Currently, personal data in Vietnam is regulated by various laws and legal documents, which cannot provide consistency comparable to the General Data Protection Regulation (GDPR) of the European Union, the Personal Information Protection Law of China, and laws and regulations from other nations.

Vi Nguyen - Lawyer, Dentons LuatViet

In this context, a draft decree on personal data protection was drafted to gather feedback and opinions from 2021. However, in February this year, the government published Resolution No.13/NQ-CP approving the application to draft the decree on personal data protection.

Accordingly, the National Assembly Standing Committee has considered the necessity of the order, procedures, and documents for the draft decree. This is an important step forward in personal data protection in Vietnam.

Resolution 13 provides for circumstances when personal data can be processed without the consent of the data owner. Compared with the draft decree and the currently regulations on personal data, the aforementioned regulations on personal data have new definitions, namely regarding personal data controllers and personal data processors.

Currently, the laws in Vietnam do not separate the data controller and data processor, and only refer to “organisations and individuals collecting, processing, and using personal data from other individuals” as well as “organisations and individuals processing personal information”.

The addition of the new definitions should bring Vietnamese laws closer to the level of GDPR, which provides a clear definition of data processor and data controller as well as their obligations. However, as the latest version of the draft has not been disclosed, the details are unknown.

The disclosure of personal data is in accordance with the law. Areas covered include national defence, security, safety, significant disasters, and pandemics, among others.

For the performance of contracts of data owner with the relevant agencies, organisations and individuals must act in accordance with the law. Accordingly, Resolution 13 has expanded the cases where the processing organisation can process personal data without consent from the data owner “to perform the contracts on use of information, products, and services on the internet” provided in the Law on Information Technology to contracts of data subjects. This provision is relatively broad and might need further clarification.

Overall, the broadness of the above regulations could be exploited to unnecessarily process personal data without the consent of data owners. As such, authorities should provide appropriate guidance on this regulation to limit the use of this provision affecting the interest of data subjects.

Resolution 13 also fails to clarify the application of the regulations to personal sensitive information or children as data owners. As these issues are special in nature, the processing of such data or from such owners should be regulated separately. Therefore, the official decree on personal data protection should be examined holistically.

Although Resolution 13 shows the government’s intention to emulate the GDPR of the EU, authorities must provide specific guidance and explanation for circumstances of processing data without consent from the data owner, particularly for circumstances where data is processed for the performance of contracts of the data owner with relevant agencies, organisations, and individuals in accordance with the law.