ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Vietnam report)

ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Vietnam report)

Author: Dominic Paulger, Policy Manager (APAC), Future of Privacy Forum

Asian Business Law Institute and Future of Privacy Forum

August 2022

This report provides a detailed overview of relevant laws and regulations in Vietnam on

• notice and consent requirements for processing personal data;
• alternative legal bases for processing personal data which permit processing of personal data without consent if the data controller undertakes a risk impact assessment (e.g., legitimate interests); and
• statutory bases for processing personal data without consent and exceptions or derogations from consent requirements in laws and regulations.

Table of Contents

1. INTRODUCTION 

2. CONSENT AND PRIVACY SELF-MANAGEMENT IN EXISTING LAWS AND REGULATIONS

    2.1. Heath sector 

    2.2. Credit sector 

3. CONSENT AND PRIVACY SELF-MANAGEMENT IN THE DRAFT PDP DECREE

4. CONDITIONS FOR CONSENT 

    4.1. Definition and forms of consent

           a. Consent in e-commerce
           b. Consent to receive advertising or marketing communications
           c. Consent in the Draft PDP Decree

    4.2. Withdrawal of consent

           a. Existing data protection framework
           b. Draft PDP Decree

    4.3. Bundled consent

           a. Existing data protection framework
           b. Draft PDP Decree
           c. Whether access to services may be conditional on consent

5. CONSENT FOR SPECIAL CATEGORIES OR USES OF DATA

    5.1. Existing data protection framework

    5.2. Draft PDP Decree

    5.3. Children

           a. Existing data protection framework
           b. Draft PDP Decree

    5.4. Cookies, Internet of Things, online tracking

    5.5. Direct marketing

           a. Existing data protection framework
           b. Draft PDP Decree

    5.6. Biometric data

    5.7. Genetic data

    5.8. Financial information

    5.9. Pseudonymized data

    5.10. Location data

6. CONSENT FOR CROSS-BORDER DATA TRANSFERS

    6.1. Existing data protection framework

    6.2. Draft PDP Decree

7. TRANSPARENCY AND NOTICE

    7.1. Existing data protection framework

    7.2. Draft PDP Decree

8. SANCTIONS AND ENFORCEMENT

    8.1. Existing data protection framework

           a. Administrative sanctions
           b. Criminal sanctions
           c. Enforcement

    8.2. Draft PDP Decree

           a. Fines
           b. Additional sanctions
           c. Remedial measures
           d. Compensation

9. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT SUBJECT TO A RISK IMPACT ASSESSMENT

10. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT IN OTHER CIRCUMSTANCES DEFINED BY LAW

      10.1. Existing data protection framework

               a. Network environments
               b. Health sector.
               c. Credit sector.

       10.2. Draft PDP Decree

                a. Processing of personal data without consent
                b. Disclosure of personal data without consent
                c. Sharing personal data with a third party, or granting a third party access to personal
data
                d. Scientific or statistical research