On March 15, 2024, as part of the launch event celebrating Vietnam Consumer Rights Day 2024, the theme “Transparent Information – Safe Consumption” was selected to emphasize the critical role of information in safeguarding the rights and safety of the consumer. This theme underscores the pressing need to enhance awareness of transparent information, particularly amid the growing prevalence of fraudulent and privacy-invasive practices targeting consumers. From a legal perspective, the Law on Consumer Protection 2023 (“LCP 2023”) introduces specific provisions on the protection of personal information of the consumer. These provisions aim to protect consumers’ personal data and ensure the lawful safeguarding of their rights and interests. They also seek to prevent data misuse and reinforce the accountability of organizations and individuals in securely and transparently collecting, storing, and using consumer information.
This article provides an overview, analysis, and commentary on the scope and limitations of the LCP 2023 with respect to the concept of “Consumer Information.” It does not address the specific measures that organizations or businesses must adopt to protect consumer information or the rights consumers have regarding their personal data under the LCP 2023.
1. Definition of Consumer Information under the LCP 2023
Consumer information is defined in Article 3.3 of the LCP 2023. Specifically, Article 3 provides that: “Consumer information includes personal information of consumers, information regarding the purchase and use of products, goods, and services by consumers, and other information related to transactions between consumers and organizations or individuals engaged in business activities”.
Under this definition, Consumer Information encompasses basic personal data such as name, phone number, delivery address, personal email, age, gender, occupation, banking details, etc. Additionally, it includes information about consumer activities, such as purchase history, products or services utilized, transaction timestamps, and feedback or complaints regarding service quality. For instance, a consumer frequently purchasing infant formula via a shopping application may have their purchase history recorded, including the types of formula purchased and transaction times. Upon receiving a defective product, the consumer may file a complaint requesting a replacement and leave a two-star service rating.
Thus, the scope of Consumer Information as defined in Article 3.3 of the LCP 2023 is limited to basic personal data, information related to transactions, and the use of products, goods, and services by consumers, as well as other related information. Under its current approach, the LCP 2023 has essentially established a legal framework to protect consumer rights against risks of data misuse by businesses and individuals to a certain extent.
2. Key Observations on the Concept of Consumer Information under the LCP 2023
First, the LCP 2023 does not categorize Consumer Information into Basic Consumer Information and Sensitive Consumer Information, as is the approach of Decree 13/2023/ND-CP. Under the decree, personal data is differentiated into basic personal data and sensitive personal data, with corresponding measures and handling processes applied at varying levels for each type. In contrast, the LCP 2023 adopts a unified concept of Consumer Information, with protective measures applied uniformly across all types of Consumer Information.
Second, the scope of the LCP 2023 is confined to (1) personal information of consumers; (2) information about consumers’ purchasing or usage of products, goods, and services; and (3) other information related to transactions between consumers and businesses. This legal provision appears to exclude a highly prevalent category of data in the digital age— Consumer Behavioral Information.
In the context of digital and e-commerce development, Consumer Behavioral Information refers to data reflecting habits, interests, and consumption trends, often collected through consumer interactions with digital platforms. Examples include search history, viewing frequency and interactions with products or services on digital platforms, and content followed on social media. Behavioral data may also include verbal or textual consumer interactions recorded by technological devices, such as queries like “Which phone should I buy?” on virtual assistant platforms, to generate tailored advertisements or product suggestions.
Third, the LCP 2023 does not directly regulate third parties beyond “organizations or individuals engaged in business activities” when such third parties collect and process Consumer Information. Specifically, in certain cases involving Consumer Information—particularly Behavioral Consumer Information as mentioned earlier—such information may not always be directly collected by businesses but is often gathered by third parties. For instance, an e-commerce platform may track a consumer’s search history for technology products like tablets from various suppliers in the same market segment to recommend suitable products. Likewise, online search engines such as Google or virtual assistant applications like Google Assistant may collect data through text input or voice queries, such as the question “Which phone should I buy?” to deliver targeted advertisements or product suggestions. Additionally, video-sharing platforms like YouTube may monitor viewing habits, such as users frequently watching cooking tutorial videos, to suggest kitchenware products or online cooking courses aligned with the consumer’s interests.
The LCP 2023 provides a foundational legal framework for the protection of consumer information. However, its lack of differentiation in data categorization, omission of behavioral data, and absence of clear provisions for third-party data handling represent notable gaps. Addressing these limitations is essential for modernizing the legal framework to keep pace with technological advancements and ensure comprehensive consumer protection.
See more:
1/ Subjects and Fundamental Principles of GDPR
2/ Due diligence on personal data protection in M&A transactions
3/ Personal data processing impact assessment
Disclaimers:
This article is for general information purposes only and is not intended to provide any legal advice for any particular case. The legal provisions referenced in the content are in effect at the time of publication but may have expired at the time you read the content. We therefore advise that you always consult a professional consultant before applying any content.
For issues related to the content or intellectual property rights of the article, please email cs@apolatlegal.vn.
Apolat Legal is a law firm in Vietnam with experience and capacity to provide consulting services related to Data and contact our team of lawyers in Vietnam via email info@apolatlegal.com.
