With the development of technology, human’s life has been becoming more comfortable than ever, we can do so much with only our phones such as booking, purchasing, socializing, conducting transactions, etc. However, everything has its pros and cons, by joining a widely connected world, human is exposed to the risk of losing their personal information, of their data being traded among suppliers which causes a lot of troubles.

Issue

Since technology has become a common part of our lives, people tend to be careless about publicizing their personal information such as their telephone numbers, their emails, their addresses, etc. to use technology more easily or sometimes it is a compulsory condition. For example, you have to share your address and your telephone number to use application for cars with e-hailing service.

Consequently, many people are bothered by constant phone calls and spams to advertise for random products or services because their personal information has been sold to suppliers of these products/services by the original obtainer of such information. This issue has become so serious as people keep getting spam calls and messages regardless of time or place that can be seen as an act of harassment.

Regulations

Therefore, in order to protect personal information of users, the Government has issued Decree 15/2020/ND-CP specifying penalties for administrative violations against regulations on postal services, telecommunications, radio frequencies, information technology and electronic transactions (“Decree 15”) which has already taken effect on 15/4/2020. Decree 15 stipulates quite specifically the penalties for administrative violations in field of postal services and telecommunications, two main penalties are warnings and fines, the maximum fines imposed upon an individual can reach up to VND 100.000.000. However, Decree 15 only focuses on the responsibility of organizations in postal and telecommunication services which provide network without mentioning the responsibilities of spammers so its effect on protecting users from spam phone calls, emails and messages is not quite substantial. Also, Decree 15 does not provide definitions of spam calls, emails or messages making it difficult for users to prove whether such calls, emails or messages are spam or not. In addition, even though people tend to get annoyed by spams, they usually just ignore or hang up on those spam calls or messages, it is unlikely that people will take legal actions against those spammers. Therefore, it will be better to establish an association who is responsible to take complaints from users about spammers and has authority to penalize those spammers.

Aiming to overcome the abovementioned drawbacks of Decree 15, the Government has decided to issue Decree 91/2020/ND-CP on preventing spam messages, emails and calls (“Decree 91”) on 14/8/2020. Accordingly, Decree 91 allocates responsibilities equally among network providers and advertisers who use calls and messages as marketing tools. Additionally, Decree 91 has definitions to help users to distinguish between advertisement calls or messages and spams, therefore, making it easier to determine the violations and its penalty. Decree 91 also stipulates the regulations on establish the system to receive complaints on spam messages, spam emails and spam calls managed by Ministry of Information and Communication, thus, this system will encourage users to report on spammers. Decree 91 will soon take effect on 1/10/2020 and is expected to reduce the spam calls, messages or emails which cause a lot of troubles to  users.

On the other hand, it is important to note that the legal system of Vietnam is still lack of legal tool to protect personal information of users. Although there are Law on cybersecurity and Law on cyber information security which stipulate  liabilities taken by organizations/individuals when collecting and processing personal information, prohibiting them from providing, sharing or spreading to any third party unless otherwise consented by the owners of such personal information or at the request of competent state authorities. However, these laws have not set out specific penalties for such violations which lessen their effects on violators. Moreover, in general terms these laws focus mainly on the data protection of organizations or competent authorities. In this light, a Decree is under drafting to specify protection of personal data. Some points thereof need to be clarified. More information about this Draft Decree can be found at this link.

In conclusion, protection of personal information has long been a hot potato in the legal system of Vietnam. The issuance of Decree 91 can be considered as an effort made by the Government towards this issue, however, it is just a small part of protection of personal information which needs a lot of attention from the Government. While waiting for the issuance of the specialized Decree on this problem, to protect themselves, users should be careful before publicizing their personal information.

DISCLAIMER

This LBN newsletter are NOT legal advice. Readers are advised to retain a qualified lawyer, should they wish to seek legal advice. VCI Legal are certainly among those and happy to be retained, yet VCI Legal is not to be hold responsible should any reader choose to interpret/apply the regulations after reading this LBN without engaging a qualified lawyer.