen and support the deployment of reliable and secure digital capabilities in the Union in the field, including cyber security. It is recognized that mutual participation in each other’s programs for the implementation of digital technologies should ensure mutual benefits for the Parties, while observing a high level of data protection, digital rights, etc. In accordance with paragraph 12 of Article 2 of Annex III to the Agreement, the exchange of information between the European Commission or OLAF and the competent state authorities of Ukraine must take place with due consideration of confidentiality requirements. Personal data included in the exchange of information must be transferred in accordance with the current legal norms on data protection of the Party making the transfer. According to paragraph 49 of the preamble of Regulation (EU) 2021/694 of the European Parliament and of the Council of April 29, 2021 on the establishment of the Digital Europe Program, digital transformation should allow citizens to access, use and securely manage their personal data across borders, regardless of their location or data location. According to point 60 of the preamble, by providing a single set of rules that are directly applicable in the legal systems of the Member States, Regulation (EU) 2016/679 guarantees the free flow of personal data between Member States and strengthens the trust and security of individuals, two indispensable elements of a true Digital Single Market . All actions taken within the framework of the Program, which involve the processing of personal data, must contribute to the smooth implementation of this Regulation, for example, in the field of artificial intelligence and distributed ledger technologies (for example, blockchain). These actions should support the development of digital technologies that meet data protection obligations both by design and by default. In addition, according to paragraph 69 of the preamble, this Regulation respects fundamental rights and adheres to the principles recognized in the Charter of Fundamental Rights of the European Union, in particular regarding the protection of personal data, etc. In the Charter of Fundamental Rights of the European Union (2016/C 202/02) dated June 7, 2016, Chapter II “Freedoms” contains Article 8, which is entitled “Protection of personal data”, according to which it is assumed that everyone has the right to the protection of personal data data concerning him. Such data must be processed fairly for specific purposes and on the basis of the consent of the person concerned or on another legal basis established by law. Everyone has the right to access the data that has been collected about him and the right to correct it. Compliance with these rules is subject to control by an independent body. In addition, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data establishes rules relating to the protection of natural persons with regard to the processing of personal data, as well as rules, relating to the free movement of personal data, and protects the fundamental rights and freedoms of natural persons and, in particular, their right to protection of personal data. Today in Ukraine, the main legislative act in this area is the Law of June 1, 2010 No. 2997-VI “On the Protection of Personal Data”. Article 11 of the Law of Ukraine “On Information” specifies what information about a natural person (personal data) is. In turn, the legal and organizational bases for ensuring the protection of the vital interests of a person and citizen, society and the state, national interests of Ukraine in cyberspace, the main goals, directions and principles of state policy in the field of cyber security, the powers of state bodies, enterprises, institutions, organizations, individuals and citizens in this area, the basic principles of coordination of their cyber security activities are defined in the Law of Ukraine “On Basic Principles of Cyber Security of Ukraine”. In addition, relations in the field of information protection in information, electronic communication and information and communication systems are regulated by the Law of Ukraine “On the Protection of Information in Information and Communication Systems”. In turn, the Concept of the development of e-governance in Ukraine, as well as the Law of Ukraine “On the National Informatization Program” defines e-governance. In addition, in 2021, the Law of Ukraine “On Public Electronic Registers” was adopted, which defines the State electronic platform for maintaining public electronic registers. On April 18, 2023, by a resolution of the Cabinet of Ministers of Ukraine, the Regulation on the information system “Software platform for the deployment and support of state electronic registers” was approved, as well as the Procedure for using the software “Software platform for the deployment and support of state electronic registers”. conclusions and prospects for the development. The protection of digital personal data requires the development of appropriate technical and regulatory tools, as well as judicial practice of prosecution for violations of the order of their use. It is possible to create a database or registry for private electronic/digital platforms, with the help of which or which would control their activities, including regarding the protection of personal data. At the same time, at the regulatory and legal level, it is necessary to provide that a mandatory condition for the creation and functioning of an Internet platform is its registration in such a database / such a register, and a mandatory condition for registration is confirmation of technical capabilities to ensure the protection of personal data of platform users. It is necessary to define at the regulatory level the list and mechanisms of acquisition of digital rights, their implementation, protection, compensation and responsibility for their violation. The protection of personal data should be considered one of the digital rights of a person and a citizen. The development of digitalization in a legal state must inevitably be accompanied by the development of the legal framework, in particular, the emergence, consolidation, definition and protection of digital rights of individuals and legal entities. Digital rights are a multifaceted category, they become connected and interwoven with other rights defined and established in the norms of different branches of law. The multifaceted nature of the “digital rights” category implies the separation and delimitation of various categories of digital rights, their distribution into appropriate types, for example, “personal digital rights”, “financial digital rights”, etc. It should be quite natural to form a separate element in the general system of law, such as digital law, as a set of legal norms regulating social relations related to the circulation of (including personal) data in digital networks.

