The Ministry of Public Security has just released a draft Law on Personal Data Protection with many important proposals.

Notably, Article 31 of the draft stipulates that social networks and communication services are provided directly to viewers via cyberspace. Organizations and individuals providing social network services and communication services via cyberspace (OTT) are responsible for protecting the personal data of Vietnamese citizens when operating in the Vietnamese market, or appearing on mobile application stores provided to the Vietnamese market.

bet 572.jpg
Organizations and individuals providing social networking services are not allowed to ask users to take photos of their identification cards or national identity cards as a factor in account authentication. Illustrative photo

Service providers must clearly notify the content of personal data collected when data subjects install and use social networks and OTT services. Do not collect personal data illegally and beyond the scope of the agreement with the customer.

Organizations and individuals providing social networking services and communication services via cyberspace are not allowed to require users to take photos of their citizen identification cards or identity cards as a factor in account authentication.

The draft law also requires social media platforms to provide users with an option to opt out of cookie collection and cookie sharing.

These organizations are responsible for providing a “do not track” option, or only tracking social media and OTT service usage with the user’s consent.

In addition, it is necessary to specifically and clearly notify in writing about the sharing of personal data as well as apply security measures when carrying out advertising and marketing activities based on customers' personal data.

The bill states that it is an offence to "wiretap, eavesdrop or record calls and read text messages without the consent of the data subject".

"Personal data registered for social network accounts and OTT services is not public data and cannot be processed without the consent of the data subject," the draft states.

According to the Ministry of Public Security, personal data protection is the activity of propagating, guiding, ensuring, managing, operating, preventing, detecting, stopping, and handling violations of the provisions of law on personal data protection.

Building the Law on Personal Data Protection aims to perfect the legal system on personal data protection in our country, create a legal corridor for personal data protection, improve the capacity to protect personal data for domestic organizations and individuals to reach international and regional levels. At the same time, promote the legal use of personal data to serve economic and social development.

The draft Law on Personal Data Protection is expected to be submitted to the National Assembly for comments at its 9th session and approved at the end of this year.