Not ensuring user autonomy
Recently, Zalo (under VNG Group Joint Stock Company) announced the update of service terms. In addition to basic information, the new terms also mention the collection of many types of data such as CCCD/CMND/Passport information, geographical location, usage behavior and interactive content on the platform.
Talking to Lao Dong Newspaper, Lawyer Pho Dung - Director of OPIC Law Company Limited and Partners, Hanoi Bar Association - said that Zalo, as a digital platform provider, has the right to amend and update service terms to serve operation, security and product development in the process of providing services.
However, this right is not absolute, but is strictly limited by legal regulations on protecting personal data and consumer rights" - lawyer Pho Dung emphasized.
According to lawyer Pho Dung, Zalo is not just a common application, but has become a popular means of communication for tens of millions of Vietnamese people.
Putting users on the option of accepting the full or being deleted after the account after 45 days, in essence does not reflect voluntariness, but is imposing transaction conditions, limiting the right of data subjects to self-determination over their personal information" - this lawyer analyzed.
According to Article 11 and Article 13 of Decree 13/2023/ND-CP protecting personal data, the consent of the data subject is only legal when it is clearly and specifically expressed for each purpose of data processing, not inferred from silence and most importantly, it must ensure voluntariness. Meanwhile, Zalo's new clause expands the scope of data collection to high identification information such as ID card, ID card, passport, geographical location, usage behavior, interactive content.
These are sensitive data or close to sensitive data but do not allow users to choose to agree to parts. Zalo has also not clarified the necessity of each type of data corresponding to each processing purpose. The design of this clause does not fully meet the requirements for transparency, posing a risk of violating the principle of minimizing data that the law is setting out" - lawyer Dung assessed.
Need to require transparency and separation of data processing purposes
To protect the privacy and legitimate interests of users, Lawyer Pho Dung suggested that management agencies need to review signs of abusing market positions to impose unfavorable transaction conditions on users.
The attachment of service use rights must accept all terms and not allow partial consent, it needs to be considered from the perspective of imposing unfavorable transaction conditions for consumers" - the lawyer analyzed.
Lawyer Dung also said that it is necessary to require transparency and separation of data processing purposes. Management agencies need to require businesses to clearly list each type of personal data collected, attach each type of data to each specific processing purpose; clearly distinguish data serving service operation from data serving other purposes. In particular, require businesses to redesign the consent mechanism, allowing users to selectively agree and refuse non-essential processing purposes while still continuing to use the basic functions of the service.
Next, strengthen the mechanism of supervision, post-inspection and require adjustment of clauses to ensure compliance with the Law on Protection of Personal Data as soon as it takes effect.
Management agencies need to monitor the amendment of terms, check the actual processing of data and strictly handle violations if detected. The issue is not only whether the platform has the right to update terms or not, but whether that right is exercised in a way that fully respects the user's personal data rights or not" - Mr. Dung emphasized.
Personal data protection needs to be a top priority
Lawyer Ha Hai - Deputy Chairman of the Ho Chi Minh City Bar Association - said that Zalo is an application providing services on an electronic platform and has a fee collection activity for users when exceeding the free usage level. In this relationship, VNG is both a profit-generating business unit and a controlling party, processing a large volume of personal data.
Therefore, the responsibility for protecting user information needs to be strictly, clearly and commensurate with the economic benefits that businesses earn. The law not only requires compliance with security principles, but also requires specific mechanisms of responsibility and sanctions when personal data rights are infringed.
Reality shows that many similar messaging applications and social networks in the world such as WhatsApp, WeChat, Line or Viber all publicly announce data protection commitments, applying high technical standards to ensure system safety and user privacy. These are good practices that domestic platforms need to refer to.
From a legal perspective, Zalo's update of usage terms needs to be carried out more cautiously, creating conditions for users to have time to consider and fully evaluate before approving. In all cases, the principle of protecting personal data and consumer rights needs to be placed at the top priority in the current electronic transaction environment.
On the morning of December 31, the National Competition Commission (UBCTQG) said it had received document No. 256/2025/CV-VNGG dated December 30 from VNG Company on the proposal to postpone the working schedule. The reason VNG gave was that the content of information and documents to be provided related to many professional and professional areas that needed to be summarized and prepared, so VNG could not complete it by December 31, 2025.
