Main Article Content
Abstract
In the context of the rapid digital transformation of the financial sector, credit scoring systems are increasingly relying on big data and algorithmic techniques to assess individuals’ creditworthiness. This study aims to analyse legal gaps concerning rights over financial data in digital credit scoring practices, while also clarifying the level of consumer vulnerability within algorithm-driven decision-making environments. The paper employs a doctrinal legal analysis combined with comparative legal methods and an interdisciplinary approach, particularly integrating insights from behavioural economics to explain the impact of information asymmetry and bounded rationality on consumers within the digital financial ecosystem. The findings indicate that the current legal framework has not clearly established financial data control rights, and there remain significant deficiencies in transparency mechanisms and accountability structures governing automated credit scoring systems. On this basis, the study proposes several policy directions to strengthen consumers’ control over their data, enhance algorithmic transparency, and improve supervisory mechanisms in the digital financial sector.
[Dalam konteks transformasi digital yang berkembang pesat di sektor keuangan, sistem penilaian kredit (credit scoring) semakin bergantung pada big data dan teknik algoritmik untuk menilai kelayakan kredit individu. Penelitian ini bertujuan untuk menganalisis kesenjangan hukum yang berkaitan dengan hak atas data keuangan dalam praktik penilaian kredit digital, sekaligus menjelaskan tingkat kerentanan konsumen dalam lingkungan pengambilan keputusan yang didorong oleh algoritma. Artikel ini menggunakan metode analisis hukum doktrinal yang dipadukan dengan metode hukum komparatif dan pendekatan interdisipliner, khususnya dengan mengintegrasikan perspektif ekonomi perilaku (behavioural economics) untuk menjelaskan dampak asimetri informasi dan rasionalitas terbatas (bounded rationality) terhadap konsumen dalam ekosistem keuangan digital. Hasil penelitian menunjukkan bahwa kerangka hukum yang berlaku saat ini belum secara jelas menetapkan hak pengendalian atas data keuangan. Selain itu, masih terdapat kekurangan yang signifikan dalam mekanisme transparansi dan struktur akuntabilitas yang mengatur sistem penilaian kredit otomatis. Berdasarkan temuan tersebut, penelitian ini mengusulkan beberapa arah kebijakan untuk memperkuat kendali konsumen atas data mereka, meningkatkan transparansi algoritma, serta memperbaiki mekanisme pengawasan di sektor keuangan digital.]
Keywords
Article Details
Copyright (c) 2026 Thao Thi Le (Author)

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work.
How to Cite
References
- Acquisti, A., Brandimarte, L., & Loewenstein, G. (2015). Privacy and human behavior in the age of information. Science, 347(6221), 509–514. https://doi.org/10.1126/science.aaa1465
- Akerlof, G. A. (1970). The market for “lemons”: Quality uncertainty and the market mechanism. Quarterly Journal of Economics, 84(3), 488–500. https://doi.org/10.2307/1879431
- Asian Development Bank. (2023). Financial digitalization and its implications for ASEAN+3 financial stability.
- Barocas, S., & Selbst, A. D. (2016). Big data’s disparate impact. California Law Review, 104(3), 671–732.
- Ben-Shahar, O., & Schneider, C. E. (2014). More than you wanted to know: The failure of mandated disclosure. Princeton University Press.
- Berg, T., Burg, V., Gombović, A., & Puri, M. (2020). On the rise of FinTechs: Credit scoring using digital footprints. Review of Financial Studies, 33(7), 2845–2897. https://doi.org/10.1093/rfs/hhz099
- Burrell, J. (2016). How the machine “thinks”: Understanding opacity in machine learning algorithms. Big Data & Society, 3(1), 1–12. https://doi.org/10.1177/2053951715622512
- Chi, F., Hwang, B.-H., & Zheng, Y. (2025). The use and usefulness of big data in finance: Evidence from financial analysts. Management Science, 71(6), 4599–4621. https://doi.org/10.1287/mnsc.2022.02659
- Citron, D. K., & Pasquale, F. (2014). The scored society: Due process for automated predictions. Washington Law Review, 89(1), 1–33.
- De Hert, P., & Papakonstantinou, V. (2016). The new General Data Protection Regulation: Still a sound system for the protection of individuals? Computer Law & Security Review, 32(2), 179–194. https://doi.org/10.1016/j.clsr.2016.02.006
- Dencik, L., Hintz, A., & Cable, J. (2019). Exploring data justice: Conceptions, applications and directions. Information, Communication & Society, 22(7), 873–881. https://doi.org/10.1080/1369118X.2019.1606268
- Doerr, S., Frost, J., Gambacorta, L., & Shreeti, V. (2023). Big techs in finance (BIS Working Paper No. 1129). Bank for International Settlements. https://www.bis.org/publ/work1129.pdf
- Edwards, L., & Veale, M. (2017). Slave to the algorithm? Why a ‘right to an explanation’ is probably not the remedy you are looking for. Duke Law & Technology Review, 16(1), 18–84.
