Selling Personal Customer Information is Subject to Penalty!

You inadvertently go online and type a few keywords such as "customer data" or "VIP customers", "potential customers", and you may find numerous websites openly trading personal information such as: Lists of VIP customers in all industries at cheap and reliable prices, lists of potential customers 2016, super cheap customer lists, etc. These customer information data are also sorted and classified into lists by industry, income level, geographic location, etc., to facilitate exchange and trading. Moreover, these information are also stored on CDs, containing about 5,000 customer information and are sold at prices ranging from VND 85,000 to 800,000, sometimes a CD containing up to 10,000 customers is sold for 5 to 10 million VND. Most of these selling websites assert the quality and quantity of customer information, ensuring they are promptly updated and reliability reaches 80%, and also include promotions. Although this trading service is quite bustling on the internet, the owners of the lists only accept exchanges through accounts and gmail to avoid being "spied on".

The incident was only discovered when the person considered to be the customer received a consultation call from a company or service. These companies can know everything about the customer's personal information such as name, phone number, email address, ID number, even monthly income... This "interest" has made some customers feel annoyed and worried.

On March 18, 2016, the Ministry of Information and Communications issued Directive No. 11/CT-BTTTT on strengthening the protection of personal information of service users and preventing the illegal buying and selling of mobile SIM cards. Perhaps the disclosure of personal information partly originates from telecommunications services, the buying and selling of such mobile SIM cards. The Ministry requires telecom enterprises, affiliated units, and local information and communication departments to strengthen cooperation with the police sector to inspect, verify, and handle organizations and individuals with violations. Telecom enterprises must popularize and supervise SIM-selling agents, registration points to strictly comply with regulations on protecting the personal information of telecommunications service users; to not buy and sell pre-activated SIMs...

The act of selling customer information also infringes on the privacy of customers according to the provisions of Article 38 of the Civil Code 2005 as previously mentioned by Thu ky luat here.

Furthermore, Article 22 of the Information Technology Law 2006 stipulates:

"1. Individuals have the right to request organizations and individuals storing their personal information on the network environment to perform inspections, corrections, or deletions of that information;

2. Organizations and individuals are not allowed to provide others' personal information to a third party, except as otherwise provided by law or with the consent of that person;

3. Individuals have the right to claim compensation for damages caused by violations in the provision of personal information."

If anyone commits the above violations, they may be administratively handled under Article 65 of Decree 185/2013/ND-CP as follows:

“ Article 65. Violations regarding the protection of consumer information:

*1. A fine of VND 10,000,000 to 20,000,000 shall be imposed for one of the following violations:

a) Failure to clearly and openly notify consumers of the purpose before collecting and using consumer information as prescribed;b) Using consumer information for purposes not in accordance with what was notified to consumers without their consent as prescribed;c) Failing to ensure the safety, accuracy, and completeness of collected, used, or transferred consumer information as prescribed;d) Failing to self-adjust or take measures for consumers to update and adjust information when detecting inaccuracies as prescribed;e) Transferring consumer information to a third party without the consumer’s consent as prescribed, except as otherwise provided by law.*

2. The fine shall be doubled for information related to personal privacy of consumers.

3. Corrective measures: Mandatory destruction of violating materials containing consumer information.”

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE