Government proposes ban on buying and selling personal data

(NLDO) - Faced with the widespread buying and selling of personal data, which poses a risk of profiteering and fraud, the Government has proposed banning the buying and selling of personal data.

On the afternoon of May 5, continuing the 9th Session, authorized by the Prime Minister, Deputy Prime Minister Le Thanh Long presented to the National Assembly the draft Law on Personal Data Protection.

Deputy Prime Minister Le Thanh Long presented the draft Law on Personal Data Protection to the National Assembly. Photo: Pham Thang

The Government 's submission stated that the 2013 Constitution inherited the provisions of previous Constitutions, affirming that the right to privacy of individuals is inviolable, and at the same time expanding the scope of the right to privacy, not only the right to inviolability of the body, home, and correspondence, but also including the right to protect personal secrets, including information about private life, personal secrets, and family secrets (Article 21).

However, through the practical implementation of personal data protection work according to Decree No. 13/2023/ND-CP, it shows that there are currently many organizations and enterprises collecting excess personal data compared to their industries, products, and business services, lacking a legal basis when collecting personal data, and unable to identify data processing flows.

Many activities of collecting and processing personal data do not have the consent of the data subject, and it is not possible to obtain consent for the personal data collected.

This shows that citizens' basic rights to personal data are not guaranteed, citizens do not know how to protect themselves, do not know how to file lawsuits, protest, or request compensation for damages when there are acts that violate the law and infringe upon their legitimate rights and interests.

Although Decree No. 13/2023/ND-CP stipulates that personal data cannot be bought or sold in any form, in reality, the buying and selling of personal data is currently widespread and public, and many acts have not been handled due to lack of legal regulations.

According to the report on information security risks in Vietnam in 2024, data encryption attacks combined with personal information theft amounted to 10 terabytes, causing total estimated damage of up to 11 million USD; 14.5 million accounts in Vietnam were leaked, accounting for 12% globally.

The Ministry of Public Security discovered, fought, and handled a number of large-scale personal data appropriation and trading lines in Vietnam (up to thousands of GB of data, including many internal and sensitive personal data). In 2023, discovered, investigated, and verified 16 cases of disclosure and sale of information, state secrets, and internal data on platforms and forums (BreachedForums, Telegram, Facebook); provided services to look up personal data of Vietnamese citizens (real-time data).

The above situation poses an urgent need to perfect the law on personal data protection to be unified and synchronous in the legal system, to raise awareness and consciousness about the current processing of personal data in parallel with the work of protecting personal data and having clear regulations on ensuring the rights of data subjects.

The Law on Personal Data Protection will help raise awareness of all subjects (individuals, agencies, organizations, enterprises) about the rights, responsibilities, and obligations to protect personal data. The sanctions applied after the promulgation of the Law are also deterrent, raising awareness of the rule of law, respect and compliance with regulations in personal data processing activities.

Therefore, Article 7 of the draft law stipulates 6 groups of prohibited acts, including: Processing personal data illegally, causing negative impacts on the State, national defense, security, rights and legitimate interests of organizations and individuals; obstructing data protection activities of competent authorities; taking advantage of data protection to violate the law; collecting, processing, transferring data illegally; buying and selling personal data; intentionally appropriating, disclosing or losing personal data.

The Government proposes that the National Assembly consider, comment on and approve this Law project at the 9th Session.

Source: https://nld.com.vn/chinh-phu-de-xuat-cam-mua-ban-du-lieu-ca-nhan-196250505155230324.htm