JAKARTA,LITERASIHUKUM.COM - For decades, Indonesian law in the field of transactions and consumer protection was known for the principle of "caveat emptor" latin which means "let the buyer beware". This principle was born from the assumption that the buyer has a weaker position but still has to actively protect himself. However, in a digital age enveloped by a heavy flow of personal data, this paradigm is considered obsolete and even dangerous.

The presence ofLaw Number 27 of 2022 on Personal Data Protection (UU PDP)brings a breath of fresh air as well as a silent but powerful legal revolution. This law explicitly or implicitly shifts the center of gravity of responsibility from consumers (personal data subjects) to service providers or corporations (personal data controllers). This shift is nothing but a change fromcaveat emptorgo tocaveat venditormeans "let the seller take responsibility".

What is the fundamental meaning of this change for the community, business actors, and law enforcement officials in Indonesia? This article will thoroughly explore the paradigm shift, complete with legal foundations, case studies, and implementation challenges.

Understanding Two Contrasting Paradigms

Caveat Emptor: The Legacy of Roman Law that is Being Abandoned

Caveat emptorhas its roots in ancient Roman law which emphasizes freedom of contract (pacta sunt servandathis principle assumes that both parties have an equal bargaining position. In practice, this principle states that the buyer purchases a good or service "as is". If after the transaction a hidden defect is found, the buyer cannot sue the seller unless there was a specific agreement beforehand.

In the context of personal data protection, the application ofcaveat emptormeaning:users of digital services are considered fully responsible for the security of their own data. Digital platforms only need to provide long and complicated terms and conditions, and the user is deemed to "agree" by clicking the "I Agree" button. If a data breach occurs, the user (buyer) is blamed for not being careful enough, such as using a weak password or accessing public Wi-Fi.

A classic example before the PDP Law was when there was a leak of customer data e-commercehowever, companies often only issue apologies and advise users to change passwords on their own. Consumer lawsuits almost always fail because the plaintiffs are unable to prove the technical negligence of the company.