On 24 September 2024, the Ministry of Public Securities (MPS) published the draft law on personal data protection (Draft PDPL). Compared to Decree 13/2023, the Draft PDPL introduces several significant points related to personal data protection. This blog will explore the key highlights and implications of these new provisions.
1) Expanded scope of application
As compared to Decree 13/2023, the Draft PDPL broadens its scope to cover additional entities, being “agencies, organizations, and individuals collecting and processing personal data of foreigners within Vietnamese territories.” (Article 1.2(dd). This provision appears to enhance the protection of personal data belonging to foreign nationals. However, it remains unclear whether the provision applies solely to foreigners present in Vietnam or also to those residing abroad. The ambiguity lies in the interpretation of the phrase “within Vietnamese territories”. If it extends to foreigners outside Vietnam, it could impose significant compliance burdens on Vietnamese enterprises processing personal data of foreign nationals.
Furthermore, it is confusing that the Draft PDPL does not address the existing ambiguity in the scope of application under Decree 13/2023. Instead, it introduces another type of applicable entity that could potentially create even greater uncertainty.
2) Definition of personal data associated to “citizen”
Unlike Decree 13/2023, the Draft PDPL defines both basic personal data and, seemingly, sensitive personal data as being specifically associated to “citizens”. It is unclear why Draft PDPL limits its personal data protection to citizens rather than to all individuals, regardless of nationality or status. This approach is not in line with the term “personal data” in GDPR (which refers to that of a natural person). Furthermore, limiting protections to citizens could also infringe on the rights of non-citizens and stateless people, potentially conflicting with Article 21 of the 2013 Constitution, which guarantees privacy rights to "everyone," not just citizens.
Additionally, the term “citizen” is ambiguous, as it is unclear whether it refers to Vietnamese citizens only or also encompasses foreign citizens. If the former interpretation is adopted, this would be inconsistent with the broader scope outlined in Article 1.2(dd) of the Draft PDPL, which governs the personal data of foreigners. If the latter interpretation is adopted, it would not be reasonable for the Draft PDPL and Vietnamese authorities to govern personal data of foreign citizens (especially those who are not in Vietnam).