The development of technology and science, notably the emergence of the popularity of Chat GPT, has resulted in various legal issues regarding personal data privacy in Vietnam. Currently, personal data in Vietnam is regulated in various laws and legal documents, which cannot provide consistency comparably to the General Data Protection Regulation (GDPR) of the European Union, the Personal Information Protection Law of the People's Republic of China and other laws and regulations from other countries.

In that context, the Draft Decree on personal data protection was drafted to gather feedback and opinions from 2021 (“Draft Decree”). However, on 07 February 2023, the Government promulgated Resolution No 13/NQ-CP approving the application to draft the decree on personal data protection (“Resolution 13”). Accordingly, the National Assembly Standing Committee has considered the necessity in promulgating the order, procedures, and documents for the draft decree. This can be considered as an important step to promulgate the Decree on personal data protection in Vietnam. 

Highlights of Resolution 13

The prominent content of Resolution 13 is providing for the circumstances when personal data can be processed without the consent of the data owner.

Specifically:

a) For life or health preservation of the data owner or other individuals in emergency. The Personal Data Controller, Personal Data Processor and Personal Data Controller and Processor, and third parties have the onus to prove the occurrence of this circumstance;

Comparing with the Draft Decree and the currently effective regulations on personal data, the aforementioned regulations on personal data have mentioned new definitions, namely Personal Data Controller and Personal Data Controller and Processor. At this moment, the laws in Vietnam do not separate the data controller and data processor, and only refer to “organizations, individuals collecting, processing and using personal data from other individuals” ¹ and “organizations, individuals processing personal information”. ²

The addition of the new definitions to the Draft Decree should propel Vietnamese laws to the close to the level of GDPR, as GDPR provides for the clear definition of “data processor”, “data controller” and the obligations of the mentioned subjects.

However, as the latest version of the Draft Decree has not been disclosed, the details of the definition on Personal Data Controller are unknown.

b) The disclosure of personal data is in accordance with the law

c) For data processing of competent authorities in emergencies with respect to national defense, national security, order and safety of society, significant disaster, dangerous pandemic; the occurrence of security risks, national defense not reaching the level of promulgating emergency; prevention of riot, terrorism, criminal and illegal activities in accordance with laws and regulations;

d) For the performance of contracts of data owner with the relevant agencies, organizations, individuals in accordance with the law

Accordingly, Resolution 13 has expanded the cases where the processing organization can process personal data without consent from the data owner from “to perform the contracts on use of information, products, services on the internet” provided in the Law on Information Technology to “contracts of data subjects.” This provision is relatively broad and might need further clarification or guidance from the competent authorities.

Our implication:

1. With the broadness of the above regulations in item (d) above, it can be “exploited” to unnecessarily process personal data without the consent of data owners. As such, the competent authorities should provide appropriate guidance on this regulation to limit the use of this provision affecting the interest of data subjects.
2. Resolution 13 also does not clarify the application of the regulations to personal sensitive information or children as data owners. As the aforementioned issues are special in nature, the processing of such data or from such owners should be regulated separately. Therefore, the official Decree on personal data protection should be examined holistically.
3. Although Resolution 13 shows the Government’s intention to emulate the GDPR of the European Union, the competent authorities must provide specific guidance and explanation for circumstances of processing data without consent from the data owner, particularly for circumstances where data is processed for the performance of contracts of data owner with relevant agencies, organizations and individuals in accordance with the law.

Note:

1. Law on information technology No. 67/2006/QH11 – Article 21
2. Law on Cybersecurity No. 86/2015/QH13 – Article 3(17)