The misuse of personal data by certain individuals, including individuals within business entities, has become a form of loss for many people, growing alongside advances in digital technology, where various activities can now be conducted digitally. Since 2021, numerous cases of consumer data breaches have occurred. Although the Personal Data Protection Law (PDP) has been enacted, its implementation still faces various obstacles, such as a lack of effective oversight, the absence of an independent authority fully responsible for personal data protection, and a lack of awareness among digital businesses regarding compliance with the new regulations. The type of study undertaken is a normative legal study (library legal research), as indicated by the title of this thesis. The data sources for this research are secondary data. Legal concepts, legal ideas, legal doctrines, and relevant regulations can be cited, copied, and analyzed to obtain secondary data from library research. The approach used in this thesis is the normative legal approach. The problem in this thesis discusses the Legal Certainty for Consumers Who Experience Personal Data Violations in Digital Business Transactions Based on Law Number 27 of 2022 concerning Personal Data Protection and Legal Protection Efforts for Personal Data Consumers Harmed by Digital Business Transactions. The analysis and discussion found that Legal Certainty for Consumers who experience Personal Data Violations in Digital Business Transactions based on Law Number 27 of 2022 concerning Personal Data Protection can be seen in the provisions of Articles 7 to 14 of the PDP Law. Specifically, the legal certainty of consumer protection for their personal data can be seen in the provisions of Article 12 Paragraph (1) of the PDP Law, which essentially states that personal data subjects have the right to sue and receive compensation for violations of the processing of Personal Data about them. In addition, everyone has the right to view, change, delete, and limit the processing method of personal data, in accordance with the provisions of Articles 15 to 20 of the PDP Law. The Consumer Protection Law does not include a single article regulating the legal certainty of consumer personal data protection. The provisions of Article 45 of the Consumer Protection Law only state that Consumers can file a lawsuit based on Article 45 of the Consumer Protection Law if they feel they have been harmed by Business Actors.

The development of technology utilization in terms of the business sector in various fields makes its own challenges in providing consumer protection. then it is necessary to know that the Personal Data Protection of telemedicine service users provides consumer protection accommodation. There are aspects of protection for consumers as service users of personal data. Control of personal data should be carried out by companies that use technology in their business activities, in this case the organizers of electronic systems as required by existing regulations. The protection of consumers has been accommodated in the Consumer Protection Law (1999). Problems with data leaks that occur in Indonesia are problems experienced by consumers as users of digital services. Protection of personal data is a basic right of citizens and therefore the role of the State as the competent authority in the management and regulation of personal data. To ensure accommodation of personal data protection in the business development of digital start-up companies, it is necessary to study the accommodation of personal data protection as a form of protection for consumers in the Consumer Protection Law ( 1999) by Digital Start-up Companies as service providers. Normative research method with conceptual and legal approach is used to explain the facts. The results of this study show that the Consumer Protection Law (1999) on Consumer Protection has not provided regulatory accommodation that provides data protection for consumers of telemedicine. Output from this research can be a guideline for consumer protection practices in digital start-ups as required by the Consumer Protection Law (1999) and recommendations for relevant stakeholders in digital start-up services.Keywords: Consumer Protection; Personal Data Protection; Start-Up.

The issue of personal data protection has been one of the focal points of attention in recent decades. This is because the protection of personal data is a form of realizing the right to privacy as a fundamental human right. Personal data refers to information about a specific individual’s characteristics that serves as a means of their identification. Personal data protection in Bosnia and Herzegovina is regulated by the Law on Personal Data Protection. This law governs the principles of personal data processing, the obligations of data controllers and processors, the rights of data subjects, as well as sanctions for violations of the law. Since 2016, the protection of personal data in the European Union has been regulated by the General Data Protection Regulation (GDPR), which has significantly improved the system for protecting personal data. A particularly significant category of personal data is personal health data, which includes identification and identifying information about an individual’s health and medical condition, their medical diagnosis, prognosis, and treatment, as well as information about substances that can identify that individual. Data related to an individual’s health is a crucial and potentially vulnerable aspect of their life. These are the most intimate data about an individual, the unauthorized and unjustified disclosure of which can subject them to shame, ridicule, and stigmatization, causing them significant, primarily non-material, harm. Misuse of patient information not only violates their privacy but also undermines their dignity. Therefore, personal health data can only be processed for health-related purposes, i.e., for the benefit of the individual and society as a whole. Laws regulating patients’ rights in the Federation of Bosnia and Herzegovina (the Law on Healthcare and the Law on the Rights, Obligations, and Responsibilities of Patients) guarantee patients the right to confidentiality of information and privacy, the right to data secrecy, and the right to access their medical records. The provisions of these laws significantly meet the standards for the protection of personal health data. However, in order to improve the situation in this area, there is a need to harmonize the provisions of the general data protection law, which is subsidiarily applied in the protection of personal health data, with the provisions of the General Data Protection Regulation.

