Draft decree allows personal data collection without consent

The draft, sent from the government to the National Assembly’s Standing Committee for approval, states that there are five particular situations in which one’s personal data may be collected without consent.

First, data may be collected in order to protect people’s lives and health in emergency situations.

Second, one’s personal data may be publicized “in accordance with the law.”

Third, data may be processed by authorities during emergency situations regarding national defense, security and social order. Such situations include major natural disasters, disease outbreaks, times of terrorist threats, as well as several other circumstances.

Fourth, data may be collected when there is a contractual obligation between data owners and relevant individuals and organizations.

Finally, data may be collected if it is to “serve the activities of state entities,” as regulated by existing laws.

The government has argued that the proposed policies are compatible with international practices, human rights and the demands of everyday practicality.

Without such regulations, there would be impacts on data sovereignty and national security that could impede certain socio-economic developments, according to the government, which also stated that the new decree aimed to close gaps in the law and eliminate legal loopholes.

The draft considers personal data an asset that may be exploited for socio-economic development purposes, however it must also be tightly regulated by the state, the government has reported.

Government authorities have also stated that the state must always strive to protect the consent of data owners.

Under current Vietnamese law, data owners must be informed of all activities regarding the processing of their personal data. And the sale of personal data in any form is forbidden.

If the Standing Committee agrees to pass the draft decree, it is expected to go into effect starting July 1.

In 2019 and 2020 alone, the Ministry of Public Security detected hundreds of individuals and organizations selling personal data Vietnam. The ministry reported that nearly 1,300 GB of illegally-collected data was sold on the local black market over the period.