Severe penalties for violations related to personal data to ensure deterrence

Deputy Minister of Public Security Le Quoc Hung reports on the draft Law on Personal Data Protection

Chairman of the National Defense, Security and Foreign Affairs Committee Le Tan Toi said that the draft law is adjusted to apply to all individuals, agencies and organizations involved in personal data processing (PD), including PD processing in the physical environment, not just the network environment.

"It is necessary to clarify that the subjects of application are foreign agencies, organizations and individuals directly handling or related to the handling of DLCN of Vietnamese citizens," Mr. Le Tan Toi emphasized.

Chairman Le Tan Toi informed that regarding the rights and obligations of data subjects, the Standing Committee of the National Defense, Security and Foreign Affairs Committee has coordinated with the drafting agency to redesign the regulations on the rights of data subjects to be clearer, in line with international practice, including the right to know, the right to consent, the right to access, view, edit or request data correction, the right to withdraw consent, the right to request restriction of processing, the right to request deletion of data and other rights.

The draft also defines the principle of handling violations as depending on the nature, level, and consequences, administrative sanctions or criminal prosecution will be imposed; if damage is caused, compensation must be paid.

Regarding administrative fines, due to the nature and serious consequences of violations of regulations on DLCN protection, it is necessary to prescribe higher fines to ensure deterrence for large enterprises, especially multinational corporations or technology enterprises with revenues of thousands of billions of VND.

Chairman of the National Defense, Security and Foreign Affairs Committee Le Tan Toi

Based on international experience, the draft stipulates that for the act of buying and selling DLCN, the fine can be up to 10 times the revenue from the violation; for the act of violating the regulations on transferring DLCN across borders, the maximum fine is 5% of the revenue of the previous year; for other violations, the maximum fine is 3 billion VND. At the same time, the fine for individuals is regulated to be half of the fine for organizations.

Attending the meeting, Vice Chairman of the Law and Justice Committee Nguyen Truong Giang expressed concern about the regulation of "maximum fine of 5% of revenue", because for businesses with large revenue, up to thousands of billions of VND, applying the above fine would be very large. Mr. Nguyen Truong Giang also suggested that the maximum fine of 3 billion VND should not be applied for "other acts" but should be applied according to the regulations on handling administrative violations to ensure consistency and compatibility.

Sharing the same view, Vice Chairman of the National Assembly Vu Hong Thanh said that for businesses with revenue of up to hundreds of thousands of billions of VND per year, it is impossible to collect at a rate of 5%, because that number is "extremely huge". Or for foreign businesses without legal status in Vietnam, or newly established businesses that did not have revenue last year, there must also be a reasonable mechanism to be feasible. On the other hand, according to Vice Chairman of the National Assembly Vu Hong Thanh, violations related to DLCN affect the right to privacy, if only regular administrative penalties are imposed, it will be difficult to ensure deterrence.

Speaking further at the meeting, Deputy Minister of Public Security Le Quoc Hung emphasized that the goal of this law is to contribute to preventing and handling personal data infringement issues that are widespread and increasingly serious, necessary to monitor both national security and human rights.

The draft law prohibits the purchase and sale of DLCN (except in cases where the law provides otherwise), according to the Deputy Minister of Public Security, because DLCN is closely linked to people, human rights, personal rights, and privacy rights, it cannot be considered as ordinary goods or property. This is a special type of resource, a special property, requiring exploitation and use to go hand in hand with the highest and strictest level of protection.

“If we allow the trading of personal data, it means allowing the trading of people, human rights, and the right to decide on other people’s personal information. The viewpoint of prohibiting the trading of personal data is consistent with international practices and regulations of countries on the protection of personal data, prioritizing development along with the protection of rights,” said Deputy Minister Le Quoc Hung.

Regarding the handling of administrative violations of personal data protection, the Deputy Minister of Public Security said that due to the very serious consequences of the violation, it is necessary to prescribe higher fines to ensure deterrence for large enterprises, especially multinational corporations or high-tech enterprises with revenues of thousands of billions of VND. If the fine is too light, large, cross-border enterprises are willing to violate to transfer personal data across borders for huge profits.

The National Assembly is expected to consider passing this law at the second phase of the 9th session.

Regarding prohibited acts, the draft law is expected to incorporate and revise, focusing on prohibiting common, high-risk acts such as: handling DLCN to oppose the State; obstructing DLCN protection activities; taking advantage of DLCN protection activities to violate the law; illegally collecting, storing, disclosing, and transferring DLCN; buying and selling DLCN (except in cases where the law provides otherwise); appropriating, intentionally disclosing, or losing DLCN.

MR. PHUONG

Source: https://www.sggp.org.vn/phat-nang-cac-vi-pham-lien-quan-den-du-lieu-ca-nhan-de-dam-bao-tinh-ran-de-post798230.html