- European Union. (2016a). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union.
- European Union. (2016b). Directive (EU) 2015/2366 on payment services in the internal market (PSD2). Official Journal of the European Union.
- Hildebrandt, M. (2018). Law for computer scientists and other folk. Oxford University Press.
- Hutchinson, T., & Duncan, N. (2012). Defining and describing what we do: Doctrinal legal research. Deakin Law Review, 17(1), 83–119.
- Jagtiani, J., & Lemieux, C. (2019). The roles of alternative data and machine learning in fintech lending: Evidence from the LendingClub consumer platform. Financial Management, 48(4), 1009–1029. https://doi.org/10.1111/fima.12295
- Kroll, J. A., Huey, J., Barocas, S., Felten, E. W., Reidenberg, J. R., Robinson, D. G., & Yu, H. (2017). Accountable algorithms. University of Pennsylvania Law Review, 165(3), 633–705.
- National Assembly of Vietnam. (2025). Law on personal data protection (Draft/Expected enactment in 2025).
- Organisation for Economic Co-operation and Development. (2019a). Artificial intelligence in society. OECD Publishing. https://doi.org/10.1787/eedfee77-en
- Organisation for Economic Co-operation and Development. (2019b). Enhancing access to and sharing of data: Reconciling risks and benefits for data re-use across societies. OECD Publishing. https://doi.org/10.1787/276aaca8-en
- Organisation for Economic Co-operation and Development. (2019c). OECD principles on artificial intelligence.
- Pasquale, F. (2015). The black box society: The secret algorithms that control money and information. Harvard University Press.
- Purtova, N. (2018). The law of everything: Broad concept of personal data and future of EU data protection law. Law, Innovation and Technology, 10(1), 40–81. https://doi.org/10.1080/17579961.2018.1452176
- Siems, M. (2014). Comparative law. Cambridge University Press.
- Simon, H. A. (1955). A behavioral model of rational choice. Quarterly Journal of Economics, 69(1), 99–118.
- Simon, H. A. (1957). Models of man: Social and rational. John Wiley & Sons.
- Sunstein, C. R. (2019). On freedom. Princeton University Press.
- Taylor, L. (2017). What is data justice? Big Data & Society, 4(2), 1–14.
- Thaler, R. H., & Sunstein, C. R. (2008). Nudge: Improving decisions about health, wealth, and happiness. Yale University Press.
- Varian, H. R. (2018). Artificial intelligence, economics, and industrial organization (NBER Working Paper No. 24839). National Bureau of Economic Research. https://www.nber.org/system/files/working_papers/w24839/w24839.pdf
- Voigt, P., & Von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A practical guide. Springer.
- Wachter, S., & Mittelstadt, B. (2019). A right to reasonable inferences: Re-thinking data protection law in the age of big data and AI. Columbia Business Law Review, 2019(2), 494–620.
- Wachter, S., Mittelstadt, B., & Floridi, L. (2017). Why a right to explanation of automated decision-making does not exist in the General Data Protection Regulation. International Data Privacy Law, 7(2), 76–99. https://doi.org/10.1093/idpl/ipx005
- Watkins, D., & Burton, M. (2018). Research Methods in Law. Routledge. https://api.pageplace.de/preview/DT0400.9781315386652_A30449886/preview-9781315386652_A30449886.pdf.
- Yeung, K. (2018). Algorithmic regulation: A critical interrogation. Regulation & Governance, 12(4), 505–523. https://doi.org/10.1111/rego.12158
- Zarsky, T. (2016). The trouble with algorithmic decisions: An analytic road map to examine efficiency and fairness in automated and opaque decision making. Science, Technology, & Human Values, 41(1), 118–132. https://doi.org/10.1177/0162243915605575
- Zweigert, K., & Kötz, H. (1998). An introduction to comparative law. Oxford University Press.
References
Acquisti, A., Brandimarte, L., & Loewenstein, G. (2015). Privacy and human behavior in the age of information. Science, 347(6221), 509–514. https://doi.org/10.1126/science.aaa1465
Akerlof, G. A. (1970). The market for “lemons”: Quality uncertainty and the market mechanism. Quarterly Journal of Economics, 84(3), 488–500. https://doi.org/10.2307/1879431
Asian Development Bank. (2023). Financial digitalization and its implications for ASEAN+3 financial stability.
Barocas, S., & Selbst, A. D. (2016). Big data’s disparate impact. California Law Review, 104(3), 671–732.
Ben-Shahar, O., & Schneider, C. E. (2014). More than you wanted to know: The failure of mandated disclosure. Princeton University Press.
Berg, T., Burg, V., Gombović, A., & Puri, M. (2020). On the rise of FinTechs: Credit scoring using digital footprints. Review of Financial Studies, 33(7), 2845–2897. https://doi.org/10.1093/rfs/hhz099
Burrell, J. (2016). How the machine “thinks”: Understanding opacity in machine learning algorithms. Big Data & Society, 3(1), 1–12. https://doi.org/10.1177/2053951715622512
Chi, F., Hwang, B.-H., & Zheng, Y. (2025). The use and usefulness of big data in finance: Evidence from financial analysts. Management Science, 71(6), 4599–4621. https://doi.org/10.1287/mnsc.2022.02659
Citron, D. K., & Pasquale, F. (2014). The scored society: Due process for automated predictions. Washington Law Review, 89(1), 1–33.
