Public trading of personal data in Vietnam has always been a critical and concerning issue for many years. In May 2021, two individuals were prosecuted for buying and selling 1,300 GB of data, containing massive amounts of personal information. This is just one of many cases that involve buying and selling personal data in Vietnam.
In recent years, the Vietnamese government has focused more on personal information security matters. On 5 October 2021, the Ministry of Justice of Vietnam held an online seminar on "Sharing France's experience in protecting personal data online". At the event, The Deputy Director of the Criminal - Administrative Law Department – Ms. Nguyen Thi Hanh, emphasized that protecting personal data has become an important and urgent issue which must be addressed by the Vietnamese government. There is a significant need for legislators to confirm and communicate regulations to protect the rights of individuals, particularly those rights regarding the protection of personal information in the current internet environment.
Today, legal provisions on personal data protection appear in scattered legal documents, such as the Constitution, diverse laws, decrees, and circulars. For example, the 2013 Constitution stipulates that individuals are entitled to comprehensive protection regarding the privacy and confidentiality of their personal information. Another example is the Law on Cyber Information Security 2015, which stipulates that organizations/individuals can only collect personal information after having obtained owners’ consent on the scope and purpose for the use of this information; and they may not provide, share or distribute such information to third parties, except at the request of a State agency. Those who violate the provisions of the Law on Cyber Information Security may be required to pay damages, handle administrative violations, or be imprisoned, depending on the nature, degree of danger, and consequences of the violation. Under the 2015 Criminal Code, acts related to infringing upon personal privacy will be criminally sanctioned, specifically acts of “infringing upon the secrecy or safety of another person's correspondence, telephone, telegram or other forms of communication of private information” or “giving or using the information on computer networks or telecommunications networks”. However, these two crimes were only partially regulated, and the 2015 Criminal Code did not specifically or directly, regulate violations against personal data on the internet.
As indicated above, Vietnamese law does not, currently, include sufficient and specific regulations to protect personal, online information − comprehensively. In addition, the acts of infringement have not been specified, particularly, those that infringe on personal rights in cyberspace, whereas the internet is rapidly growing, and ensuing cybercrimes are more and more complex.
To best protect the rights of private individuals, legislators must carefully study evolving trends in the cybercrime environment to overcome the limitations of the regulations mentioned above. In addition, it is necessary to research actions taken by other countries around the world, with a focus on those that have established effective and comprehensive systems for protecting personal information, in order to benefit from that experience when developing applicable legal systems in Vietnam.
