I. INTRODUCTION
Decree 13/2023/ND-CP and the forthcoming Law on Personal Data Protection are the two primary legal normative documents governing issues related to the processing and protection of personal data in Vietnam. However, these two legal normative documents do not directly stipulate sanctioning measures (including administrative sanctions and criminal liability) for acts of violation of the law on personal data protection.
Accordingly, decrees on administrative sanctions and the 2015 Criminal Code (amended and supplemented in 2017) regulate administrative sanctions or criminal liabilities for acts of violation of the law related to the issue of personal data protection.
This article aims to address and briefly describe the crimes and criminal liabilities related to the field of personal data protection as stipulated by the 2015 Criminal Code.
In general, violations of the law on personal data protection may be subject to criminal prosecution for the following crimes:
- Article 159. Infringement upon secret information, mail, telephone, telegraph privacy, or other means of private information exchange
- Article 167. Infringement upon freedom of speech, freedom of the press, the right of access to information, and the right to protest of citizens
- Article 287. Obstruction or disturbance of computer networks, telecommunications networks, or electronic devices
- Article 288. Illegal provision or use of information on computer networks or telecommunications networks
- Article 289. Illegal infiltration into the computer network, telecommunications network, or electronic device of another person
- Article 291. Illegal collection, storage, exchanging, trading, publishing of information about bank accounts
2. Criminal liability in the field of personal data protection
2.1. Infringement upon secret information, mail, telephone, telegraph privacy, or other means of private information exchange (Article 159 of the 2015 Criminal Code)
Article 38 of the 2015 Civil Code stipulates provisions related to the Right to private life, personal secrets, and family secrets. Violations of the right to private life, personal secrets, and family secrets shall be grounds for criminal liability as stipulated in Article 159 of the 2015 Criminal Code. Specifically as follows:
| Violating Act | Sanction | Other notes (if any) |
Recommits any of the following acts after being disciplined or incurring an administrative Criminalty:
|
A warning, a fine of from VND 20,000,000 to VND 50,000,000 or a Criminalty of up to 03 years’ community sentence | The offender may also be liable to a fine of from VND 5,000,000 to VND 20,000,000, be prohibited from holding certain positions for 01 – 05 years |
Committ the above violations (Article 159.1 of the 2015 Criminal Code) and fall into one of the following cases:
|
P prison from 01 year to 03 years |
2.2. Infringement upon freedom of speech, freedom of the press, the right of access to information, and the right to protest of citizens (Article 167 of the 2015 Criminal Code)
The law on personal data protection stipulates the right to be provided with personal data upon the request of the Data Subject.1Accordingly, individuals or organizations obstructing a Data Subject from exercising this right may be subject to criminal prosecution for the crime of infringing upon access to information. Specifically as follows:
| Violating Act | Sanction | Other notes (if any) |
| The Offender uses violence, threat to use violence, or other tricks to obstruct a citizen from exercising his/her right of access to information despite the fact that he/she was disciplined or incurred a civil penalty for the same offence | A penalty of up to 02 year’s community sentence or 03 – 24 months’ imprisonment | Offender might be forbidden from holding certain positions for 01 – 05 years. |
Committ the above violations (Article 167.1 of the 2015 Criminal Code) and fall into one of the following cases:
|
A penalty of 01 – 05 years’ imprisonment |
2.3. Obstruction or disturbance of computer networks, telecommunications networks, or electronic devices (Article 287 of the 2015 Criminal Code)
The law on personal data protection stipulates that the storage, deletion, or destruction of personal data shall be carried out upon the request of the Data Subject or as prescribed by law.2 Accordingly, acts of arbitrarily deleting, damaging, or altering electronic data, or illegally preventing the transmission of data of computer networks, telecommunications networks, or electronic means may be subject to criminal prosecution as stipulated in Article 287 of the 2015 Criminal Code. Specifically as follows:
| Violating Act | Sanction | Other notes (if any) |
| Any person or organization who deletes, damages, or changes a software program or electronic data, or illegally obstructs the transmission of data of a computer network, telecommunications network, or an electronic device, or otherwise obstructs or disturbs a computer network, telecommunications network, or an electronic device in any of the following cases, except for the cases in Article 286 and Article 289 hereof :
|
A fine of from VND 30,000,000 to VND 200,000,000 or a penalty of 06 – 36 months’ imprisonment | The offender might also be liable to a fine of from VND 30,000,000 to VND 200,000,000 or prohibited from holding certain positions or doing certain jobs for 01 – 05 years. |
Committ the above violations (Article 287.1 of the 2015 Criminal Code) and fall into one of the following cases:
|
A fine of from VND 200,000,000 to VND 1,000,000,000 or a penalty of 03 – 07 years’ imprisonment |
|
Committing the above violations (Article 287.1 of the 2015 Criminal Code) and falling into one of the following cases:
|
A penalty of 07 – 12 years’ imprisonment |
2.4. Illegal provision or use of information on computer networks or telecommunications networks (Article 288 of the 2015 Criminal Code)
The law on personal data protection strictly prohibits the illegal trading of personal data.3 Concurrently, personal data may only be rectified upon the request of the Data Subject or as prescribed by law.4 Accordingly, the act of illegally trading personal data may be subject to criminal prosecution for the Crime of illegally providing or using information on computer networks or telecommunications networks under Article 288 of the 2015 Criminal Code. Specifically as follows:
