Is it eligible for personal data disclosure under the Draft Decree on Personal data protection? How is personal data divided?
Personal data disclosure
Currently, the law does not have any provisions on personal data. However, in 2021, the Government of Vietnam issued a Draft Decree regulating personal data protection to adjust personal data, personal data processing, personal data protection measures, Personal Data Protection Commission, handling of personal data breaches, responsibilities for protecting personal data of relevant agencies, organizations and individuals. Here is some information about your matter:
What is personal data?
According to the definition in Clause 1 Article 2 of the Draft Decree on personal data protection of Vietnam (Draft 2), personal data is data about an individual or related to the identification or being able to identify a specific individual.
How many types of personal data are there?
According to Clauses 2 and 3, Article 2 of the Draft Decree on personal data protection of Vietnam (Draft 2), personal data is divided into two types: Basic personal data and sensitive personal data.
Whereby:
Basic personal data, including:
- Full name, middle name and birth name, alias (if any);
- Date of birth; day, month, year dead or missing;
- Blood group, gender;
- Place of birth, place of birth registration, place of permanent residence, current residence, hometown, contact address, email address;
- Academic level;
- Ethnic;
- Nationality;
- Phone number;
- Identity card number, passport number, citizen identification number, driving license number, license plate number, personal tax identification number, social insurance number;
- Marital status;
- Data that reflects activity or history of activity in cyberspace.
Sensitive personal data, including:
- Personal data on political and religious views;
- Personal health data is information regarding the physical or mental health status of the data subject collected, identified during the registration or provision of medical services;
- Genetic personal data is information relating to inherited or acquired genetic characteristics of an individual;
- Biometric personal data is information about the physical attributes and biological characteristics of each individual;
- Personal data on gender status is information about a person who is identified as being male, female, a mix of female and male, not all female or all male, neither female nor male or the status of the sex-conscious data subject is inconsistent with the sex identified at birth;
- Personal data about life, sexual orientation;
- Personal data about criminals, criminal acts collected and stored by law enforcement agencies;
- Financial personal data is information used to identify accounts, cards, payment instruments provided by financial institutions to data subjects or information about the relationship between financial institutions and financial institutions. , principal data with data subject, including profile, financial status, credit history, income level;
- Personal location data is information about an individual's physical location in the past and present;
- Personal data about social relationships;
- Other personal data required by law is specific and requires necessary security measures.
Is it eligible for personal data disclosure?
According to Article 6 of the Draft Decree on personal data protection of Vietnam (Draft 2), the disclosure of personal data is regulated as follows:
- The personal data processor, the third party may disclose personal data without the consent of the data subject in the following cases:
+ According to the provisions of law;
+ Disclosure of information is necessary for the interests, national security, social order and safety;
+ On the media for the purposes of national defense and security, social order and safety, social ethics, and community health;
+ On the media according to the provisions of the Press Law, do not cause economic, honor, spiritual or material damage to the data subject;
+ In cases where it is required by law to be urgent, life threatening or seriously affecting the health of data subjects or public health.
- The personal data processor, the third party immediately terminates the disclosure of personal data at the request of the data subject, except for the case specified in Clause 1 of this Article.
- Do not disclose other people's personal data in the following cases:
+ The data in question is sensitive personal data;
+ Damage to the legitimate interests of the data subject.
- The recording, video recording and processing of data obtained through audio recording and video recording activities in public places by competent state agencies in the case prescribed by law is considered consent of the data subject.
+ The collection agency is obligated to notify data subjects in such a way that data subjects understand that they are being recorded, videotaped and processed data so that data subjects know how to prevent them if they so desire;
+ The notification obligation does not apply in cases where it is for the purposes of national defense, national security, social order and safety, social ethics, or the health of the community.
As a matter of fact, there are 5 cases where a personal data processor, a third party may disclose personal data without the consent of the data subject.
Download the Draft Decree on personal data protection here.
LawNet
