Legal Analysis of Open Banking and Bank Customer Data Privacy Rights in Indonesia - Karwati, Karwati; Hardyansah, Rommy; Saktiawan, Pratolo (Journal of Social Science Studies, 2024)
The development of digital finance has encouraged the implementation of open banking as a mechanism for sharing bank customer data through application programming interfaces (APIs) between financial institutions and third parties. In Indonesia, this development intersects with the strengthening of personal data protection through Law Number 27 of 2022 concerning Personal Data Protection (PDP Law), Bank Indonesia Regulations concerning Data and Information Policy, and various Financial Services Authority (OJK) regulations concerning digital financial services and fintech. This study aims to analyses open banking regulations from the perspective of bank customer data privacy rights using a normative juridical method based on a literature review of legislation and the latest academic literature. The results of the analysis show that the PDP Law provides a general foundation through the principles of lawfulness, fairness, and transparency, while also guaranteeing customers, as data subjects, the rights of access, correction, deletion, and objection. At the sectoral level, Bank Indonesia regulations on data and information policy govern banking data governance, security standards, and support for digital innovation, while OJK regulations emphasize consumer protection and risk management in the use of customer data by fintech players. Theoretically, this combination of regulations can support the implementation of open banking in line with modern data protection principles, as long as the division of roles between banks, technology service providers, and regulators is clearly defined. This study concludes that the effectiveness of customer privacy protection in open banking schemes is greatly influenced by the implementation of explicit consent, clarity of opt-in and opt-out mechanisms, API design that applies data minimization and accountability, and consistent monitoring and sanctions for data breaches. The main recommendations of the study are the need for joint guidelines between authorities, strengthening technical standards and data compliance audits, and improving customer data literacy so that the rights granted by the PDP Law and sectoral regulations can be effectively implemented in digital banking practices.