70th anniversary of Hanoi's Liberation Day Vietnam - Asia 2023 Smart City Summit Hanoi celebrates 15 years of administrative boundary adjustment 12th Vietnam-France decentrialized cooperation conference 31st Sea Games - Vietnam 2021 Covid-19 Pandemic
Home / Economy / Banking & Finance
VDCA publishes guidelines for personal data processors
Thanh Thanh 04:48, 2023/07/21
Decree No. 13 is the third legal document to enhance cyberspace management in Vietnam.

Hoang Viet Tien, Deputy Secretary-General of the Vietnam Digital Communications Association (VDCA), spoke to The Hanoi Times about the highlights of the recent decree on personal data protection that would affect businesses in Vietnam, as well as the association's recommendations related to the decree.

 Local businesses are waiting for regulators to issue guidance for personal data processors. Photo: VNA

It is believed that more detailed data protection and cybersecurity obligations will be included in Decree No. 13. What is your view?

Vietnam's Decree on Personal Data Protection, also known as Decree No. 13, came into effect on July 1, 2023. The decree stipulates that many data subjects and data processors have the right to process data. Importantly, there are eight principles that local businesses processing personal data must adhere to and 11 rights of data subjects.

The decree provides clearer and more detailed obligations for businesses to collect, use, and manage personal data.

This decree focuses on processing, updating, modifying, deleting, and protecting personal data. The regulation improves the data processing process and enhances enforcement. We await the issuance of guidelines for personal data processors from regulatory authorities.

We consider certain cases, such as deleting personal information upon request. Many companies collect personal information to build customer profiles concerning interests, needs, and behaviors, referred to as analytically derived personal information. Consequently, building such profiles helps companies improve their operations.

Banks may use data about a customer's monthly salary to analyze interests and suggest better insurance policies or credit packages for the customer. In this case, personal information is used to enhance customer service.

However, when a customer requests the deletion of analytically derived personal data, the question arises as to whether all such personal data should be deleted under Regulation No. 13. The deletion of analytically derived personal data or newly created personal data from raw data is not clearly defined in Decree No. 13. This is one of many questions raised by members of the VDCA.

Hoang Viet Tien, Deputy Secretary General, Vietnam Digital Communications Association.

What should companies be aware of data subjects' rights under the Regulation?

Among these rights, companies should pay particular attention to the right of restriction of data processing and the right of objection to data processing, as compliance in these areas must adhere to the 72-hour rule. Restrictions must be implemented within 72 hours of the data subject's request for any personal data that the subject wishes to be restricted unless otherwise required by law.

This means the bank cannot sell the data to third parties, and all personal data can only be used for one application, such as a banking application.

Do you have any suggestions for Vietnamese businesses to meet their personal data protection obligations?

What enterprises need to do now is fulfill their obligations in protecting personal data by using encryption techniques and minimizing identification to ensure that data is used for necessary purposes or in emergencies.

Let's take Windows products as an example. We have had Win 98, Win 2000, Win XP, and many more products will be released in the future. Microsoft's role is to introduce products to the market, and the market will determine their suitability. Customers will provide feedback and suggestions for the product, similar to what we do today. State authorities are responsible for issuing Decree 13 and implementing it. Professional associations will conduct seminars and discussions to disseminate the decree and gather feedback. Today's discussion also aims to assist regulators in improving the regulation.

Based on your observations, what are the initial reactions of Vietnamese enterprises to the latest decree?

Some companies have taken measures to comply with Decree No. 13. For example, when a user accesses an application to buy movie tickets, a notification window will pop up, asking whether they agree to allow the company to process their personal data. If the person agrees, the company has the right to use the data. This is because the company has added some features to existing applications to establish the relationships between the data subject, the personal data controller, and the personal data processor.

In my opinion, data subjects must understand that the protection of their own data is their responsibility first. Then comes the role of regulators, who issue decrees or circulars to address violations or misuse of personal data.


Thank you for your time!

TAG: Hanoi news Vietnam news Personal Data Protection Decree in Vietnam Vietnam Decree No. 13
Other news
21:52, 2024/05/27
C.bank not considering dropping credit growth quota for fear of rising bad debts
Given the unique economic conditions of Vietnam, if banks increase credit growth without control measures, the system could return to the hot credit growth period seen before 2011.
18:20, 2024/05/09
Vietnam's non-cash payments reach US$9.8 trillion, 23 times GDP
Many of the banking industry's digital transformation goals for 2025 are on track to be met or exceeded.
21:53, 2024/05/04
PM urges Central bank to ensure positive growth in 2024
Local lenders are encouraged to provide incentives and attract individuals to take out consumer loans.
17:07, 2024/05/03
Vietnamese Gov't to continue VAT cut for second half of 2024
If the VAT reduction policy is continued for the last six months of the year, the total revenue loss for 2024 is projected to be approximately VND47.5 trillion (US$1.87 billion).
21:54, 2024/04/23
3,400 taels of gold purchased at the first-in-11-year auction
Gold trading firm SJC and lender ACB are the two successful bidders at the auction held today.
16:19, 2024/04/22
HoSE to launch KRX-developed transaction system in early May
Brokerage firms are expected to prepare data for the transition to the new system.