You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

February 8, 2023

Vietnam’s Personal Data Protection Decree Takes Important Step Toward Issuance

Subscribe to Updates

Government Approves Legislative Dossier

On February 7, 2023, the Vietnamese government issued Resolution No. 13/NQ-CP (“Resolution 13”) to approve the latest version of the draft Personal Data Protection Decree (“Draft PDPD”)—a draft which has not yet been made public.

Similar to Resolution No. 27/NQ-CP issued in March 2022 approving the previous version of the Draft PDPD (“Resolution 27”), Resolution 13 stipulates the different cases where data subjects’ consent is exempted for processing personal data. Most of these lawful bases are similar to those under Resolution 27—except for the fourth case, which is brand new—with some changes for better clarity.

According to Article 1 of Resolution 13, personal data can be processed without consent in the following five cases:

(1) The processing is to protect the life and health of the data subject or others in an emergency situation. Data Controllers, Data Processors, Parties Controlling and Processing Personal Data, and Third Parties are responsible for proving this case;

Remarks: Vietnamese law, including the prior published version of the Draft PDPD, has never used the terms “data controller”, “data processor,” and “parties controlling and processing personal data.” The inclusion of these terms suggests that the latest version of the Draft PDPD has adopted the GDPR-like concepts of “data controller” and “data processor.” However, until the latest version of the Draft PDPD can be assessed, it is uncertain how these concepts are defined and whether they are fully in line with GDPR definitions.

(2) The disclosure of personal data is in accordance with the law;

(3) The processing of data is performed by competent state agencies in the event of a state of emergency related to national defense, national security, social order and safety, major disaster, or dangerous epidemic; when there is a threat to security and national defense but not to the extent that a state of emergency must be declared; or when the processing is to prevent and combat riots and terrorism, crime, and law violations in accordance with law;

Remarks: This expands the list of situations where the data subject’s consent is exempted compared to a similar criterion in Resolution 27, which simply mentioned “national defense and security requirements.”

(4) The processing is to fulfill the contractual obligations of the data subject with relevant agencies, organizations, and individuals as prescribed by law;

Remarks: Under current legislation, consent is exempted when personal data is used for signing, modifying, or performing a contract to use information, products, and services in the network environment between the data subject and an IT/e-commerce trader/service provider. This basis for consent exemption is stipulated under the Information Technology Law and Decree 52 on E-Commerce.

This new basis under Resolution 13 has been broadened to include the processing of personal data for performing any types of contracts involving the data subject as a party. These contracts may include employment contracts and contracts for purchase of goods/services outside the IT/e-commerce context.

The Draft PDPD seems to have adopted the lawful basis under Article 6.1(b) of GDPR: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.” Interestingly, the basis of processing for “legitimate interests of the controller or third party” under the GDPR does not appear in Resolution 13. As the Vietnamese legislator has always refused to adopt this basis into the Vietnamese data protection regime, it is unlikely to be covered by the Draft PDPD.

The wording of this newly added criterion is rather broad and subjective. It is unclear what could be considered necessary to “fulfill the contractual obligations,” and whether this criterion could be interpreted broadly enough to cover “legitimate interests” of the employer/service provider when implementing contractual obligations with data subjects.

If there is no further guidance on this criterion, we believe that it would be open to the authority’s discretion in interpretation and the arguments of the parties on a case-by-case basis.

(5) The processing is to serve the activities of state agencies prescribed by sector-specific laws.

Remarks: Resolution 27 included the criterion “the processing is for competent state agencies’ investigation and handling of law violations,” which has been removed from Resolution 13. It could be argued, however, that this criterion under Resolution 13 is sufficiently broad to cover the same cases.

