Vietnam’s Personal Data Protection Decree Moves One Step Closer to Promulgation

On March 7, 2022, the government of Vietnam issued Resolution No. 27/NQ-CP (“Resolution 27”) approving the promulgation of the latest version of the Draft Decree on Personal Data Protection (“Draft PDPD”) prepared by the Ministry of Public Security (“MPS”), and further instructed the MPS to pass this draft to the National Assembly’s Standing Committee for final consideration.

Although the full content of the approved Draft PDPD has not been made available to the public, Resolution 27 clearly sets out several circumstances approved by the government in which the processing of personal data can be carried out without the consent of the data subjects. In comparison with the corresponding provision under the widely seen version of the Draft PDPD made available to the public in February 2021 (“February Draft”), the main differences are as follows:

• If the data processing is necessary in response to an emergency situation that threatens the life, health, or safety of the data subject or other individual, the data controller, data processor, data controller/processor, or a third party can process the personal data without the consent of the data subject, but they are responsible for proving that the situation is an emergency. The February Draft did not mention any requirement of proof. Moreover, “safety of the data subject or other individual” is a newly added criterion for personal data processing without consent under this circumstance.
• If the data processing is necessary because of national defense and security requirements, the processing must be carried out by competent authorities in accordance with other laws. The requirement that the processing must be carried out “by competent authorities” in this circumstance was not provided under the February Draft.
• Two circumstances have been removed: the processing of personal data in compliance with specific provisions that explicitly allow the processing of personal data without the data subject’s consent under international agreements or treaties to which Vietnam is a signatory, and the processing of personal data for research or statistical purposes. This means data processing for these purposes will still be subject to the prior consent of the data subjects.
• One circumstance has been added: the processing of personal data by a competent state agency to serve the operation of the state agency in accordance with the law.

Moreover, under Resolution 27, the MPS is assigned to preside over and coordinate with the Ministry of Justice in researching and proposing the development of a Law on Personal Data Protection, a new and separate piece of legislation that promises the development of a comprehensive legal system on data protection for Vietnam.

By Tilleke & Gibbins, Vietnam, a Transatlantic Law International Affiliated Firm. 

For further information or for any assistance please contact vietnam@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.