The law on personal data protection strictly prohibits the illegal trading of personal data.3 Concurrently, personal data may only be rectified upon the request of the Data Subject or as prescribed by law.4 Accordingly, the act of illegally trading personal data may be subject to criminal prosecution for the Crime of illegally providing or using information on computer networks or telecommunications networks under Article 288 of the 2015 Criminal Code. Specifically as follows:
| Violating Act | Sanction | Other notes (if any) |
| Commits any of the following acts and earns an illegal profit of from VND 50,000,000 to under VND 200,000,000 or causes property damage of from VND 100,000,000 to under VND 500,000,000 or damages reputation of an organization or individual:
|
A fine of from VND 30,000,000 to VND 200,000,000 or face a penalty of up to 03 years’ community sentence or 03 – 36 months’ imprisonment |
The offender might also be liable to a fine of from VND 20,000,000 to VND 200,000,000 or prohibited from holding certain positions or doing certain jobs for 01 – 05 years |
Committing a crime in one of the following cases :
|
A fine of from VND 200,000,000 to VND 1,000,000,000 or a penalty of 02 – 07 years’ imprisonment |
2.5. Illegal infiltration into the computer network, telecommunications network, or electronic device of another person (Article 289 of the 2015 Criminal Code)
The law on personal data protection stipulates that individuals and organizations involved in processing personal data must implement technical measures such as warnings, access codes, firewalls, etc., to ensure information safety for collected, stored, and processed personal data. Acts such as bypassing warnings, access codes, firewalls, using another person’s administrative rights, or by other means illegally accessing computer networks, telecommunications networks, or electronic means of others to appropriate control; interfering with the operational functions of electronic means; stealing, altering, destroying, or forging data, or illegally using services may be subject to criminal prosecution for the Crime of illegally accessing computer networks, telecommunications networks, or electronic means of others under Article 289 of the 2015 Criminal Code. Specifically as follows:
| Violating Act | Sanction | Other notes (if any) |
| Any person or organization who deliberately bypasses the warning, hacks the password or firewall, or uses the administrator’s right of another person to infiltrate another person’s computer network, telecommunications network, or electronic device in order to take control, interfere the operation of the electronic device; steal, change, destroy, fabricate data or illegally use services. |
A fine of from VND 50,000,000 to VND 300,000,000 or face a penalty of 01 – 05 years’ imprisonment |
The offender might also be liable to a fine of from VND 5,000,000 to VND 50,000,000 or prohibited from holding certain positions or doing certain jobs for 01 – 05 years . |
This offence committed in any of the following cases:
|
A fine of from VND 300,000,000 to VND 1,000,000,000 or a penalty of 03 – 07 years’ imprisonment |
|
This offence committed in any of the following cases:
|
A penalty of 07 – 12 years’ imprisonment |
2.6. Illegal collection, storage, exchanging, trading, publishing of information about bank accounts (Article 291 of the 2015 Criminal Code)
The law on personal data protection stipulates that establishing software systems, technical measures, or organizing activities for collecting, transferring, buying, or selling personal data without the consent of the data subject is a violation of the law. In the banking and finance sector, illegally collecting, storing, exchanging, trading, or publicizing information on bank accounts of others may be subject to criminal prosecution for the Crime of illegally collecting, storing, exchanging, trading, or publicizing information on bank accounts under Article 291 of the 2015 Criminal Code. Specifically as follows:
| Violating Act | Sanction | Other notes (if any) |
| Any person or organization who illegally collects, stores, exchanges, trades, publishes information about other people’s bank accounts with a quantity of 20 – 49 accounts or earns an illegal profit of from VND 20,000,000 to under VND 50,000,000 |
A fine of from VND 20,000,000 to VND 100,000,000 or a penalty of up to 03 years’ community sentence |
The offender might also be liable to a fine of from VND 10,000,000 to VND 50,000,000 or prohibited from holding certain positions or doing certain jobs for 01 – 05 years or have part or all of his/her property confiscated. |
This offence was committed in any of the following cases:
|
A fine of from VND 1000,000,000 to VND 200,000,000 or a penalty of 03 – 24 months’ imprisonment |
|
This offence committed in any of the following cases:
|
A fine of from VND 200,000,000 to VND 500,000,000 or a penalty of 02 – 07 years’ imprisonment |
(1) Article 14 of Decree 13/2023/ND-CP; Article 16 of Draft Law on Personal Data Protection.
(2) Article 16 of Decree 13/2023/ND-CP; Article 18 of Draft Law on Personal Data Protection.
(3) Article 3.4 of Decree 13/2023/ND-CP; Article 7.5 of Draft Law on Personal Data Protection.
(4) Articles 15 and 16 of Decree 13/2023/ND-CP; Articles 17 and 18 of the Draft Law on Personal Data Protection.
Related posts
- Notification of personal data protection violation
- The connection between ESG and personal data protection in the digital age
- Shape Personal data protection organization services under the draft law on personal data protection
Disclaimers:
This article is for general information purposes only and is not intended to provide any legal advice for any particular case. The legal provisions referenced in the content are in effect at the time of publication but may have expired at the time you read the content. We therefore advise that you always consult a professional consultant before applying any content.
For issues related to the content or intellectual property rights of the article, please email cs@apolatlegal.vn.
Apolat Legal is a law firm in Vietnam with experience and capacity to provide consulting services related to Data and contact our team of lawyers in Vietnam via email info@apolatlegal.com.
