Criminal Liability in Cases of Personal Data Leakage Amid the Covid-19 Pandemic

Abstract

Recently, there was an alleged leak of personal data on the Electronic Health Alert Card (eHAC) application. The eHAC application is an application to verify passengers traveling during the Covid-19 pandemic. A report found experiencing the alleged leak of 1.3 million personal data users of the application. Meanwhile, the leaked data that can be retrieved from the eHAC database includes personal data of application users, including names, ID card numbers, passports, profile photos, and hotel details of users. In addition to personal data, documents on Covid-19 test results can also be accessed. For example, data from hospitals to clinics entered in the eHAC application, hospital details to the coordinates of the hospital location. Seeing this case, the issue of security in the management of big data becomes essential. Moreover, those big data is sensitive and significantly needed in handling the Covid-19 pandemic. In addition, the issue of who is the most criminally responsible for the leakage of personal and sensitive data also needs to be discussed so that similar cases do not occur in the future. Thus, this research paper aims to understand the legal concept of criminal liability in personal data protection and policy challenges in Indonesia. The research used doctrinal-comparative legal research, which desk study research, and qualitative method. As a result, the research found the possible models of criminal liability in cases of personal data leakage. Yet, the Indonesian government faces several challenges in implementing the concept of a personal data protection policy. Therefore, there is a need to propose how future policies related to personal data protection can be implemented in Indonesia.