Legal protection of personal data for emergency contacts unilaterally included in illegal online loan services

New opportunities for digital financial services (Fintech) have emerged to accelerate digital financial inclusion amid social distancing, one of which is through Online Loans. The convenience offered by Online Loans in the process of borrowing money or financing without having to visit conventional financial institutions such as banks directly, is one of the factors supporting the increasing popularity of Online Loans, thereby opening up more opportunities for Online Loan Providers to expand their industry. However, issues arise due to the ease of this technology, one of which is the misuse of borrowers' emergency contacts, causing inconvenience to the owners of those contacts whose personal lives are disrupted. The study is conducted using normative legal research. The experience of convenience offered by Online Loans is much greater; the borrowing process only takes place through a website or mobile phone, allowing consumers to confirm only through the system and do it anytime and anywhere. However, the conveniences provided by Online Loans are often not accompanied by adequate education in society regarding the technology used or the legal and lending provisions. This has become a loophole for "predatory lending" actors to develop their businesses. Legal protection for borrowers is already regulated in the Financial Services Authority Regulation Number 10/POJK.05/2022 Regarding Information Technology-Based Borrowing and Lending Services. Borrowers regarding their personal data have also been clearly regulated in Law Number 27 of 2022 Concerning Personal Data Protection, as well as the presence of Financial Technology associations that accompany the pace of technology-based borrowing and lending services. Control of personal data must obtain explicit consent from the data subject to process personal data. There are several sanctions for online loan customers who provide emergency contact numbers without consent. These sanctions include written warnings, temporary cessation of all personal data processing activities, deletion or destruction of personal data, and/or administrative fines.