What is the consent of the data subject in the personal data processing in Vietnam? What acts are prohibited in the personal data processing in Vietnam?
- What is the consent of the data subject in the personal data processing in Vietnam?
- In what form must the withdrawal of consent in the personal data processing be expressed?
- In which cases is the consent of the data subject only valid?
- What acts are prohibited in the personal data processing in Vietnam?
What is the consent of the data subject in the personal data processing in Vietnam?
Pursuant to Clause 8, Article 2 of Decree No. 13/2023/ND-CP defining the consent of a data subject as follows:
“Consent” of a data subject refers to an act that the data subject permits the processing of his/her personal data in a clear, voluntary and affirmative manner.
In what form must the withdrawal of consent in the personal data processing be expressed?
Pursuant to Clause 1, Article 12 of Decree No. 13/2023/ND-CP stipulating as follows:
Consent withdrawal
1. The withdrawal of consent shall not affect the lawfulness of the processing to which consent was given before it is withdrawn.
2. The withdrawal of consent shall be expressed in a format that can be printed and reproduced in writing, including in electronic or verifiable format.
3. When obtaining request for consent withdrawal from the data subject, the Personal Data Controller and the Personal Data Controller-cum-Processor shall notify the data subject of potential consequences and damage if she/he withdraws his/her consent.
4. After complying with regulations in Clause 2 of this Article, the Personal Data Controller, the Personal Data Processor, the Personal Data Controller-cum-Processor and the Third Party shall stop and request relevant organizations and individuals to stop processing the personal data of the data subject who has withdrawn his/her consent.
Thus, according to the foregoing, the withdrawal of consent shall be expressed in a format that can be printed and reproduced in writing, including in electronic or verifiable format.
What is the consent of the data subject in the personal data processing in Vietnam? What acts are prohibited in the personal data processing in Vietnam? (Image from the Internet)
In which cases is the consent of the data subject only valid?
Pursuant to Clause 2, Article 11 of Decree No. 13/2023/ND-CP stipulating as follows:
Consent of a data subject
1. The consent of the data subject shall be granted to all activities in the processing of his/her personal data, unless otherwise provided for by law.
2. The consent is only valid when the data subject voluntarily consents and clearly knows the following contents:
a) Type of personal data;
b) Purposes;
c) Organization or individual permitted to process personal data;
d) Rights and obligations of the data subject.
3. The consent of the data subject shall be expressed in a clear and specific manner in writing, by voice, by ticking the consent box, by consent syntax via message, by selecting consent settings or by other forms.
4. The consent must be bound to the same purpose. In case of multiple purposes, the Personal Data Controller and the Personal Data Controller-cum-Processor shall list these purposes so that the data subject consents to one or several purposes that have been set out.
5. The consent of the data subject shall be expressed in a format that can be printed and reproduced in writing, including in electronic or verifiable format.
6. Silence or non-response is not considered as consent.
7. The data subject may give partial or conditional consent.
8. In case of the processing of sensitive personal data, the data subject shall receive notification of thereof.
9. The consent of the data subject is valid until the data subject has other decisions or the competent authority makes written request.
10. In case of a dispute, the Personal Data Controller and the Personal Data Controller-cum-Processor shall prove consent of the data subject.
11. Via the authorization in accordance with regulations of the Civil Code, an organization or individual may act on behalf of the data subject to carry out procedures related to the processing of his/her personal data with the Personal Data Controller and the Personal Data Controller-cum-Processor in case the data subject knows and consents as prescribed in Clause 3 of this Article, unless otherwise provided for by law.
Thus, according to the above provisions, the consent of the data subject in the personal data processing is only valid when the data subject voluntarily consents and clearly knows the following contents:
- Firstly, type of personal data;
- Secondly, purposes of the personal data processing;
- Thirdly, organization or individual permitted to process personal data;
- Fourthly, rights and obligations of the data subject.
What acts are prohibited in the personal data processing in Vietnam?
Pursuant to Article 8 of Decree No. 13/2023/ND-CP, prohibited acts in the personal data processing include:
- Firstly, processing person data in contravention of regulations of law on protection of personal data.
- Secondly, processing personal data in order to provide information and data against regulations of the Socialist Republic of Vietnam
- Thirdly, processing personal data in order to provide information and data that affect national security, social order and safety, and legitimate rights and interests of other organizations and individuals.
- Fourthly, obstructing protection of personal data by competent authorities.
- Finally, taking advantage of protection of personal data to commit volitions of law.
Decree No. 13/2023/ND-CP takes effect from July 1, 2023.
LawNet