Identity Theft? Take This Action

PERTANYAAN

Is the criminal justice process for identity theft the same as conventional criminal justice?

INTISARI JAWABAN

Recently, Indonesia has the PDP Law as a special regulation that includes criminal sanctions related to personal data protection.

What are the criminal sanctions contained in the PDP Law and are the procedural laws applicable in the judicial process the same as those stipulated in the Criminal Procedure Code?

Please read the review below for a further explanation.

ULASAN LENGKAP

Thank you for your question.

This article is an English translation of Terjadi Pencurian Data Pribadi (Identity Theft)? Tempuh Langkah Ini written by Bernadetha Aurelia Oktavira, S.H., and published on Friday, 7 October 2022.

This article below is an update of the article entitled Legal Measures against Personal Data Theft (Langkah Hukum terhadap Pencurian Data Pribadi), which was written by Laksono Daniel Christian Hutagalung, S.H., LL.M. and was published on Tuesday, 5 November 2019. 

All legal information available on Klinik hukumonline.com has been prepared for educational purposes only and is general in nature (read the complete Disclaimer). In order to obtain legal advice specific to your case, please consult with Justika Partner Consultant.

Personal Data Protection

To first clarify the answer to your question, we will first explain about the protection of personal data. There is now a PDP Law or also known as Law 27/2022.

Why should personal data (data pribadi in Bahasa Indonesia) be protected? This is because personal data protection is one of the human rights that is part of personal protection, so it is necessary to provide a legal basis to provide security for personal data while guaranteeing the rights of citizens.[1]

Thus, what is personal data? Under the PDP Law, personal data are data regarding individuals who are identified or can be identified separately or in combination with other information, either directly or indirectly through an electronic or non-electronic system.[2]

What is included in personal data? Personal data consist of:[3]

1. Specific personal data, namely, health data and information, biometric data, genetic data, crime records, child data, personal financial data, and/or other data in accordance with provisions of laws and regulations
2. General personal data, namely, full name, gender, citizenship, religion, martial status, and/or combined personal data to identify a person.

Criminal Sanctions for Identity Theft in Indonesia

In general, the judicial process of a criminal offense is based on Criminal Procedure Code as a procedural law that contains the orderly process of resolving or handling criminal cases contained in the Criminal Code, starting from the preliminary investigation, full investigation, prosecution, trial, examination, appeal, cassation, and judicial review.

Criminal Procedure Code and Criminal Code are lex generali in criminal law. This means that if there are other laws outside the Criminal Procedure Code and Criminal Code that have specific or special procedural laws and specific criminal sanctions, then these provisions apply lex specialis.

Also read: 3 Principles of Law: Lex Superior, Lex Specialis, and Lex Posterior Along with Examples

Meanwhile, in the PDP Law itself, criminal sanctions are regulated for the following actions:

1. Every Person who intentionally and unlawfully obtains or collects Personal Data that do not belong to them with the intention to benefit themselves or other persons which may result in the loss of the Personal Data Subject as referred to in Article 65 paragraph (1) shall be sentenced to a maximum imprisonment of 5 (five) years and/or a maximum fine of Rp5,000,000,000.00 (five billion rupiah).[4]
2. Every Person who intentionally and unlawfully discloses Personal Data that do not belong to them as referred to in Article 65 paragraph (2) shall be sentenced to a maximum imprisonment of 4 (four) years and/or a maximum fine of Rp4,000,000,000.00 (five billion rupiah).[5]
3. Every Person who intentionally and unlawfully uses Personal Data that do not belong to them as referred to in Article 65 paragraph (3) shall be sentenced to a maximum imprisonment of 5 (five) years and/or a maximum fine of Rp5,000,000,000.00 (five billion rupiah).[6]
4. Any Person who intentionally create false Personal Data or falsify Personal Data with the intention to benefit themselves or other persons which may result in the loss of other persons as referred to in Article 66 shall be sentenced to a maximum imprisonment of 6 (six) years and/or a maximum fine of Rp6,000,000,000.00 (six billion rupiah).[7]

Based on the above provisions, the criminal offense of identity theft as you asked can be charged using Article 67 section (1) and (3) PDP Law, which carries a maximum imprisonment of 5 years and/or a maximum fine of Rp5 billion.

