Vietnam: How does the withdrawal of consent by a personal data subject affect previous data processing?
- How does the withdrawal of consent by a personal data subject affect previous data processing?
- What actions does the Personal Data Controller take when obtaining request for consent withdrawal from the data subject?
- Can a data subject request the Personal Data Controller to delete his or her personal data when withdrawing consent?
How does the withdrawal of consent by a personal data subject affect previous data processing?
According to Clause 1, Article 12 of Decree No. 13/2023/ND-CP, the consequences of consent withdrawal of data subjects in personal data protection are as follows:
Consent withdrawal
1. The withdrawal of consent shall not affect the lawfulness of the processing to which consent was given before it is withdrawn.
2. The withdrawal of consent shall be expressed in a format that can be printed and reproduced in writing, including in electronic or verifiable format.
3. When obtaining request for consent withdrawal from the data subject, the Personal Data Controller and the Personal Data Controller-cum-Processor shall notify the data subject of potential consequences and damage if she/he withdraws his/her consent.
4. After complying with regulations in Clause 2 of this Article, the Personal Data Controller, the Personal Data Processor, the Personal Data Controller-cum-Processor and the Third Party shall stop and request relevant organizations and individuals to stop processing the personal data of the data subject who has withdrawn his/her consent.
According to the above regulations, the withdrawal of consent shall not affect the lawfulness of the processing to which consent was given before it is withdrawn.
Vietnam: How does the withdrawal of consent by a personal data subject affect previous data processing?
What actions does the Personal Data Controller take when obtaining request for consent withdrawal from the data subject?
Clauses 3 and 4, Article 12 of Decree No. 13/2023/ND-CP stipulating the activities of the Personal Data Controller when obtaining request for consent withdrawal from the data subject as follows:
Consent withdrawal
1. The withdrawal of consent shall not affect the lawfulness of the processing to which consent was given before it is withdrawn.
2. The withdrawal of consent shall be expressed in a format that can be printed and reproduced in writing, including in electronic or verifiable format.
3. When obtaining request for consent withdrawal from the data subject, the Personal Data Controller and the Personal Data Controller-cum-Processor shall notify the data subject of potential consequences and damage if she/he withdraws his/her consent.
4. After complying with regulations in Clause 2 of this Article, the Personal Data Controller, the Personal Data Processor, the Personal Data Controller-cum-Processor and the Third Party shall stop and request relevant organizations and individuals to stop processing the personal data of the data subject who has withdrawn his/her consent.
According to the above provisions, when obtaining request for consent withdrawal from the data subject, the Personal Data Controller shall:
+ Notify the data subject of potential consequences and damage if she/he withdraws his/her consent.
+ After transferring the request to withdraw consent in an appropriate form, the Personal Data Controller shall stop and request relevant organizations and individuals to stop processing the personal data of the data subject who has withdrawn his/her consent.
Can a data subject request the Personal Data Controller to delete his or her personal data when withdrawing consent?
Point b, Clause 1 and 2, Article 16 of Decree No. 13/2023/ND-CP stipulates the cases in which a data subject can request the Personal Data Controller to delete his/her personal data in Vietnam as follows:
Storage, deletion and destruction of personal data in Vietnam
1. The data subject has the right to request the Personal Data Controller and the Personal Data Controller-cum-Processor to delete his/her personal data in the following cases:
a) The data subject no longer finds the data necessary for the purposes for which it was collected under his/her consent and he/she accepts any damage that may be caused by the deletion;
b) The data subject withdraws consent;
c) The data subject objects to the processing of his/her personal data and the Personal Data Controller and the Personal Data Controller-cum-Processor do not have sound reasons for continuation in the processing;
d) The personal data is processed for purposes other than those that the data subject gives the consent or the processing of personal data is a violation against regulations of law;
dd) The personal data shall be deleted as prescribed by law.
2. The personal data shall not be deleted at the request of the data subject in the following cases:
a) The deletion of personal data is prohibited by law;
b) The personal data is processed by the competent state agency with a view to serving operations by such agency as prescribed by law.
c) The personal data has been disclosed as prescribed by law.
d) The personal data is processed with a view to serving law, scientific research and statistics as prescribed by law;
dd) The personal data shall not be deleted in the event of a state of emergency on national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a risk of threatening security and national defense but not to the extent of declaring a state of emergency; to prevent and combat riots and terrorism, to prevent and combat crimes and law violations according to regulations of law;
e) It is required to respond to emergent cases that threaten the life and health or the safety of the data subject or other persons.
...
According to the above provisions, the data subject is entitled to request the Personal Data Controller to delete his/her personal data when withdrawing consent if it does not fall into the following cases:
- The deletion of personal data is prohibited by law;
- The personal data is processed by the competent state agency with a view to serving operations by such agency as prescribed by law.
- The personal data has been disclosed as prescribed by law.
- The personal data is processed with a view to serving law, scientific research and statistics as prescribed by law;
- The personal data shall not be deleted in the event of a state of emergency on national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a risk of threatening security and national defense but not to the extent of declaring a state of emergency; to prevent and combat riots and terrorism, to prevent and combat crimes and law violations according to regulations of law;
- It is required to respond to emergent cases that threaten the life and health or the safety of the data subject or other persons.
Decree No. 13/2023/ND-CP takes effect from July 1, 2023.
LawNet
