Criminal Liability for the Misuse of Personal Data by Corporations: A Criminal Law and Corporate Liability Perspective
DOI:
https://doi.org/10.58258/dvgve850Keywords:
Criminal Law; Corporate Criminal Liability; Corporate Culture Model; Data Misuse; Personal Data Protection.Abstract
The rapid expansion of digital technologies has significantly increased the risk of personal data misuse by corporations, creating complex legal challenges in determining corporate criminal liability. Although Indonesia enacted Law Number 27 of 2022 on Personal Data Protection, the practical application of criminal liability against corporations remains problematic due to the limitations of traditional criminal law doctrines in attributing actus reus and mens rea to corporate entities. This study aims to analyze the formulation of corporate criminal liability for the misuse of personal data and to examine future criminal law policies that can strengthen legal enforcement against corporate offenders. This research employs a normative legal method using statutory, conceptual, and comparative approaches. Primary legal materials consist of Indonesian legislation concerning personal data protection and corporate criminal liability, while secondary materials are derived from recent national and international scholarly journals. The findings demonstrate that conventional doctrines, particularly the Identification Theory, are insufficient to address decentralized digital corporations operating through automated decision-making systems. Instead, the Corporate Culture Model provides a more appropriate framework by evaluating organizational policies, governance structures, and institutional compliance in determining corporate fault. Furthermore, the study recommends integrating strict liability with a due diligence defense, strengthening digital forensic standards, recognizing AI-generated evidence, and adopting proportional turnover-based financial sanctions as effective mechanisms to enhance deterrence. These reforms are expected to establish a more adaptive and effective corporate criminal liability system capable of protecting personal data rights while ensuring legal certainty and accountability within Indonesia’s digital economy.References
Anggriani, D., Febriyani, E., & Situmeang, A. (2026). Pertanggungjawaban pidana korporasi atas kebocoran data pribadi di Indonesia: Studi komparatif dengan Amerika Serikat dan Uni Eropa. Fundamental Justice, 7(1). https://doi.org/10.30812/fundamental.v7i1.6237
Azhar, D. P., & Mahyani, A. (2023). Pertanggungjawaban pidana korporasi sebagai pelaku tindak pidana penyebaran data pribadi. Bureaucracy Journal: Indonesia Journal of Law and Social-Political Governance, 3(1), 640–651. https://doi.org/10.53363/bureau.v3i1.200
Buckley, G., Caulfield, T., & Becker, I. (2024). GDPR and the indefinable effectiveness of privacy regulators: Can performance assessment be improved? Journal of Cybersecurity, 10(1), tyae017. https://doi.org/10.1093/cybsec/tyae017
Falevi, Y. (2024). Corporate criminal liability for misuse of personal data. Syiah Kuala Law Journal, 8(3), 485–499. https://doi.org/10.24815/sklj.v8i3.43280
Guntoro, M. A., Sanusi, & Sudewo, F. A. (2022). Corporate criminal liability for leakage of personal data. In Proceedings of the 1st International Conference on Law, Social Science, Economics, and Education (MALAPY 2022). https://doi.org/10.4108/eai.28-5-2022.2320539
Haditama, T. K., & Sugianto, F. (2025). A comparative analysis of corporate criminal liability for AI-based malware: A study of Indonesian and European Union law. Indonesia Law Reform Journal, 5(2). https://doi.org/10.22219/ilrej.v5i2.39901
Haryanto, S. E., & Heliany, I. (2026). Corporate liability for cybercrime: A legal analysis of the protection of personal data subjects. FOCUS: Journal of Social Studies, 7(1), 14–20. https://doi.org/10.37010/fcs.v7i1.2165
Ismaidar, & Ula, R. F. (2025). Pertanggungjawaban pidana korporasi terhadap kebocoran data pribadi konsumen dalam perspektif hukum pidana siber di Indonesia. Hukum Inovatif: Jurnal Ilmu Hukum Sosial dan Humaniora, 2(3). https://doi.org/10.62383/humif.v2i3.1802
Krol, K. (2023). Corporate criminal liability for AI-enabled cybercrime: A case study of a ransomware attack. Journal of Cybersecurity and Privacy, 3(1), 1–15. https://doi.org/10.3390/jcp3010001
Ruohonen, J., & Hjerppe, K. (2020). The GDPR enforcement fines at glance. arXiv. https://doi.org/10.48550/arXiv.2011.00946
Simanullang, B. R. H., & Yustika, L. (2026). Piercing the corporate veil: The urgency of criminal liability of directors in personal data protection law. International Journal of New Approaches to Law and Rationality in Nationhood, Governance, and Rights Advocacy, 1(2). https://doi.org/10.56861/nalarnagara.v1i2.266
Suartha, I. D. M., & Ivory, J. (2024). Corporate crime liability: Beyond rule reform on Indonesia criminal policy. Focus Journal Law Review, 4(2). https://doi.org/10.62795/fjl.v4i2.281
Velasco, C. (2022). Cybercrime and artificial intelligence: An overview of the work of international organizations on criminal justice and the international applicable instruments. ERA Forum, 23, 109–126. https://doi.org/10.1007/s12027-022-00702-z
Wheatley, S., Maillart, T., & Sornette, D. (2016). The extreme risk of personal data breaches and the erosion of privacy. The European Physical Journal B, 89(1). https://doi.org/10.1140/epjb/e2015-60754-4
Yang, L., Tian, M., Xin, D., Cheng, Q., & Zheng, J. (2024). AI-driven anonymization: Protecting personal data privacy while leveraging machine learning. arXiv. https://doi.org/10.48550/arXiv.2402.17191
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Lebrina Wonlele, Appe Hutauruk, Hotman Sinambela, Sunarno Sunarno
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