In addition to criminal sanctions, additional sentences may be imposed in the form of confiscation of obtained profits and/or assets or proceeds from criminal acts and compensation payment.[8]

Meanwhile, if identity thefts are conducted by a Corporation, the sentence under Article 67 PDP Law may be imposed to the manager, controller, commanding officer, beneficial owner, and/or corporation (for fines).[9]

The fines imposed on a corporation is maximum of 10 (ten) times from the maximum sentence imposed. In addition, a corporation may be imposed on additional sentences in the form of:[10]

1. confiscation of profits and/or assets obtained or proceeds from crimes;
2. suspension of the entire or part of the corporation’s business;
3. permanent prohibition of doing certain actions;
4. shutdown of the entire or part of the Corporation’s place of business and/or activities;
5. fulfill the obligations that have been neglected;
6. payment of compensation;
7. revocation of license; and/or
8. dissolution of the corporation.

Also read: Administrative and Criminal Sanctions in the Personal Data Protection Law

Applicable Procedural Law

Based on the principle of lex specialis, Article 64 section (2) PDP Law states that the applicable procedural law in the judicial process of personal data protection is carried out based on the applicable procedural law in accordance with statutory provisions. In addition, if necessary to protect personal data, the court proceeding may be conducted in a closed court.[11]

Valid evidence in this PDP Law shall consist of:[12]

1. evidence as referred to in the procedural law; and
2. other evidence in the form of electronic information and/or electronic documents in accordance with provisions of laws and regulations.

So, to answer your question, although criminal sanctions have been specifically regulated in the PDP Law, the applicable procedural law in the criminal justice process related to personal data protection still refers to the provisions in the Criminal Procedure Code.

Actions that Victims Can Take

Then, what legal measures can be taken by victims of identity theft? Besides reporting the perpetrator to the police, according to Article 12 section (1) PDP Law, personal data subjects have the right to sue and receive compensation for violations of the processing of personal data regarding themselves in accordance with provisions of laws and regulations.

Moreover, according to Article 26 section (1) and (2) Law 19/2016, victims can file a civil lawsuit where the relevant provisions confirm as follows.

1. Unless determined otherwise by Laws and Regulations, the use of any information through electronic media which is related to the personal data of a person shall be conducted with consent from the Person concerned.
2. Every person whose right is violated as referred to in paragraph (1) may file a lawsuit for the loss incurred based on this Law.

Compensation lawsuits against parties who misuse personal data are in the form of lawsuits against the law a.k.a unlawful acts based on Article 1365 Civil Code.

Also read: Examples of Unlawful Acts and the Basis of the Lawsuit

These are the answers we can provide, we hope you will find them useful.

Legal Basis:

1. The 1945 Constitution of the Republic of Indonesia;
2. Civil Law Code;
3. Criminal Code;
4. Law Lumber 8 of 1981 on Criminal Procedure Code;
5. Law Number 11 of 2008 on Electronic Information and Transactions as amended by Law Number 19 of 2016 on the Amendment to Law Number 11 of 2008 on Electronic Information and Transactions;
6. Law Number 27 of 2022 on Personal Data Protection.

---

[1] Dictum of consideration of Law Number 27 of 2022 on Personal Data Protection (“PDP Law”) jo. Article 28G section (1), Article 28H section (4), and Article 28J The 1945 Constitution of the Republic of Indonesia;

[2] Article 1 number 1 PDP Law.

[3] Article 4 PDP Law.

[4] Article 67 section (1) PDP Law.

[5] Article 67 section (2) PDP Law.

[6] Article 67 section (3) PDP Law.

[7] Article 68 PDP Law.

[8] Article 69 PDP Law.

[9] Article 70 section (1) and (2) PDP Law.

[10] Article 70 section (3) and (4) PDP Law.

[11] Article 64 section (4) PDP Law.

[12] Article 64 section (3) PDP Law.