Government outlaws sale of personal data

All personal data is to be protected, secured and stored only for time frames appropriate for the purpose of acquisition.

Owners of the data must be informed that it is being processed. Any organization or individual violating regulations on protection of personal data will be fined or prosecuted.

Vietnam would be part of international mechanisms to enforce laws and for mutual legal assistance for the protection of personal data, the government said.

The decree also forbids processing of personal data to create information that impacts national security, social order and the rights of organizations and individuals.

But it makes provision for collecting personal data without consent in certain cases like protecting lives and health during emergency situations, natural disasters, disease outbreaks, times of terrorism threats, and others and to “serve the activities of state entities” as regulated by the law.

The decree categorizes personal data as basic and sensitive. The former includes name, date of birth, gender, nationality, phone number, ID number, and marriage and family status.

Sensitive data relates to political and religious stances, health status, race, sex life, sexual orientation, and information such as bank balance.

The decree takes effect in July.