Principles on Processing of Personal Data under the new Decree 13/2023/ND-CP

Principles on Processing of Personal Data under the new Decree 13/2023/ND-CP

Introduction

On 17 April 2023, after a thorough drafting and revising procedure, the Government had promulgated the first-ever Decree No. 13/2023/ND-CP on Personal Data Protection (“PDPD”), with the aim to provide a comprehensive and uniform approach to personal data safeguards in Vietnam. As the PDPD encompasses mostly on the requirements applicable to businesses involving in the personal data processing activities, we shall take a closer look at its key implications for this particular subject.

Parties involved in processing Personal Data

Under the PDPD, there are 05 groups[1] of parties involved in the processing of personal data, accordingly:

Data Subject: Refers to an individual to whom the data relates;

Personal Data Controller: Refers to an organization or individual that decides purposes and means of processing personal data (“Data Controller”);

Personal Data Processor: Refers to an organization or individual that processes data on behalf of the Personal Data Controller via a contract or agreement (“Data Processor”);

Personal Data Controller-Processor: Refers to an organization or individual that performs both the Controller and Processor roles, jointly decides purposes and directly processes personal data; and,

Third Party: Refers to an organization or individual other than the aforementioned parties, and is permitted to process personal data.

In general, exclusive of the Data Subject, the PDPD imposes equal applicable organizational and technical measures to each of the latter four regulated parties to ensure the security and integrity of the personal data, as such parties can be held liable for any damages resulted from the processing. Notwithstanding, the responsibilities of the Data Controller and the Data Processor (and correspondingly, the Data Controller-Processor) are governed under a more stringent and specified manner.

In regards to the abovementioned measures, the Data Controller is obligated to have those reviewed and updated periodically. It is also required to record a log of processing activities, and only working with Data Processor that has implemented appropriate security measures[2]. On the other hand, Data Processor must have a contract with the Data Controller before receiving and processing any personal data. After completing the processing, Data Processor shall have to delete and return all data to the Data Controller[3]. It is crucial for businesses to understand and identify their roles, to fully comply with the regulations.

Principles of processing Personal Data

The PDPD outlines eight principles[4] for businesses to conduct activities in compliance. These principles are in much compatibility with the principles listed under the EU’s General Data Protection Regulation No. 2016/679 (“GDPR”), namely:

Lawfulness: The personal data shall be processed as prescribed by law;

Transparency: The Data Subject must be informed of the processing activities;

Purpose Limitation: The personal data shall be processed only for the purposes registered and declared by the processing-involved parties;

Data Minimization: The collected personal data shall be appropriate for the scope and purposes of processing;

Accuracy: The personal data shall be updated and supplemented for the processing purposes;

Integrity and Confidentiality: The personal data shall be protected and secured during the processing against any violations or damages;

Storage Limitation: The personal data shall be stored only for a period appropriate with the processing purposes; and

Accountability: The Data Controller and Data Controller-Processor must comply with the above principles and demonstrate their compliance.

Regarding the “Data Minimization” principle, the PDPD explicitly introduces the additional principle on prohibition of sale or purchase of personal data under any manner.

Consent of the Data Subject

Consent of the Data Subject is the most crucial basis and will be applied in all activities of data processing. The consent by a Data Subject will be valid only when[5]:

The consent is voluntarily given, without being forced or deceived; and,

Be made based on the Data Subject’s full understanding of: the type of personal data to be processed; the purpose of the personal data processing; the entities permitted to process personal data; and the Data Subject’s rights and obligations.

The consent must be expressed clearly and specifically in written instrument, by voice, by ticking the consent box, by text message, by selecting consent technical settings, or via other forms applicable[6]. The PDPD further stipulates that such forms of consent must be able to be printed, copied in writing, either in electronic or verifiable format[7].

Furthermore, consent for data use must be bound to a single purpose[8]. In case of processing the data for multiple purposes, the Data Controller and Data Processor must list out all purposes so that the Data Subject can acknowledge and decide whether to give consent to the stated purposes. Additionally, the Data Subject may provide a partial or conditional consent[9].

It must be noted that the Data Subject's silence or lack of response does not constitute a consent[10].

Processing Personal Data in special cases

Processing Personal Data without consent

Regardless of Section III above, the PDPD also specifies several special cases in which the processing of personal data without consent is permissible, in order to ensure the public interests or to serve the activities of state agencies. Such circumstances are prescribed under Article 17 of the PDPD, when serving the purposes of protecting the life and health of the Data Subject or others; or processing by competent regulatory authorities in the event of a state of emergency regarding national defense, security, social order and safety.

In addition, personal data acquired from audio and video recording activities in public places by the competent agencies and organizations can also be processed[11]. However, these instruments shall only be made for the protection of the national security, social order and safety, legitimate rights and interests in accordance with the law. For clarification, if a video or audio is recorded for other purposes, then the Data Subject’s consent is still required before processing. The Data Subject is informed of the recording of such audios and videos.

Processing Personal Data of special Data Subjects

In regards to the processing of personal data of persons declared missing or dead, a consent of that person’s family members (e.g., his/her spouse, adult children or parents) must be obtained[12]. In the case such person has no family member, it is considered as no consent is given and therefore, the processing could not be carried out.

In regards to the processing of children’s personal data, for children of 7 years old or older, any parties involved in data processing must obtain the consent of both the child and their parents or guardian[13]; while for children under 7 years old, it seems that only the consent of their parents or guardian is required. Therefore, it is critical for any processing-involved party to confirm the age of the children prior to conducting any processing activities.

Processing Personal Data in marketing and advertising services

Entities that provide marketing and advertising services may only use customers’ personal data collected through their business activities to provide marketing and advertising services with the consent of the Data Subject on the basis that the Data Subject be notified of content, method, form and frequency of marketing and advertising activities provided to them[14].

Conclusion

Under the PDPD, the Government has addressed many of the current challenges facing personal data protection in Vietnam. However, the absence of a specific procedure, for example to handle violation complaints remains a concern, which leads to the anticipation that the Government will issue a decree on the enforcement of the regulations. In the interim, businesses are encouraged to cautiously approach and act in compliance with the PDPD.

ADK VIETNAM LAWYERS

[1] Article 2.6, 2.9, 2.10, 2.11, 2.12 of the Decree No. 13/2023/ND-CP on Personal Data Protection (PDPD).

[2] Article 38 of the PDPD.

[3] Article 39 of the PDPD.

[4] Article 3 of the PDPD.

[5] Article 11.2 of the PDPD.

[6] Article 11.3 of the PDPD.

[7] Article 11.5 of the PDPD.

[8] Article 11.4 of the PDPD.

[9] Article 11.7 of the PDPD.

[10] Article 11.6 of the PDPD.

[11] Article 18 of the PDPD.