Proposal to consider 5% revenue fine for personal data violations

Continuing the program of the 9th Session, 15th National Assembly , on the afternoon of May 12, the National Assembly discussed in groups the draft Law on Personal Data Protection.

Clarifying what is “sensitive personal data”

Participating in the discussion, delegate Tran Quoc Tuan ( Tra Vinh delegation) said that the meaning of the phrase "sensitive personal data" in the draft Law is unclear, and is still qualitative because personal data is sensitive to one person but not to another.

The delegate gave an example of the health condition and private life recorded in Mr. Nguyen Van A's medical records being leaked when Mr. A was the Chairman of the Board of Directors of a large company, which was doing well in business and had very high stock value.

Scene of the discussion session at Ho Chi Minh City Group on the afternoon of May 12. (Photo: VT)

However, Ms. B spread the news that Mr. A had terminal cancer. This news had a negative impact, causing the company's stock value and capitalization to plummet.

"In fact, Mr. A is really sick, and Ms. B is also the one who spread the truth. However, that source of information caused great damage to the company. So, is Ms. B's spreading of information that Mr. A has cancer considered a violation of the law?", the delegate asked.

Therefore, delegate Tuan suggested that the meaning of the phrase "sensitive information" should be clarified in the law to ensure feasibility.

Penalties of 1% to 5% of turnover are unlikely to be feasible.

Regarding handling violations of personal data protection regulations, Clause 2, Article 4 of the draft Law states: "Apply administrative penalties from 1% to 5% of the previous year's revenue of organizations and enterprises that violate regulations on personal data protection".

According to delegate Tuan, this regulation is difficult to implement, especially for newly established enterprises at the beginning of the year but cannot be punished if they violate the law at the end of the year. Or there are also cases where enterprises that violate the law are dissolved before being discovered. There are even cases where enterprises have low profit margins, if punished, they will suffer heavy losses.

Sharing the same opinion, delegate Do Duc Hien (Ho Chi Minh City delegation) said that the above penalty level is too severe and not feasible for businesses, especially for corporations operating in many industries and fields, where 1-5% of revenue is very large.

Delegates proposed to study and revise this regulation in the direction of stipulating maximum fines corresponding to the fields of data and digital technology industry. On that basis, the Government shall specify the fines for each specific violation, aggravating and mitigating circumstances, according to the principles of handling administrative violations.

Delegate Truong Trong Nghia (Ho Chi Minh City delegation). (Photo: VT)

Regarding this content, delegate Truong Trong Nghia (Ho Chi Minh City delegation) proposed considering the direction of regulating the fine based on the amount of interest earned and the level of damage caused, instead of regulating the fine based on revenue as in the draft.

Supplementing regulations on collecting and processing health data in medical applications

Regarding the regulations on personal data protection related to health and insurance information, Clause 2, Article 31 of the draft Law clearly states: "Organizations and individuals operating in the health sector shall not provide personal data to organizations providing health care services or health insurance services, unless there is a written request from the data subject."

According to delegate Nguyen Tri Thuc (Ho Chi Minh City delegation), during the professional activities of the medical sector, especially in urgent cases, emergencies, or referrals, doctors are often in a hurry when consulting, sometimes only communicating directly over the phone without having time to prepare all the necessary documents.

Delegate Nguyen Tri Thuc (Ho Chi Minh City delegation). (Photo: VT)

"In the case of a patient in a coma or without family members present, doctors at two medical facilities are forced to exchange and process health data without waiting for permission from the patient or the patient's family. If the consent of the data subject is required, it will not be possible to meet treatment requirements in time," the delegate stated.

Therefore, the Ho Chi Minh City delegation proposed to add regulations allowing the sharing of health data in emergency cases, or requiring professional consultation without the patient's consent. This is very important because it is closely related to daily medical activities.

In addition, delegate Thuc also said that there is currently a lot of health data collected by digital medical applications on the market, such as heart rate, blood sugar, movement indicators, etc. However, the draft Law does not have specific regulations on controlling these digital medical platforms.

Delegates proposed to add regulations on the collection and processing of health data in medical applications, including encryption standards, security when storing health data on applications, the process of granting access to third parties (hospitals or health insurance), and a mechanism for users to control their data on applications (right to delete data, limit information collection), helping to secure data information when using personal health monitoring applications.

Topic: 9th Session, 15th National Assembly

Draft Resolution amending and supplementing a number of articles of the 2013 Constitution of the Socialist Republic of Vietnam

Plan to organize the collection of opinions from the people, sectors and levels on the draft Resolution amending and supplementing a number of articles of the 2013 Constitution of the Socialist Republic of Vietnam

Announcement of 2 Resolutions of the National Assembly on amending and supplementing the 2013 Constitution

Source: https://nhandan.vn/de-nghi-can-nhac-muc-phat-5-doanh-thu-neu-vi-pham-du-lieu-ca-nhan-post879158.html