"Strong medicine" to protect personal data

We are facing a major challenge in protecting privacy in the digital world. In a report to the National Assembly in 2022, the Ministry of Public Security said that personal data of two-thirds of our country's population is being stored, posted, shared and collected on cyberspace in many different forms and to different degrees.

Recently, the 2024 cybersecurity research and survey conducted and published by the National Cyber ​​Security Association showed that the situation of personal data leakage continues to be complicated and serious. Specifically, up to 66.24% of users confirmed that their information has been used illegally. The reasons leading to this situation are very diverse, but according to the survey, 73.99% of users said that their information was leaked when shopping online, 62.13% said that sharing information on social networks was the main factor, while 67% identified that the leakage occurred during the use of essential services such as restaurants, hotels, or supermarkets.

This shows that the threat comes not only from cyber attacks but also from the lack of awareness of protecting personal information of users themselves; from agencies, organizations and businesses being lax in protecting personal data; not having appropriate management measures and protection techniques. Notably, even large enterprises with fully equipped technology systems have leaked personal data. For example, VNG Company leaked more than 163 million customer accounts; Mobile World and Dien May Xanh leaked more than 5 million emails and tens of thousands of payment card information; or the case of Vietnam Airlines' server being hacked and more than 400,000 customer accounts posted on the internet...

One of the serious consequences of personal information disclosure is the increase in online fraud. When bad guys have sensitive information such as phone numbers, emails, ID cards or bank account numbers, they can easily access and defraud people and appropriate property. According to a survey by the National Cyber ​​Security Association, 1 in 220 users are victims of online fraud, a rate of up to 0.45%. The total estimated damage in 2024 caused by online fraud is up to 18,900 billion VND, which is not a small number.

When personal information is leaked, people not only face a violation of their privacy, but also suffer financial, reputational, and even psychological damage. Cases of medical records being leaked and exploited commercially, such as insurance companies accessing patients’ health information to calculate insurance premiums, are becoming a real concern. Continuous “spam calls” are also evidence of information leaks and exploitation for commercial purposes.

Not to mention, this situation can undermine people's trust in organizations, authorities and online public services. This will hinder the national digital transformation process and the development of the digital economy.

According to statistics from the Ministry of Public Security, there are currently a total of 69 legal documents directly related to personal data protection. However, all of them have not yet agreed on the concept and content of personal data and personal data protection; it was only in Decree No. 13/2023/ND-CP that the concept of personal data and personal data protection was clearly stated. Moreover, the strong development of information technology (such as artificial intelligence, cloud computing, blockchain, etc.) and new threats from cybercrime require a stronger and more flexible legal framework to protect personal data more effectively.

At the meeting yesterday afternoon, the National Assembly Standing Committee gave its opinion on the draft Law on Personal Data Protection, and agreed on the necessity of enacting this law. It is expected that this bill will be submitted to the National Assembly for comments at the May Session and approved at the October Session. This draft is expected to create a clear and synchronous regulatory system; truly a "strong medicine" to help protect personal data and privacy more effectively, simplify and radically cut down on administrative procedures to create the most favorable conditions for businesses and people to promote the development of the data economy and digital economy.

Netherlands