The use of Financial Technology based on Peer to Peer Lending in information technology-based lending andborrowing services in Indonesia has always increased, especially since the Covid-19 pandemic. In the use ofFinancial Technology based on Peer to Peer Lending, consumers must provide personal data including alldata, information, information and documents, both electronic and non-electronic and emergency telephonenumbers. Unfortunately, there are cases of misuse of personal data, namely if consumers have not paid off theloan, the Financial Technology Company threatens to disseminate photos and personal data of the borrowerif they do not pay off the loan immediately. One of the factors that influence the misuse of personal datais the absence of facilities and regulations that comprehensively regulate the protection of personal datain Indonesia. The purpose of this study is to analyze of legal protection against consumer personal data inFinancial Technology companies. This research uses a normative juridical approach that uses data obtainedthrough library materials. The results of the study indicate that there is a need for legal reform regarding theprotection of personal data in Indonesia by issuing regulations at the level of the Act, although there are severalregulations governing the protection of personal data electronically, but these regulations do not provide firmcertainty on the protection of personal data.

This research focus on consumer personal data protection as a part of invention from privacy right in digital era. The high number of consumer personal data utilization by electronic system operator not accompanied with decent penetration stress test (PST) regulation. The purpose of this research is to give solution to clear personal data protection problem through PST testing method. The method that used by this research is normative research through statutory approach and conceptual approach. The result from this research concludes that there are still many problematic PST regulation. The problem can be seen from personal data protection that shattered in 30 statutory from different sector with no one arrange PST comprehensively. This dispute culminates to emergence dissimilarity definition, overlapping authority between receiver of System Management Security Information certification annual report, and PST operator polemic. As the result, it causes rampant of personal data breach that inflict consumer by matter, along with specific data exploitation that lead to sluggish business and economic country. Therefore, PST testing reformulation is needed as prevention step to protect consumer personal data in digital business era.

This research will explore the use of technology so that it can strengthen the legal system in Indonesia and examine best legal practices in various countries to improve consumer data protection in e-commerce. Consumer protection legal research is increasingly urgent given the risks that continue to evolve and have a significant impact on consumers. The formulation of this research problem is: 1) How is the protection of business civil law in providing protection for consumers related to the misuse of consumer personal data in e-commerce transactions? 2) What are the legal actions against the misuse of consumer data in e-commerce? This thesis research uses normative legal types on consumer protection and misuse of personal data while also researching legal aspects that regulate consumer rights and the protection of unauthorized users. The results of the study show that the protection of consumers' personal data in e-commerce transactions in Indonesia is regulated by various laws and regulations, which are relevant to the civil law aspects of business. Cases of misuse of consumer data in e-commerce have encouraged increased awareness of the importance of protecting consumer rights in civil relations between consumers and business actors.

The purpose of this study is to analyse the General Data Protection Law for the Protection of Personal Data from the perspective of the protection of the consumer's personal data, with a view to ascertaining the main aspects of the legislation and verifying its impacts in relation to geopricing practices and geoblocking. To that effect, it begins by addressing the principles of the new legislation that inform the activity of processing personal data. Right after, the main axes of structuring the law are presented, focusing on aspects that concern the processing of consumer data. Finally, the practices of geodiscrimination will be examined, with the effect of assessing the legal treatment in relation to such techniques and how they may be affected after the entry into force of the General Data Protection Law. For that, the hypothetico-deductive methodology and the bibliographic research technique were adopted. Thus, it is observed that new data protection legislation added to the protection of consumers' rights in relation to the practices of geopricing and geoblocking, insofar as the standard was designed to prevent the disinformation of the personal data holder on the purpose of the treatment of your information and the illegitimate treatment of personal data, as well as covering the possibility of redressing the consumer who holds personal data if he experiences damage.

