Is the criminal justice process for identity theft the same as conventional criminal justice?
DAFTAR ISI
INTISARI JAWABAN
Recently, Indonesia has the PDP Law as a special regulation that includes criminal sanctions related to personal data protection.
What are the criminal sanctions contained in the PDP Law and are the procedural laws applicable in the judicial process the same as those stipulated in the Criminal Procedure Code?
Please read the review below for a further explanation.
This article below is an update of the article entitled Legal Measures against Personal Data Theft (Langkah Hukum terhadap Pencurian Data Pribadi), which was written by Laksono Daniel Christian Hutagalung, S.H., LL.M. and was published on Tuesday, 5 November 2019.
All legal information available on Klinik hukumonline.com has been prepared for educational purposes only and is general in nature (read the complete Disclaimer). In order to obtain legal advice specific to your case, please consult with Justika Partner Consultant.
Personal Data Protection
To first clarify the answer to your question, we will first explain about the protection of personal data. There is now a PDP Law or also known as Law 27/2022.
Belajar Hukum Secara Online dari Pengajar Berkompeten Dengan Biaya TerjangkauMulai DariRp. 149.000
Why should personal data (data pribadi in Bahasa Indonesia) be protected? This is because personal data protection is one of the human rights that is part of personal protection, so it is necessary to provide a legal basis to provide security for personal data while guaranteeing the rights of citizens.[1]
Thus, what is personal data? Under the PDP Law, personal data are data regarding individuals who are identified or can be identified separately or in combination with other information, either directly or indirectly through an electronic or non-electronic system.[2]
What is included in personal data? Personal data consist of:[3]
Specific personal data, namely, health data and information, biometric data, genetic data, crime records, child data, personal financial data, and/or other data in accordance with provisions of laws and regulations
General personal data, namely, full name, gender, citizenship, religion, martial status, and/or combined personal data to identify a person.
Criminal Sanctions for Identity Theft in Indonesia
In general, the judicial process of a criminal offense is based on Criminal Procedure Code as a procedural law that contains the orderly process of resolving or handling criminal cases contained in the Criminal Code, starting from the preliminary investigation, full investigation, prosecution, trial, examination, appeal, cassation, and judicial review.
Criminal Procedure Code and Criminal Code are lex generali in criminal law. This means that if there are other laws outside the Criminal Procedure Code and Criminal Code that have specific or special procedural laws and specific criminal sanctions, then these provisions apply lex specialis.
Meanwhile, in the PDP Law itself, criminal sanctions are regulated for the following actions:
Every Person who intentionally and unlawfully obtains or collects Personal Data that do not belong to them with the intention to benefit themselves or other persons which may result in the loss of the Personal Data Subject as referred to in Article 65 paragraph (1) shall be sentenced to a maximum imprisonment of 5 (five) years and/or a maximum fine of Rp5,000,000,000.00 (five billion rupiah).[4]
Every Person who intentionally and unlawfully discloses Personal Data that do not belong to them as referred to in Article 65 paragraph (2) shall be sentenced to a maximum imprisonment of 4 (four) years and/or a maximum fine of Rp4,000,000,000.00 (five billion rupiah).[5]
Every Person who intentionally and unlawfully uses Personal Data that do not belong to them as referred to in Article 65 paragraph (3) shall be sentenced to a maximum imprisonment of 5 (five) years and/or a maximum fine of Rp5,000,000,000.00 (five billion rupiah).[6]
Any Person who intentionally create false Personal Data or falsify Personal Data with the intention to benefit themselves or other persons which may result in the loss of other persons as referred to in Article 66 shall be sentenced to a maximum imprisonment of 6 (six) years and/or a maximum fine of Rp6,000,000,000.00 (six billion rupiah).[7]
Based on the above provisions, the criminal offense of identity theft as you asked can be charged using Article 67 section (1) and (3) PDP Law, which carries a maximum imprisonment of 5 years and/or a maximum fine of Rp5 billion.
In addition to criminal sanctions, additional sentences may be imposed in the form of confiscation of obtained profits and/or assets or proceeds from criminal acts and compensation payment.[8]
Meanwhile, if identity thefts are conducted by a Corporation, the sentence under Article 67 PDP Law may be imposed to the manager, controller, commanding officer, beneficial owner, and/or corporation (for fines).[9]
The fines imposed on a corporation is maximum of 10 (ten) times from the maximum sentence imposed. In addition, a corporation may be imposed on additional sentences in the form of:[10]
confiscation of profits and/or assets obtained or proceeds from crimes;
suspension of the entire or part of the corporation’s business;
permanent prohibition of doing certain actions;
shutdown of the entire or part of the Corporation’s place of business and/or activities;
Based on the principle of lex specialis, Article 64 section (2) PDP Law states that the applicable procedural law in the judicial process of personal data protection is carried out based on the applicable procedural law in accordance with statutory provisions. In addition, if necessary to protect personal data, the court proceeding may be conducted in a closed court.[11]
Valid evidence in this PDP Law shall consist of:[12]
evidence as referred to in the procedural law; and
other evidence in the form of electronic information and/or electronic documents in accordance with provisions of laws and regulations.
So, to answer your question, although criminal sanctions have been specifically regulated in the PDP Law, the applicable procedural law in the criminal justice process related to personal data protection still refers to the provisions in the Criminal Procedure Code.
Actions that Victims Can Take
Then, what legal measures can be taken by victims of identity theft? Besides reporting the perpetrator to the police, according to Article 12 section (1) PDP Law, personal data subjects have the right to sue and receive compensation for violations of the processing of personal data regarding themselves in accordance with provisions of laws and regulations.
Moreover, according to Article 26 section (1) and (2) Law 19/2016, victims can file a civil lawsuit where the relevant provisions confirm as follows.
Unless determined otherwise by Laws and Regulations, the use of any information through electronic media which is related to the personal data of a person shall be conducted with consent from the Person concerned.
Every person whose right is violated as referred to in paragraph (1) may file a lawsuit for the loss incurred based on this Law.
Compensation lawsuits against parties who misuse personal data are in the form of lawsuits against the law a.k.a unlawful acts based on Article 1365 Civil Code.