Vietnam’s Personal Data Protection: What Is Going To Change?

Vietnam is currently experiencing one of the fastest internet-based development in the world. While the number of Internet users in Vietnam has reached more than 64 million people, accounting for more than 2/3 of the population (66% – an increase of more than 19% compared to 2018); the country is also ranked 13th in the world in terms of internet users, including 58 million Facebook accounts and 62 million Google accounts. The Vietnamese Government is drastically directing the promotion of e-Government development towards digital government and the digital economy and has achieved significant results. However, with increased levels of technology application, the greater the provision and use of personal information. This poses the task of effectively managing & handling violations of the law on personal information as well as ensuring compliance with constitutional, national and international laws.

In accordance, the Minister of Public Security decided to publicize the draft of the Decree on Personal Data Protection (hereafter referred as “the draft Decree”) with strict regulations, pursuant to the Law on Cyber Security dated June 12th, 2018 and other relevant laws and regulations. Currently, the Ministry of Public Security is collecting suggestions from agencies, organizations and individuals in order to perfect the legal elements of the draft decree.

Subjects of the Draft Decree on Personal Data Protection in Vietnam

The draft Decree applies to all (domestic) agencies, organizations and individuals involved in the handling and processing of personal data, according to Article 1.2 of the draft. Moreover, the handling of breaches of personal data protection regulations will be applied to any domestic and foreign organizations, enterprises and individuals doing business in Vietnam, stipulated in Article 4.2 of the draft.

Personal data identified under this draft Decree will be any data regarding individuals or relating to the identification or possible identification of a particular individual. The main content that the draft has set out include regulations on personal data; handling personal data; personal data protection measures; the personal data protection committee; handling violations; personal data protection responsibility of relevant agencies, organizations and individuals.

Types of Data

The draft Decree classifies two types of personal data, “basic personal data” and “sensitive personal data”. Basic personal data includes: name, age, date of birth, place of residence, nationality, ethnicity, personal identification numbers, etc. Sensitive personal data includes: political opinion, religion, status health, financial status, offense, etc.

Measures to Protect Personal Data

The draft Decree provides many measures to protect personal data, notably principles of personal data protection such as: Legal principles (only collected in necessary cases provided by laws), the principle of minimal use (only collected to the extent necessary to achieve the specified purpose), the principle of limited use (data can only be used under the consent of the data subject or the allowance of competent authorities in accordance with laws). In addition, no individual or organization may disclose personal data of others in the event that the data mentioned is sensitive personal data or harms the legitimate interests of the data subject.

Obligations of Processors of Personal Data

Processors of personal data will be obliged to respect the data subjects’ rights, such as notifying them at the time of data processing or notifying immediately when possible; allow the data subjects to view and receive copies of their personal data; terminate the processing of personal data, restrict access to personal data, terminate disclosure or allow access to personal data, delete or close files of collected personal data as the data subject requires.

The disclosure of personal data without the data subject’s consent is allowed only in the following cases: (1) where the laws so provide; where the disclosure of information is necessary for the sake of national security, social order and safety; (3) in case of disclosure through media for the purpose of national defense and security, social order and safety, social morality, and health of the community; (4) in case of disclosure to the media according to the provisions of the Press Law, not causing economic, honor, spiritual or material damage to data subjects; (5) Any cases where it is defined by the laws as an emergency, risk of life threatening, or seriously affecting the health of the data subjects or public health.

In particular, the recording and processing data obtained through the recording and video surveillance in public places by competent state agencies stipulated by the laws will be considered as already acquiring the consensus of the data subjects.

Sanctions for Breaches of Regulations on Personal Data

The draft also provides strong sanctions for the breaches related to personal data. For example, the draft stipulates fines from VND 80,000,000 to VND 100,000,000 (approximately $3,478 to $4,347) for acts of not applying technical measures on personal data protection, violating regulations on registering sensitive personal data or violating regulations on the cross-border transfer of personal data. In addition to the specified penalty, if a personal data processor is found to have been in breach or the regulations on multiple occasions causing severe consequences, a fine of up to 5% of the total revenue of the personal data processor will be imposed.

According to the Ministry of Public Security, the protection of personal data is the foundation for socio-economic development, ensuring the operation of agencies and organizations; thereby protecting legitimate rights and interests of organizations and individuals in Vietnam.

Should you have any questions, or require any additional information, please do not hesitate to contact us at info@dandreapartners.com.