Purpose – The purpose of this paper is to make a case for the recognition of privacy and personal data protection as species of consumer rights in Nigeria in line with the revised United Nations Guidelines for Consumer Protection (UNGCP) by amending existing laws or enacting a new law to provide for personal data protection regime for consumers. Methodology/Approach/Design – The study follows a structured review of relevant extant legislation on consumer protection and personal data protection, namely the Federal Competition and Consumer Protection Act 2018 (FCCPA) and the Nigeria Data Protection Regulation 2019 (NDPR). Findings – The paper identifies that the provisions of Nigeria’s foremost consumer protection legislation, FCCPA, does cover electronic commerce (e-commerce) or consumer privacy and personal data protection while the NDPR, subsidiary legislation on personal data protection, which is yet to be effectively implemented is too general as to provide the consumers the much-needed privacy protection in their dealings with businesses. Practical Implications–Given the importance Recognition of data privacy and personal data protection as a species of consumer rights helps in understanding consumer protection in online transactions and opens opportunities for future research on consumer privacy and data protection. Originality/Value – Given the importance attached to the protection of consumer privacy and the various ramifications of transactions involving exposure of consumers’ personal data, recognition of privacy consumers’ rights to privacy is vital in consolidating knowledge of consumer rights and identifying paths for future research.

The article is devoted to the study of the organizational and legal mechanism of personal data protection. The concept of "personal data protection" is developed in detail in domestic jurisprudence. The law regulates legal relations related to the protection and processing of personal data, with the aim of protecting the fundamental rights and freedoms of a person and a citizen, and, first of all, the right to non-interference in personal life, in connection with the processing of personal data. However, the rapid development of information technologies, the digitization of society forces us to improve the organizational and legal mechanism of personal data protection every time, to search for more effective and reliable methods and means of their protection. The actual legal basis for the protection of personal data can be found in the Constitution of Ukraine, the Criminal Code of Ukraine, the Civil Code of Ukraine, the Law of Ukraine "On the Protection of Personal Data", decisions of the Constitutional Court of Ukraine, international legal acts, consent to the mandatory use of which was given by the Verkhovna Rada of Ukraine. It is substantiated that it is the state that acts as the guarantor of the protection of a person's personal data - its task is to create an organizational and legal mechanism that would effectively protect human rights related to personal data, etc. The organizational component of the personal data protection mechanism covers the vertical of state bodies and services, which, in accordance with the powers assigned to them, carry out personal data protection activities. On the basis of the conducted research, we came to the conclusion that the organizational and legal mechanism for the protection of personal data is a set of legal norms and a complex of preventive measures carried out by relevant state bodies and services aimed at protecting personal data, stopping offenses, applying coercion to offenders and restoring violated human rights related to personal data.

Privacy as a legal concept is an unavoidable part of a modern democratic society and is recognized as one of the fundamental human rights of every citizen. The right to privacy and the protection of personal data are guaranteed by international human rights documents. In librarianship, the right to privacy and protection of personal data is also guaranteed in the documents of international library associations, which clearly emphasize that librarians are obliged in their work to protect the privacy and personal data of their users. Privacy and personal data are increasingly difficult to protect today, as access to data is simpler and easier due to the use of different and new information technologies, electronic communication, social networks, electronic databases, etc. Personal rights are guaranteed by international documents on protection of personal data and protected by national personal data protection laws. The main objectives of the paper are: to problematize the definition of the concept of privacy from several perspectives; problematize the importance of the right to privacy and protection of personal data in the context of the library profession; provide an overview of significant international documents in the field of human rights which also guarantee the right to privacy and protection of personal data; make a review of important international documents guaranteeing the right to protection and confidentiality of personal data; and finally, the paper will provide an overview of documents of international library associations that in their texts indicate the importance of privacy and protection of personal data in the library business.