Review by the National Assembly

Following the issuance of Resolution 13, on February 8, 2023, the National Assembly’s Committee for Defense and Security held a plenary meeting to review and discuss the newly approved Draft PDPD. According to media reports recapping the discussion, most of the delegates attending the meeting believed that this version of the Draft PDPD had been prepared quite thoroughly, with due consideration of opinions contributed by other state agencies and the public during the consultancy phase. However, given the significance of the PDPD, which covers novel issues that have rarely been tested in practice, the Draft PDPD was still subject to extensive comments from the delegates in the meeting, and possible further review by the Committee for Defense and Security.

What’s Next for the Draft PDPD?

Resolution 13 approves the content of the government’s report on the Draft PDPD, the report on collecting and considering opinions of the Standing Committee of the National Assembly, and the content of the latest version of the Draft PDPD; and assigns the Minister of Public Security, on behalf of the government, to report on and consult with the Standing Committee on the Draft PDPD. This means the resolution works as direction and approval of principles for key issues so that the Ministry of Public Security can complete the Draft PDPD for the Standing Committee’s approval before its eventual promulgation.

According to Article 2 of Resolution 13, as the next step, the Minister of Public Security will have to consult the Standing Committee of the National Assembly on the new version of the Draft PDPD. No specific timeline for promulgation has been announced. Following the review session by the Committee for Defense and Security, the Ministry of Public Security will need to consider the opinions of the delegates in the session and update the Draft PDPD accordingly, before submitting it to the Standing Committee.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

