Continuing in my examination of data privacy and cybersecurity issues in Vietnam, this week I want to look at the issue of individual data privacy rights in Vietnam, what are a data subject’s responsibilities and their rights, and what can they expect when putting their data in the wilds of the internet.
General Protections of Individual Data
Personal data, or an individual’s data, is not only protected by branch laws which have been passed in the last few years, but in Vietnam’s constitution as well. According to that document there are a few aspects of privacy which are guaranteed by law. They include:
- the inviolability of private life, personal secrets and family secrets;
- the security of information about private life, personal secrets or family secrets;
- the right to privacy of correspondence, telephone conversations, telegrams and other forms of private communication; and
- the prohibition of illegally breaking into, controlling or seizing another’s correspondence, telephone conversations, telegrams or other forms of private communication.
These rights are reflected throughout the country’s laws. While information safety and cybersecurity have both received specific treatment of late, much of the legislation covering privacy as contemplated in the constitution is spread throughout the various laws and imposes responsibilities on individuals and organizations according to their sector of activity. For example, banks are required to maintain the confidentiality of all transactions accounts and clients; and lawyers must maintain similar levels of confidentiality, refraining from disclosing personal information regarding the matters entrusted to them.
This dissemination of the right of privacy into individual laws has largely made a centralized understanding of the right difficult. For although the Civil Code provides that “the private life, personal secrets and family secrets of a person are inviolable and protected by
law,” and “the collection, preservation, use, and publication of information about the private life of an individual must have the consent of that person,” there is little other guidance regarding the collection, analysis, storage, and propagation of personal information in an age when such data has become a commodity.
Some effort has been made to keep up with this development in the data market. In 2015, the National Assembly passed the law on network information security which applies to the collection and use of data on the internet. This went a long way towards settling the rights and duties of individuals and organizations in relation to personal data online, but did little to address other avenues for data collection such as the Internet of Things or public records. It does, however, constituted Vietnam’s approach to the protection of private data, for now and as such I examine its contents as regards the protection of individual data below.
The Law on Individual Data Privacy in Vietnam
In general, individuals have a duty to protect their own data and to follow the laws of Vietnam regarding the use and protection of data. Organizations and entities collecting, storing, and analyzing that data also have duties to treat that data properly as well, but the individual must first be vigilant and aware that he is creating or disseminating data when he travels the web. The protection of individuals’ data contributes to the protection and security of the nation and the order and safety of society.
Organizations collecting data from individuals can only collect that information after obtaining the agreement of the data subject regarding the scope, purpose, and use of the data collected. Any use of that data outside such an agreement may only occur after informing and obtaining the consent of the data subject of such additional use. Collected data can only be provided, shared, or propagated to a third party after receiving consent from the data subject or upon receiving a request from an authorized government agency. Government agencies that collect data from individuals have the duty to protect and preserve that data.
Individuals have the right to request that organizations collecting their data provide them their own data which has been collected. Individuals have the power to request organizations that collect their data to revise, amend, or destroy the data that they have collected or stored. They can also request the organization to cease providing their information to a third party. Immediately upon receiving such a request, the organization collecting such information must:
- Accede to the individual’s request and report to, or provide advice of such to him that they have acceded and completed his request;
- Apply appropriate methods to protect the individual’s data; and
- Notify the requesting individual in the case where such request remains unmet due to technology or other factors.
The organization collecting data must destroy the data of the individual upon the completion of the purpose for which it was collected or upon the expiration of storage and notify the individual of such unless the law provides otherwise.
Organizations collecting data must apply appropriate methods of management and technology to protect the data of individuals which it collects and stores and follow the standards and technology protocols for protecting information safety on the internet.
Failure on the part of the organization to comply with these rules will subject that organization to administrative penalties and the possibility of criminal liability. In addition, they will be liable for indemnifying injure parties should their violating acts cause harm.
A Bill of Rights for Individual Data Privacy in Vietnam
All of that is well and good, but what rights do individuals really have when it comes to protecting their data in cyberspace? The American Chamber of Commerce has posted a reference from Westlaw’s Practical Law service all about data privacy in Vietnam (see resource here). In that document, they include a poorly worded list of the rights individuals possess when it comes to protecting their data privacy in Vietnam. With several modifications, I want to include a similar list here as it makes it plain what an individual can expect when it comes to their data.
An individual, therefore, has the following rights when protecting their individual data privacy in Vietnam:
- To protect their own personal data when using the internet;
- To give or withhold permission for the collection, processing, and storage of personal data;
- To be informed of the purpose and scope of the collection of their personal data and the use to which such personal data will be put;
- To give or withhold permission for the sharing of personal data with third parties;
- To request that the sharing of personal data with a third party cease even if they had previously provided permission for such sharing;
- To access their personal data that an organization has collected or stores;
- To update, amend, rectify, or delete the personal data that the organization has collected or stores and to receive notification from the organization when such a request is completed;
- To receive compensation for any damages caused by the organization’s violation of legal obligations when processing personal data.
As you can see, the list is relatively short and the law limited. Compared to the European Union’s GDPR and California’s CCPA this list is minimal. However, it is also open to interpretation and many terms remain undefined leaving the courts an opportunity to impose responsibilities on organizations collecting personal data that may seem excessive. The law is over five years old now and may be subject to upcoming amendments and changes that will take into account international and technological developments in the interceding time period. In the meantime, take these rights to heart and know that individuals have the right to protect their own data when dealing online.
If you have any questions regarding data privacy law in Vietnam, or law in Vietnam in general, please feel free to contact us at www.indochinecounsel.com or get in touch with me personally through the email link on the Author Bio page here on Vietnamese Law Blog.