Everyone should protect their personal data online. (Illustrative image)

Dr. Hoa said the fourth industrial revolution and the digital economy have changed the perception of assets. Many types of "virtual assets" can be converted into money and real assets. It is necessary to change the approach, from considering the right to protect personal data as a purely moral right, to a new thinking, to exploit the economic value of personal data. Accordingly, the right to personal data will be the right to a new type of asset - non-traditional property.

“Data becomes a valuable resource in the digital era, even being compared to a special oil source in the digital economy. However, there are some questions: Who owns the personal data, who will have the right to sell or buy that information? To what extent is the collected personal information disclosed? These are the big questions that the Vietnamese legal system has not yet answered,” said Dr. Hoa.

Vietnam already has a legal framework at a basic level on personal data protection. Specifically, the 2013 Constitution along with the legal system in general have created the necessary foundation to protect the right to personal data.

Administrative violations in the field of personal data protection are regulated in many legal documents. One of them is Decree 15/2020/ND-CP, which stipulates administrative fines for various types of acts of infringing upon privacy and protecting personal information from 2 million to 70 million VND.

Those who violate the privacy rights of personal information, depending on the nature and seriousness of the violation, may be handled according to the provisions of Article 288 of the Penal Code 2015.

“The crime of illegally giving or using information on computer networks and telecommunications networks” has the highest penalty of seven years in prison and a fine of between VND 20 million and VND 200 million; In case of aggravating circumstances, the maximum fine is VND 1 billion.

“In addition, the Penal Code 2015 clearly stipulates the crime of ‘infringing upon the secret or safety of mail, telephone, telegraph or other forms of exchanging private information of others’ in Article 159.

“However, in fact, both of these crimes have not been specifically and directly related to the violations of the law related to personal data,” said Dr. Hoa.

The regulations on sanctions to protect personal data are still "quite light", not ensuring deterrence, Dr Hoa said.

Specifically, the largest administrative fine under Decree 15/2020/ND-CP is VND 70 million; the largest criminal penalty is VND 200 million. Even in the case of infringing upon personal secrets leading to the victim's suicide, the violator will only be fined up to VND 1 billion or imprisoned from two to seven years (Article 288, Penal Code 2015).

“Compared with the general data protection regulations developed by the European Commission (GDPR), which imposes a fine of up to 20 million euros, equivalent to 500 billion VND, it can be seen that the fine in Vietnam's law is relatively mild, while the consequences from an invasion of privacy can be very serious, damaging the honor, dignity, safety and even the lives of not one but possibly many victims,” Dr. Hoa said.

It is therefore necessary to consider additional provisions on criminal liability for violations of the right to be protected with personal data in the Penal Code. Some violations of the law on protection of personal data can be criminalized, such as: illegal collection, use, exploitation, and transfer of personal data. It is necessary to increase the effectiveness of the personal data protection mechanism through civil action.

In particular, there are legal gaps on the protection of personal data that need attention. For example, it is necessary to introduce a unified concept of “personal data” and “personal data protection”. Some legal documents related to personal data protection have conflicted, overlapping or inconsistent provisions. The enactment of a Personal Data Protection Law is necessary, because the law will cover more principled issues.

Vietnam already has a basic legal framework for personal data protection, but each person needs to be protected in the digital environment, and ensure the safety of online accounts such as bank accounts, e-wallets, email, Facebook.

“It is time for state management agencies, organizations, businesses and especially people to be aware of the importance of personal data protection when using services in the cyberspace,” Dr. Hoa said.

Ka Mi

VN to crack down on trading of personal data online

In recent years, trading of personal information has been rampant in Vietnam.

Heavy sanctions needed to prevent illegal trade of personal data

The personal data of many Vietnamese users is being illegally appropriated and even traded in the cyberspace.

The Ministry of Public Security completes draft decree on cybersecurity fines

The act of buying and selling personal data of over 10,000 people should result in a fine of VND80-100 million (nearly US$3,500), according to a proposal by the Ministry of Public Security.