Weaknesses in the Construction of Corporate Criminal Liability in Article 70 of the Personal Data Protection Law

Abstract

The development of digital technology in Indonesia has increased the use of personal data by various corporations, from large companies to digital startups. This situation creates a significant risk of data breaches, necessitating clear and effective corporate criminal liability. Article 70 of the Personal Data Protection Law addresses corporate criminal liability; however, its structure reveals notable weaknesses. This provision primarily focuses on the faults of individual managers, overlooking the collective and systemic responsibilities of the organization; thus, the narrow perspective makes it challenging to prove and impose sanctions effectively. This study employs a qualitative normative method with a statutory and conceptual approach. The regulatory analysis examines the Personal Data Protection Law to assess its normative structure, forms of accountability, and types of sanctions. The conceptual approach highlights theories of corporate fault, liability, and the principle of data protection as a constitutional right, aiming to examine normative weaknesses and propose a normative reconstruction. The results show that Article 70 still lacks objective indicators, has the potential to lead to scapegoating, and underemphasizes preventive mechanisms (compliance-based liability). The proposed normative reconstruction includes a clear separation of corporate and managerial responsibilities, integration of compliance obligations, implementation of risk-based accountability, and expansion of types of sanctions in the form of compliance orders, data governance reform, and corporate probation. This approach is expected to improve the effectiveness of law enforcement, strengthen corporate accountability, and optimally protect data subjects' rights.