In what cases is personal data allowed to be deleted and not allowed to be deleted? What are the prohibited acts in the protection of personal data in Vietnam?
In what cases is personal data deleted?
Pursuant to Clause 1, Article 16 of Decree No. 13/2023/ND-CP:
Storage, deletion and destruction of personal data in Vietnam
1. The data subject has the right to request the Personal Data Controller and the Personal Data Controller-cum-Processor to delete his/her personal data in the following cases:
a) The data subject no longer finds the data necessary for the purposes for which it was collected under his/her consent and he/she accepts any damage that may be caused by the deletion;
b) The data subject withdraws consent;
c) The data subject objects to the processing of his/her personal data and the Personal Data Controller and the Personal Data Controller-cum-Processor do not have sound reasons for continuation in the processing;
d) The personal data is processed for purposes other than those that the data subject gives the consent or the processing of personal data is a violation against regulations of law;
dd) The personal data shall be deleted as prescribed by law.
Thus, personal data is deleted in the following cases:
- The data subject no longer finds the data necessary for the purposes for which it was collected under his/her consent and he/she accepts any damage that may be caused by the deletion;
- The data subject withdraws consent;
- The data subject objects to the processing of his/her personal data and the Personal Data Controller and the Personal Data Controller-cum-Processor do not have sound reasons for continuation in the processing;
- The personal data is processed for purposes other than those that the data subject gives the consent or the processing of personal data is a violation against regulations of law;
- The personal data shall be deleted as prescribed by law.
In what cases is personal data allowed to be deleted and not allowed to be deleted? What are the prohibited acts in the protection of personal data in Vietnam?
What are the 06 cases where personal data cannot be deleted upon request?
Pursuant to Clause 2, Article 16 of Decree No. 13/2023/ND-CP stipulating as follows:
Storage, deletion and destruction of personal data in Vietnam
…
2. The personal data shall not be deleted at the request of the data subject in the following cases:
a) The deletion of personal data is prohibited by law;
b) The personal data is processed by the competent state agency with a view to serving operations by such agency as prescribed by law.
c) The personal data has been disclosed as prescribed by law.
d) The personal data is processed with a view to serving law, scientific research and statistics as prescribed by law;
dd) The personal data shall not be deleted in the event of a state of emergency on national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a risk of threatening security and national defense but not to the extent of declaring a state of emergency; to prevent and combat riots and terrorism, to prevent and combat crimes and law violations according to regulations of law;
e) It is required to respond to emergent cases that threaten the life and health or the safety of the data subject or other persons.
Thus, the personal data shall not be deleted at the request of the data subject in the following cases:
(1) The deletion of personal data is prohibited by law;
(2) The personal data is processed by the competent state agency with a view to serving operations by such agency as prescribed by law.
(3) The personal data has been disclosed as prescribed by law.
(4) The personal data is processed with a view to serving law, scientific research and statistics as prescribed by law;
(5) The personal data shall not be deleted in the event of a state of emergency on national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a risk of threatening security and national defense but not to the extent of declaring a state of emergency; to prevent and combat riots and terrorism, to prevent and combat crimes and law violations according to regulations of law;
(6) It is required to respond to emergent cases that threaten the life and health or the safety of the data subject or other persons.
What are the prohibited acts in the protection of personal data in Vietnam?
According to the provisions of Article 8 of Decree No. 13/2023/ND-CP as follows:
Prohibited acts
1. Processing personal data in contravention of regulations of law on protection of personal data.
2. Processing personal data in order to provide information and data against regulations of the Socialist Republic of Vietnam
3. Processing personal data in order to provide information and data that affect national security, social order and safety, and legitimate rights and interests of other organizations and individuals.
4. Obstructing protection of personal data by competent authorities.
5. Taking advantage of protection of personal data to commit violations of law.
Thus, the prohibited acts in the protection of personal data in Vietnam include:
- Processing person data in contravention of regulations of law on protection of personal data.
- Processing personal data in order to provide information and data against regulations of the Socialist Republic of Vietnam
- Processing personal data in order to provide information and data that affect national security, social order and safety, and legitimate rights and interests of other organizations and individuals.
- Obstructing protection of personal data by competent authorities.
- Taking advantage of protection of personal data to commit volitions of law.
Decree No. 13/2023/ND-CP takes effect from July 1, 2023.
LawNet
