At the 9th Session of the 15th National Assembly, the Draft Law on Personal Data Protection was officially submitted. The draft law consists of 7 chapters and 68 articles, inheriting Decree 13/2023/ND-CP and adding many new contents.
The draft law lists 6 groups of prohibited acts, including: Illegal processing of personal data, negatively affecting the State, national defense, security, rights and legitimate interests of organizations and individuals; obstructing data protection activities of competent authorities; taking advantage of data protection to violate the law; collecting, processing, and transferring data in violation of regulations; buying and selling personal data; intentionally appropriating, disclosing or losing personal data.
The draft law also clearly states the proposal to impose a penalty of 1% to 5% of the previous consecutive year's revenue on violating organizations.
The Committee for National Defense, Security and External Affairs - the law project's review agency - said that some members of the Committee proposed clarifying the definition of "buying and selling personal data" to have a solid legal basis for banning this behavior.
Talking to Lao Dong, artificial intelligence (AI) expert Tran Hai Long (AI Scientist Brickteck JSC) said that personal data has become a valuable asset of each person. Currently, many cases of fraud and property appropriation occur from the fact that bad guys have the victim's personal information and rely on it to create a scenario of fraud and appropriation.
"Therefore, the Government's proposal to legalize the ban on the purchase and sale of personal data is completely reasonable and will certainly help prevent and reduce fraud cases. However, there will be many difficulties in controlling because buying and selling is often not done in a transparent manner" - Mr. Long shared.
According to experts, in addition to promulgating laws and sanctions for acts of trading personal data, there is also a need for measures to propagate and educate people about the importance of personal data.
Mr. Long analyzed that information such as full name, phone number and email address can be freely provided to the parties; as for other information such as personal identification code, living address and family information, it is necessary to be very careful when the subject requests to provide it.
According to Mr. Long, banning the sale of personal data is completely necessary. However, this should be limited and may allow businesses to buy and sell user data transparently to promote socio-economic development.
Sharing the same view, cybersecurity expert Ngo Minh Hieu - founder of the Countering of Bankruptcy Project - said that the Draft Law on Personal Data Protection has proposed administrative sanctions to increase deterrence against violations of personal data protection.
"However, it is necessary to supplement and specify sanctions, especially criminal and civil sanctions, to ensure feasibility and effectiveness in law enforcement. This will help promptly prevent violations of personal data and protect the rights of citizens more comprehensively" - Mr. Hieu expressed.