La actividad cotidiana de cualquier persona deja hoy “rastro digital”. Esto obliga a plantear: ?Que ocurre con nuestro “rastro digital” cuando morimos? ?Puede la persona prever algo al respecto? El hecho de que en el “rastro digital” puedan verse involucrados tanto aspectos de caracter neta­mente personal como patrimonial, determina que la aproximacion al “rastro digital” dejado por la per­sona al fallecer pueda hacerse: o bien desde una perspectiva eminentemente patrimonial-sucesoria, de la gestion y/o el destino del patrimonio digital; o bien desde una perspectiva eminentemente personal, de la proteccion post mortem de la intimidad/privacidad y/o de los datos personales tanto del fallecido como de terceros. Este doble enfoque se refleja en la practica y tambien en la legislacion comparada, europea y norteamericana. Mas concretamente, es esta una materia en la que confluyen cuestiones de Derecho de sucesiones, de Derecho contractual y de Derecho de la persona –en particular, relativas a la proteccion de datos personales y a la proteccion de la intimidad/privacidad postuma y de terceros–. Asi, por lo que respecta al punto de vista patrimonial, si bien en principio no es posible hablar de la “heren­cia digital” como algo distinto de la “herencia analogica”, ello no obsta a que deban tenerse en cuenta ciertas especificidades que rodean y/o afectan a ciertos “bienes digitales”, en algun caso tributarias del Derecho de contratos. En este contexto, la persona puede ordenar sus “voluntades digitales”, previendo disposiciones sucesorias (nombrando “sucesores digitales”) y/o no sucesorias (ya sea designando “albacea/s digital/ es” o bien quien va a poder actuar en relacion a la proteccion de sus datos personales y/o al ejercicio de las acciones de proteccion civil del honor, la intimidad o la imagen). Por lo que respecta a la legislacion espanola, la Ley catalana 10/2017, de 27 de junio, de las volun­tades digitales, adopta una perspectiva esencialmente patrimonial, previendo la posibilidad de designar un “albacea digital” para que actue ante los prestadores de servicios digitales con los que el causante tenga cuentas activas. El hecho de que la norma catalana se muestre plenamente respetuosa con el con­tenido del contrato suscrito entre el usuario fallecido y el prestador de servicios contrasta con las solu­ciones adoptadas al respecto en otros ordenamientos. Por otra parte, la regla por defecto de no acceso al “contenido” de las cuentas y archivos digitales, salvo que el causante lo haya establecido o se obtenga autorizacion judicial, aproxima la Ley catalana a lo previsto en otros sistemas. En la Ley Organica 3/2018, de 5 de diciembre, de Proteccion de Datos Personales y garantia de los derechos digitales, confluyen tanto el enfoque personal –de la proteccion de datos de las personas fallecidas–, como el patrimonial –relativo a los “contenidos digitales”– (en el mal llamado “testamento digital”). Esta ley parte de la regla de acceso por defecto a los contenidos digitales o a los datos perso­nales del fallecido, y establece una legitimacion muy amplia en cuanto a facultades y demasiado extensa en cuanto a personas legitimadas, sin establecer prelacion alguna entre ellas. Esto, que puede generar problemas en la practica, contrasta con lo previsto en la Ley catalana y en otras legislaciones de nuestro entorno. La Ley Organica 3/2018 se revela, asi, mas como una ley de desproteccion de datos y de con­tenidos digitales, que no de proteccion de los mismos.

Legal protection for consumers must be considered because the existence of consumers is prone to fraud. Personal consumer data protect one form of legal protection for consumers in conducting transactions with business actors, both domestic and foreign transactions. With the times at this time, consumer data that exists on business actors, both in the form of state-owned enterprises or business actors in the private form, is a lot of consumer data that these business actors trade and this consumer data is widely known. The problem studied is how the consumer’s legal protection of personal data on digital platforms. Research methods are using normative research methods, namely by explaining the issues and views of consumer legal protection of personal data on existing legal regulatory, digital platforms. The results illustrate that for now, consumer legal protection of personal data on digital platforms still refers to several laws and regulations in Indonesia. The government is also preparing a Draft Law on Personal Data Protection, which will become lex specialis. For the protection of personal consumer data in Indonesia related to personal data on digital platforms.

The development of digital technology has driven the transformation of banking services that are now digital-based. Behind the convenience of these services, there are major challenges related to the protection of consumer personal data. This research aims to analyse the legal protection of personal data in digital banking services in Indonesia. This normative research uses a statutory approach by examining relevant laws and regulations, such as the Personal Data Protection Act, Financial Services Authority Regulations and Bank Indonesia Regulations as well as a conceptual approach. The results of this study show that there are already several laws and regulations governing digital financial services in Indonesia that seek to provide protection for the use of personal data for financial services consumers, although there are still several cases of theft and misuse of personal data of financial services consumers as well as forms of legal protection of personal data in digital banking services. This study is expected to provide further understanding of the urgency of personal data protection and the contribution of regulations in creating a safe digital banking ecosystem for consumers.