How are sanctions for trading personal information in Vietnam?

Hello Mr. Lam, LawNet would like to answer your question as follows:

1. Provisions on personal information

According to Clause 15 Article 3 of the Law on Cyberinformation Security 2015 of Vietnam, personal information means information associated with the identification of a specific person.

Concurrently, according to Clause 5 Article 3 of the Decree No. 64/2007/NĐ-CP of Vietnam’s Government: Personal information means information which is adequate to accurately identify the identity of an individual, covering at least one of the following information: full name, date of birth, profession, title, contact address, e-mail address, telephone number, ID number and passport number. Personal secrets include medical records, tax payment dossiers, social insurance card's numbers, credit cards' numbers and other personal secrets.

Moreover, according to Clause 13 Article 3 of the Decree No. 52/2013/NĐ-CP of Vietnam’s Government: Personal information is information contributing to identifying a particular individual, including his/her name, age, home address, phone number, medical information, account number, information on personal payment transactions and other information that the individual wishes to keep confidential.

Thus, it can be seen that Vietnamese law stipulates that personal information is information that is directly related to the identification of a specific person. Decree No. 52/2013/NĐ-CP further stipulates “other information that the individual wishes to keep confidential”, but there are no criteria to determine the information that an individual wishes to keep secret.

2. Is it illegal to trade in personal information?

According to the Law on Cyberinformation Security 2015 of Vietnam, prohibited acts include:

- Blocking the transmission of information in cyberspace, or illegally intervening, accessing, harming, deleting, altering, copying or falsifying information in cyberspace.

- Illegally affecting or obstructing the normal operation of information systems or the users’ accessibility to information systems.

- Illegally attacking, or nullifying cyberinformation security protection measures of, information systems; attacking, seizing the right to control, or sabotaging, information systems.

- Spreading spams or malware or establishing fake and deceitful information systems.

- Illegally collecting, utilizing, spreading or trading in personal information of others; abusing weaknesses of information systems to collect or exploit personal information.

- Hacking cryptographic secrets and lawfully enciphered information of agencies, organizations or individuals; disclosing information on civil cryptographic products or information on clients that lawfully use civil cryptographic products; using or trading in civil cryptographic products of unclear origin.

According to this article, illegally collecting, utilizing, spreading or trading in personal information of others; abusing weaknesses of information systems to collect or exploit personal information are prohibited in accordance with law.

3. Sanctions for trading in personal information

According to Article 4 of the Decree No. 52/2013/NĐ-CP of Vietnam’s Government on prohibited acts in e-commerce, “stealing, using, revealing, transferring and selling information relating to business secrets of other traders, organizations or individuals or personal information of consumers in e-commerce without the consent of the parties concerned, unless otherwise provided by law” is one of the violations.

The acts of transferring or selling personal information of consumers in e-commerce without the consent of related parties shall be sanctioned in accordance with Point b Clause 5 Article 63 of the Decree No. 98/2020/NĐ-CP of Vietnam’s Government. According to this provision, a fine ranging from VND 30.000.000 to VND 40.000.000 shall be imposed for stealing, revealing, transferring or selling information concerning business secrets of other traders or entities or personal information of consumers in e-commerce without the consent of related parties.

Moreover, according to Clause 2 Article 101 of the Decree No. 15/2020/NĐ-CP of Vietnam’s Government on violations against regulations on responsibility of social networking service users, a fine ranging from VND 20,000,000 to VND 30,000,000 shall be imposed for disclosing information classified as state secret, an individual’s privacy or other secrets if not liable to criminal prosecution.

Illegally trading or exchanging private information of telecommunications service users shall be administratively sanctioned in accordance with Point a Clause 5 Article 102 of the Decree No. 15/2020/NĐ-CP, specifically as follows:

“5. A fine ranging from VND 50,000,000 to VND 70,000,000 shall be imposed for the commission of one of the following violations:

a) Illegally trading or exchanging private information of telecommunications service users;

b) Hiding name or electronic address or forging another person’s name or electronic address when sending emails/messages.”

Concurrently, individuals and organizations that commit the above acts shall have the license to establish social networking site shall be suspended for a fixed period of 22 - 24 months.

Regards!

Key word: personal information | trading personal information | sanctions | prosecution | Law on Cyberinformation Security 2015 | internet | internet banking |

Please Login to be able to download