De Hert, P., & Papakonstantinou, V. (2016). The new General Data Protection Regulation: Still a sound system for the protection of individuals? Computer Law & Security Review, 32(2), 179–194. https://doi.org/10.1016/j.clsr.2016.02.006
Dencik, L., Hintz, A., & Cable, J. (2019). Exploring data justice: Conceptions, applications and directions. Information, Communication & Society, 22(7), 873–881. https://doi.org/10.1080/1369118X.2019.1606268
Doerr, S., Frost, J., Gambacorta, L., & Shreeti, V. (2023). Big techs in finance (BIS Working Paper No. 1129). Bank for International Settlements. https://www.bis.org/publ/work1129.pdf
Edwards, L., & Veale, M. (2017). Slave to the algorithm? Why a ‘right to an explanation’ is probably not the remedy you are looking for. Duke Law & Technology Review, 16(1), 18–84.
European Union. (2016a). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union.
European Union. (2016b). Directive (EU) 2015/2366 on payment services in the internal market (PSD2). Official Journal of the European Union.
Hildebrandt, M. (2018). Law for computer scientists and other folk. Oxford University Press.
Hutchinson, T., & Duncan, N. (2012). Defining and describing what we do: Doctrinal legal research. Deakin Law Review, 17(1), 83–119.
Jagtiani, J., & Lemieux, C. (2019). The roles of alternative data and machine learning in fintech lending: Evidence from the LendingClub consumer platform. Financial Management, 48(4), 1009–1029. https://doi.org/10.1111/fima.12295
Kroll, J. A., Huey, J., Barocas, S., Felten, E. W., Reidenberg, J. R., Robinson, D. G., & Yu, H. (2017). Accountable algorithms. University of Pennsylvania Law Review, 165(3), 633–705.
National Assembly of Vietnam. (2025). Law on personal data protection (Draft/Expected enactment in 2025).
Organisation for Economic Co-operation and Development. (2019a). Artificial intelligence in society. OECD Publishing. https://doi.org/10.1787/eedfee77-en
Organisation for Economic Co-operation and Development. (2019b). Enhancing access to and sharing of data: Reconciling risks and benefits for data re-use across societies. OECD Publishing. https://doi.org/10.1787/276aaca8-en
Organisation for Economic Co-operation and Development. (2019c). OECD principles on artificial intelligence.
Pasquale, F. (2015). The black box society: The secret algorithms that control money and information. Harvard University Press.
Purtova, N. (2018). The law of everything: Broad concept of personal data and future of EU data protection law. Law, Innovation and Technology, 10(1), 40–81. https://doi.org/10.1080/17579961.2018.1452176
Siems, M. (2014). Comparative law. Cambridge University Press.
Simon, H. A. (1955). A behavioral model of rational choice. Quarterly Journal of Economics, 69(1), 99–118.
Simon, H. A. (1957). Models of man: Social and rational. John Wiley & Sons.
Sunstein, C. R. (2019). On freedom. Princeton University Press.
Taylor, L. (2017). What is data justice? Big Data & Society, 4(2), 1–14.
Thaler, R. H., & Sunstein, C. R. (2008). Nudge: Improving decisions about health, wealth, and happiness. Yale University Press.
Varian, H. R. (2018). Artificial intelligence, economics, and industrial organization (NBER Working Paper No. 24839). National Bureau of Economic Research. https://www.nber.org/system/files/working_papers/w24839/w24839.pdf
Voigt, P., & Von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A practical guide. Springer.
Wachter, S., & Mittelstadt, B. (2019). A right to reasonable inferences: Re-thinking data protection law in the age of big data and AI. Columbia Business Law Review, 2019(2), 494–620.
Wachter, S., Mittelstadt, B., & Floridi, L. (2017). Why a right to explanation of automated decision-making does not exist in the General Data Protection Regulation. International Data Privacy Law, 7(2), 76–99. https://doi.org/10.1093/idpl/ipx005
Watkins, D., & Burton, M. (2018). Research Methods in Law. Routledge. https://api.pageplace.de/preview/DT0400.9781315386652_A30449886/preview-9781315386652_A30449886.pdf.
Yeung, K. (2018). Algorithmic regulation: A critical interrogation. Regulation & Governance, 12(4), 505–523. https://doi.org/10.1111/rego.12158
Zarsky, T. (2016). The trouble with algorithmic decisions: An analytic road map to examine efficiency and fairness in automated and opaque decision making. Science, Technology, & Human Values, 41(1), 118–132. https://doi.org/10.1177/0162243915605575
Zweigert, K., & Kötz, H. (1998). An introduction to comparative law. Oxford University Press.