On the morning of June 5, the National Assembly Standing Committee gave its opinion on the reception, explanation, and revision of the draft Law on Personal Data Protection.
The draft law is adjusted to apply to all individuals, agencies and organizations related to personal data processing, including personal data processing in the physical environment, not just the network environment.
Contributing opinions to the report, Vice Chairman of the Committee for Law and Trial Nguyen Truong Giang assessed that the regulation prohibiting the purchase and sale of personal data in the draft Law is still general and has not fully planned all cases in civil transactions.
According to Mr. Giang, the subjects participating in the transaction can completely circumvent the law by making profitable transactions, such as giving/giving, exchanging, borrowing.
"On the other hand, Clause 4, Article 17 of the draft Law stipulates the "transfer of personal data", that is, the term "buy and sell" is not used but "transfer".
Notably, in the cases specified in Clause 1, Article 17, this transfer can be carried out with or without fee collection. Thus, in this context, the act of transferring personal data with fees is different from the act of buying and selling personal data," said Deputy Chairman of the Law and Justice Committee Nguyen Truong Giang.
Article 8 of the draft Law stipulates that the maximum penalty for administrative sanctions for organizations that violate the regulation on cross-border personal data transfers is 5% of the organization's revenue in the previous year.
The maximum fine for administrative sanctions for other violations in the field of personal data protection is 3 billion VND.
According to Mr. Giang, through a survey, in 2024, Viettel's revenue will reach 189.9 trillion VND, VNPT will reach 58.5 trillion VND - "So if the above 5% of revenue is very tight, it is recommended to consider".
In addition, Vice Chairman of the Law and Justice Committee Nguyen Truong Giang said that the regulation requiring agencies, organizations and individuals to notify or have appropriate information so that data subjects know that they are being recorded in public is not feasible in practice.
He cited the current reality, when digital technology is developing strongly, many types of devices such as security cameras, personal cameras, dash cams mounted on vehicles... are commonly used. Requiring recorders to notify each individual who was filmed in these situations is unrealistic.
Instead of requiring notification when recording or filming in public, what is more important is to focus on managing data output that is, how that data is used, shared, stored or transferred. This is the core issue that needs to be strictly controlled, Mr. Nguyen Truong Giang emphasized.
Regarding the penalty for violations in the field of personal data protection, Vice Chairman of the National Assembly Vu Hong Thanh said that this violation has a very negative impact on society and the violator, if only punished like a normal administrative fine, it would not be enough deterrent.
The Vice Chairman of the National Assembly suggested that the drafting agency coordinate with relevant agencies to absorb the opinions of delegates and clarify this issue.
At the same time, regarding the regulation on maximum fines of 5% of revenue for the year-end fiscal year, according to Vice Chairman of the National Assembly Vu Hong Thanh, this fine may be suitable for small businesses. However, for large enterprises - "as Mr. Giang just mentioned, 5% of revenue is a very large number"
In addition, for foreign enterprises that do not have a legal entity in Vietnam, or newly established enterprises that do not have data on revenue in the previous year, the application of a penalty level based on the revenue ratio is unfounded. In these cases, the Government needs to build a separate handling mechanism.
