The User’s Position as Personal Data Controller in the Utilization of Electronic Systems in the Form of Messaging Applications in Review of Law Number 27 of 2022 concerning Personal Data Protection

In its development, privacy as the right to be let alone and privacy right has now been recognized and regulated more comprehensively and specifically in Law Number 27 of 2022 on Personal Data Protection (UU PDP), along with the increasing use of messaging applications as a digital communication medium by the public. In its general use, there is a flow of information, transmitted by and between users, which can be in the form of electronic documents and often simultaneously can contain personal data (privacy). In the transmission of information flows involving personal data, it can be seen that there are users who collect and process personal data (recipients of personal data), and there are users who are interlocutors, who also send personal data to recipients (senders of personal data). This research is conducted using normative juridical method and will discuss the position of the user of the messenger application as the controller of personal data in the utilization of the messenger application and its legal consequences according to the PDP Law. From the results of the research, it can be seen that the user of a messaging application who collects and processes personal data (recipient of personal data) of their interlocutor can act as a personal data controller in the context of the PDP Law, if the user manages personal data and determines the reasons (why and how) for the management. The legal consequences that arise include the regulatory provisions in the PDP Law, especially those relating to the obligations of personal data controllers, which apply to users in their position as personal data controllers, as well as legal liability in the event of unlawful acts against personal data.