Concerns that Google, Facebook, and Tiktok store user data on servers outside Vietnam

On the afternoon of March 26, full-time National Assembly deputies gave their opinions on the draft Law on Personal Data Protection.

Mr. Duong Khac Mai speaks (Photo: Pham Thang)

Delegate Duong Khac Mai (Dak Nong Delegation) expressed his strong support for the need to promulgate the Law on Personal Data Protection. The promulgation of the law aims to concretize the Party's guidelines, policies, and viewpoints on national digital transformation, digital economic development, and building a digital society to meet the increasingly high demands of international integration, especially to promptly prevent acts of personal data infringement, collection, attacks, appropriation, and illegal trading of personal data that have been taking place in recent times in a very complicated manner.

Regarding prohibited acts, Clause 5, Article 7 of the draft law stipulates that buying and selling personal data is strictly prohibited. However, Mr. Mai requested to clarify whether the prohibition of buying and selling personal data also prohibits the act of giving or donating.

Mr. Mai analyzed: The data that organizations and enterprises collect from personal data subjects is processed data. According to the provisions of Clause 8, Article 2, personal data processing is one or more activities affecting personal data such as collecting, recording, analyzing, confirming, storing, editing, publicizing, disclosing, combining, accessing, retrieving, recalling, encoding, decoding, copying, sharing, transmitting, providing, transferring, destroying personal data or other related actions. Therefore, at this time, the data collected by enterprises and organizations is a collection of data from many personal data subjects and the costs of enterprises and organizations for personal data processing activities. Therefore, the prohibition of buying and selling personal data needs to be considered.

Ms. Nguyen Thi Suu speaks (Photo: Pham Thang)

According to delegate Nguyen Thi Suu (Thua Thien Hue Delegation), protecting personal data during the process of using personal data, first, how to use personal data? Second, protecting personal data, third, protecting during the process of using personal data.

“Only with personal data can there be protection of personal data in terms of processing, use, exploitation and related areas such as business or information on social networks. Therefore, the Drafting Committee needs to add a separate chapter regulating personal data, and at the same time add regulations on non-personal data,” Ms. Suu suggested.

Delegate Nguyen Truong Giang (Dak Nong Delegation) also said that personal data, if normally kept separately, belongs to each individual. However, personal data according to this law has been processed, that is, collected and encrypted into a file. Now we prohibit buying and selling, which is not good.

“The problem is that if we only prohibit buying and selling, can we exchange? In reality, a corporation can have many companies and when they collect data, encode and process it, they have to transfer it to other companies to serve their production and business, so we prohibit buying and selling, but when it comes to exchanging, it is not clear whether there is exchange or not?” Mr. Mai raised the issue and suggested that it must be very clear when buying and selling is allowed? When is it allowed to exchange?

Mr. Giang also mentioned that recently when he personally went with the National Defense, Security and Foreign Affairs Committee, the businesses themselves also made recommendations regarding the issue of transferring personal data from one department to another to maximize the effectiveness of the processed personal data package?

Delegate Thach Phuoc Binh speaks (Photo: Pham Thang)

According to Deputy Thach Phuoc Binh (Tra Vinh Delegation), the draft law does not clearly stipulate the management of personal data of Vietnamese citizens when this data is stored, processed or shared with organizations and individuals abroad. This poses a number of challenges such as: many large technology companies such as Google, Facebook, Tiktok store user data on servers located outside of Vietnam. Without a clear monitoring mechanism, the risk of data being misused or violated is very high.

According to Mr. Binh, if there are no regulations on the application of Vietnamese law to foreign data processing organizations, requests to delete data, prevent violations or handle disputes will face many obstacles.

“European countries and China all have very strict cross-border data control mechanisms, so our country needs similar regulations to protect citizens’ data from being illegally exploited,” Mr. Binh cited. From there, Mr. Binh suggested clearly defining the scope of the law’s regulation for personal data stored abroad. Requiring foreign organizations processing Vietnamese citizens’ data to comply with Vietnamese law is similar to the way European countries require non-European companies to comply with their data protection laws.

Source: https://daidoanket.vn/lo-ngai-google-facebook-tiktok-luu-tru-du-lieu-nguoi-dung-tren-cac-may-chu-dat-ngoai-viet-nam-10302333.html