Vietnam: In the future, in what cases will personal data be processed without the subject's consent?
Special personal data processing
According to Chapter II of the Draft Decree on personal data protection (Draft 2), the Government of Vietnam has stipulated that there are 5 cases of personal data processing, including:
Processing of personal data after the death of the data subject
In Article 9 of the Draft Decree on protection of personal data of Vietnam (Draft 2), the processing of personal data after the subject's death is regulated as follows:
- After the death of the data subject, the processing of personal data related to the data subject is done only in accordance with the will or the written consent of the person in the order of heirs in accordance with the law. if it is different from the agreement already agreed by the data subject with the personal data processor and ensuring the provisions of Clause 6, Article 8 of this Decree.
- The provisions of Clause 1 of this Article do not apply if the processed personal data contains only name, gender, date of birth, date of death, disappearance and cause of death.
Processing of personal data without the consent of the data subject
In Article 10 of the Draft Decree on personal data protection of Vietnam (Draft 2), the processing of personal data in the absence of the consent of the data subject is specified as follows:
- Personal data is processed without the consent of the data subject in the following cases:
+ According to the provisions of law;
+ For the interests, national security, social order and safety;
+ In cases where it is required by law to be urgent, life threatening or seriously affecting the health of data subjects or public health;
+ To serve the investigation and handling of law violations;
+ Implement specific regulations stating that personal data is allowed to be processed without the consent of the data subject in international agreements or treaties to which Vietnam is a signatory;
+ Process personal data in service of scientific research or statistics according to the provisions of Article 12 of this Decree.
- To share personal data or grant access to personal data to a third party without the consent of the data subject in the following cases:
+ According to the provisions of law or international agreements or treaties to which Vietnam is a contracting party;
+ Protect the life, health or freedom of data subjects;
+ Does not affect the rights and interests of the data subject and it is impossible to obtain the consent of the data subject;
+ Process personal data in service of scientific research or statistics according to the provisions of Article 12 of this Decree.
Thus, in the above cases, it is possible to process personal data without the consent of the data subject.
Processing personal data for scientific research or statistics
In Article 12 of the Draft Decree on personal data protection of Vietnam (Draft 2), the processing of personal data for scientific research or statistics is specified as follows:
- The processing of personal data for scientific research or statistics in encrypted form does not require the consent of the data subject.
- Before handing over personal data for data processing for scientific or statistical research, the data identifying a person must be de-identified and replaced with a code. Decoding and decoding capabilities are only permitted for scientific or statistical research. The processor of personal data designates in writing a specific person with access to information that allows for decryption.
- The results of processing personal data for scientific research or statistics cannot be aggregated into information of a specific data subject.
- The processing of personal data for scientific research or statistical work without the consent of the data subject should fully implement the following measures:
+ Have a commitment to protect personal data;
+ Take measures to protect personal data;
+ Have a physical device to protect personal data;
+ Having a specialized department assigned to protect personal data;
+ Registered to handle sensitive personal data with the Personal Data Protection Commission;
+ There is a written confirmation from the Personal Data Protection Committee that the conditions have been verified and the compliance with the requirements mentioned at Points a, b, c, d, dd of this Clause.
Automatic processing of personal data
In Article 13 of the Draft Decree on personal data protection of Vietnam (Draft 2), automatic personal data processing is regulated as follows:
- The automatic processing of personal data is carried out only during the participation or performance of the contract, provided that the data subject knows and agrees to the automatic data processing.
- The automatic processing of personal data must be notified to the data subject before implementation.
- The notification to the data subject must be made easy to understand and clear, including specific contents about the process and conditions for processing personal data.
Processing of personal data of children
In Article 14 of the Draft Decree on personal data protection of Vietnam (Draft 2), the processing of children's personal data is regulated as follows:
- Principles of handling children's personal data
+ Processing of children's personal data is always done in accordance with the principle of protecting the rights and in the best interests of children;
+ Before processing any personal data of children, the Data Processor must verify the age of the children and obtain the consent of the parent or guardian as required.
- When processing personal data of children, the Personal Data Processor has the right to:
+ Correct inaccurate or misleading personal data;
+ Update personal data incomplete;
+ Update and process outdated personal data;
+ Delete personal data that is no longer needed for the purpose of its processing.
- When performing the activities mentioned in Clause 2 of this Article, the Data Processor must take the necessary steps to notify all subjects related to children's personal data.
- The processing of children's personal data must cease in the following cases:
+ Has fulfilled the purpose of collection or is no longer necessary for that purpose and is required by the data subject and its guardian as required by law;
+ Parents or guardians withdraw their consent to the processing of children's personal data;
+ At the request of competent authorities when there are sufficient grounds to prove that the processing of personal data affects children's legitimate rights and interests.
Download the Draft Decree on personal data protection of Vietnam here.
LawNet
