<![CDATA[The rapid growth of online loan (fintech lending) services in Indonesia has expanded public access to financial services while simultaneously raising legal concerns regarding the protection of borrowers’ personal data. During the online verification process, borrowers are often required to grant access to personal information, creating significant risks of misuse. In practice, some online loan providers exploit borrowers’ personal data, including contact lists, as a means of debt collection through intimidation, harassment, or unauthorized dissemination of personal information, causing both material and immaterial losses. This study examines the following research questions: (1) what are the legal characteristics of losses arising from the misuse of borrowers’ personal data in online lending services, and (2) what is the legal liability of creditors for such misuse? Accordingly, this study aims to analyze the characteristics of the losses suffered by borrowers and to examine the legal responsibility of creditors who misuse borrowers’ personal data. This research employs a normative legal research method using statutory, conceptual, and case approaches through the analysis of primary and secondary legal materials. The findings reveal that the legal relationship between creditors and borrowers is established through a standard form agreement that limits borrowers’ bargaining power. Borrowers may suffer material and immaterial damages resulting from unlawful debt collection practices involving the misuse of personal data. Creditors may therefore incur civil liability in the form of compensation, while Law No. 27 of 2022 on Personal Data Protection also provides administrative and criminal sanctions for unlawful processing of personal data. In conclusion, Indonesia still lacks comprehensive legislation specifically regulating online lending agreements, making stronger legal protection necessary to ensure legal certainty and safeguard borrowers’ personal data rights.]]>