June 8, 2023
At a conference organized by Vietnam’s Ministry of Public Security (MPS) on June 7, 2023, government officials provided more guidance on the recently issued Personal Data Protection Decree (PDPD), which is set to take effect on July 1, 2023. Key takeaways included the following: A national portal on personal data protection for online submission of notifications and registrations will be launched before July 1, 2023. The MPS also plans to issue templates for data processing impact assessments (DPIAs) and transfer impact assessments (TIAs) in the near future. The PDPD requires data controllers, data processors, and data controller-processors to prepare a DPIA at the start of personal data processing. The MPS clarified that the DPIA is expected to be prepared and submitted once. Only changes to its content would require submission of an updated DPIA. Both DPIAs and TIAs (which are for cross-border data transfers) must be prepared in Vietnamese. Since the sale and purchase of personal data is strictly prohibited unless explicitly permitted by law, the MPS has handled approximately 14 cases involving unlawful trading of personal data, including sensitive data. Under the PDPD, sensitive data has a broader definition than under the GDPR (the European Union’s General Data Protection Regulation), and also includes location data, creditworthiness, and personal financial data. Consent is not a legal basis for the trading of personal data, including sensitive data. The 72-hour timeline for responding to a data subject’s request does not mean 72 working or business hours. Rather, it means 72 actual consecutive hours. Any organization transferring the personal data of Vietnamese citizens outside of Vietnam must comply with the PDPD, regardless of the organization’s location. For organizations incorporated overseas that must comply with the PDPD, there is no requirement to appoint a local representative (unlike the GDPR)—but appointment of a data
Read More
June 2, 2023
In Southeast Asia, artificial intelligence (AI) products and services are being leveraged across industries such as finance, healthcare, retail, agriculture, and manufacturing. Governments across the region are recognizing the benefits of harnessing AI and the positive impact of AI technology on economic development. As the rise in AI deployment creates opportunities for economic growth in Southeast Asia, regulatory and digital governance efforts should focus on ethical, inclusivity, and cybersecurity concerns to help ensure that the widespread use of AI technology in the region is sustainable. Two jurisdictions in the region that have already made significant strides in developing initiatives surrounding AI are Singapore and Thailand. Singapore Due to its more advanced technological infrastructure, Singapore was one of the first countries in the region to address AI-related issues. Singapore has been aligning its data protection policies and regulations with the changing digital landscape since 2012—the year Singapore passed its Personal Data Protection Act. In 2019, Singapore unveiled its National AI Strategy to increase the use of AI technologies and deploy “scalable, impactful AI solutions in key verticals by 2030.” The goal is to align talent, regulation, and business growth to ensure AI applications serve society. Singapore’s approach is to facilitate innovation while safeguarding consumer interests, as it strives to become one of the regional leaders in the field of AI. In terms of Singapore’s regulatory landscape, Singapore’s Personal Data Protection Commission (PDPC) oversees data and AI, including AI developers and AI-using companies, which consist of backroom operations, front-end usage companies, and distributors of equipment with AI features. The Singapore Academy of Law (SAL) oversees all laws applicable to AI systems and decides on issues that impact the AI industry. Singapore has joined various bilateral and regional trade arrangements to facilitate research, development, and collaboration in support of its growing digital
Read More
May 24, 2023
The draft Royal Decree on Artificial Intelligence System Service Business, which was introduced by the Office of the National Digital Economy and Society Commission earlier for public comment in October last year, focuses on potential risks from artificial intelligence (AI) systems to public health, safety, and freedoms. The framework emphasizes the importance of risk assessment, reporting requirements, and the establishment of specific measures and criteria deemed necessary to minimize AI risks. AI Systems Defined by the Decree Under the draft royal decree, an AI system is defined as a machine-based system that can make predictions, recommendations, or decisions that affect real or virtual environments pursuant to the objectives set by humans. The definition clarifies that artificial intelligence systems are designed to operate at different levels of autonomy, including: machine learning AI; logic-based and knowledge-based AI; statistical AI; Bayesian estimation AI; and search and optimization AI. Risk-based Approach The draft AI royal decree takes a risk-based approach to regulation and specifically identifies prohibited or high-risk AI services that could cause harm or engage in unethical practices to ensure that AI systems do not pose major risks to public health, safety, or freedoms. The extent of regulatory scrutiny applied to an AI system corresponds to the level of risk presented by the AI system. For example, AI systems that pose unacceptable risks are generally prohibited, AI systems considered to be high-risk are subject to a conformity assessment, and AI systems considered to be limited-risk are subject to transparency requirements. Compliance with specified criteria and procedures to minimize potential risks of each AI service would be further outlined in subregulations. Prohibited AI Systems The draft AI royal decree prohibits AI systems that: employ subliminal techniques to covertly influence human behavior (below the threshold of conscious awareness); utilize social scoring; access sensitive personal
Read More
May 17, 2023
In Myanmar, a Union Tax Law is enacted each year to announce the rates of tax set out in the Income Tax Law 1974, the Commercial Tax Law 1990, and the Special Goods Tax Law 2016. The Union Tax Law 2023 (UTL 2023) came into force on April 1, 2023. It sets the rates of special goods tax (SGT), income tax (IT), and commercial tax (CT) for the period of April 1, 2023, to March 31, 2024, and exempts certain goods and services from these taxes. The key changes implemented by the UTL 2023 are summarized below. Special Goods Tax The UTL 2023 exempts battery electric vehicles (BEVs) from SGT. At the same time, it increases the rate of SGT on imported liquor. Previously, the rate of SGT ranged from 190 MMK per liter to 60 percent of the per-liter price of imported liquor in the previous fiscal year. The UTL 2023 raises the minimum rate to 209 MMK per liter while leaving the upper rate unchanged. Commercial Tax and Customs Tariffs BEVs imported into Myanmar were made exempt from CT under the Law Amending the Union Tax Law 2022. The UTL 2023 extends the exemption until the end of the 2023–24 fiscal year, along with two- and three-wheeler BEVs, BEV batteries, and related parts for specific use in BEVs. The CT exemption for battery charging services for BEVs, also introduced in 2022, has similarly been extended. Following enactment of the UTL 2023, the Ministry of Planning and Finance (MOPF) issued Notification No. 31/2023, reducing to zero the customs tariffs on imported BEVs, including those imported completely built up (CBU), completely knocked down (CKD), or semi-knocked down (SKD). The tariffs on spare parts and materials for BEVs have also been reduced to zero. In addition to exempting BEVs from
Read More