On the morning of June 5, the National Assembly Standing Committee gave its opinion on the reception, explanation, and revision of the draft Law on Personal Data Protection.
Regarding the ban on the purchase and sale of personal data, Senior Lieutenant General Le Quoc Hung - Deputy Minister of Public Security - said that in the context of digital transformation, exploiting the potential of data, including personal data, the Government sees this as an important source of production materials in developing the digital economy.
However, personal data needs to be used effectively and reasonably, in accordance with the principles of protecting human rights and civil rights. This draft law prohibits the purchase and sale of personal data unless otherwise provided by law.
The Deputy Minister of Public Security said that if it is allowed to buy and sell personal data, it means allowing the sale of people, the sale of human rights, and the right to decide on personal information of others.
The viewpoint of banning the purchase and sale of personal data is in line with international practices and regulations of countries on personal data protection.
In particular, the awareness of personal data protection of many organizations, businesses and individuals is currently limited. The importance of protecting personal data has not been fully implemented, creating gray areas in the use of personal data.
Recently, in large-scale property fraud cases that have been dismantled and are being investigated by the Ministry of Public Security, the factor of leaking and trading personal data is the main cause of the formation of very complicated personal data black markets.
The source of illegal personal data collection may come from illegal attacks, appropriations, and transfers. The sale of personal data also uses high technology to serve the purposes of all types of crimes.
To ensure a clear distinction and avoid law evasion, the draft law has added regulations prohibiting the use of personal data of others and allowing others to use their personal data to commit illegal acts.
The draft law supplements Article 17 on personal data transfer, which stipulates that the transfer of personal data in cases specified in Clause 1 of this Article with or without fee collection is not determined to be the purchase or sale of personal data.
Due to the serious nature and consequences of violating regulations on personal data protection, it is necessary to stipulate higher fines to ensure deterrence for large enterprises, especially multinational corporations or high-tech enterprises with revenue of thousands of billions of VND.
If the fine is too light, large enterprises and cross-border enterprises will be willing to violate to profit and transfer personal data across the border.
Through research, the Government found that many countries also regulate high and very high fines in this field such as the US, EU, Singapore, Indonesia... These countries regulate fines based on revenue percentage, their fines currently fluctuate with cases of 4 billion VND, some cases up to 584 billion VND.
Therefore, the Draft Law adjusted towards an increase in the maximum penalty in sanctioning administrative violations for violations in the field of personal data protection of VND 3 billion; Amending the Law on Handling of Administrative Violations (considered at the 9th session) in the direction of the maximum fine for the field of personal data protection will be implemented in accordance with the Law on Personal Data Protection.
In addition, for the act of buying and selling personal data, a fine of up to 10 times the revenue from the violation can be imposed. In case there is no illegal collection, the maximum fine of 3 billion VND will be applied.
