Abstract: Bain & Company and Facebook research predicts that the online shopping sector in Indonesia will grow 3.7 times from US$ 13.1 billion in 2018 to US$ 48.3 billion in 2025, and the number of digital consumers in Indonesia is as much as 64 million people in 2017 to as many as 102 million people or around 53% of the total population in 2018. Even so, this massive e-commerce development itself opens up opportunities for cybercrime or what is commonly called cybercrime. Theft of personal data is a form of privacy violation. The formulation of the problem in this research is what is the basis for the judge's considerations in imposing a crime on misuse of personal data in Decision Number 438/Pid.Sus/2020/PN.Jkt.Utr? This research uses the type of juridical-normative research. The results of the study showed that Dede Supardi had committed an unlawful act in accordance with statutory provisions, especially in RI Law Number 19 of 2016 in Article 27 paragraph (4) which explained all the actions of the defendant. Based on the analysis of the decision number 438/Pid.Sus/2020/PN.Jkt.Utr which the author does that criminal responsibility for perpetrators who commit criminal acts of extortion and threats through the dissemination of personal data is in accordance with Article 45 paragraph (4) Jo Article 27 paragraph (4 ) Law of the Republic of Indonesia Number 19 of 2016 concerning Amendments to Law of the Republic of Indonesia Number 11 of 2008 concerning Information and Electronic Transactions. Penalties will be imposed on individuals or corporations who commit prohibited acts. Such as collecting personal data that is not theirs to benefit themselves or others, disclosing personal data that is not theirs and falsifying personal data for profit resulting in losses for others. Criminal provisions are regulated in articles 67-73, in the form of a maximum fine of IDR 4 billion to IDR 6 billion and a maximum imprisonment of 4 years to 6 years.Keywords: Personal data, Accountability, Consumer Protection