Personal data means the information related to the data subject. Several evildoers take advantage of loopholes in information security, infringing on personal data, and directly affecting the legitimate rights and interests of data subjects. Therefore, personal data processing as well as personal data protection are essential. Together with Apolat Legal, let’s find out some issues about personal data and personal data protection, in which case personal data processing can be done with the consent of the data subject.
1. Which information can be considered as personal data?
According to Clause 1, Article 2 Decree 13/2023/ND-CP regulates:
“Personal data means any information in the forms of symbols, letters, figures, images, sounds, or similar forms in the electronic environment that is associated with a particular person or may lead to the identification of a particular person. Personal data includes basic personal data and sensitive personal data”
Accordingly, the information in the forms of symbols, letters, figures, images, sounds, or similar forms in the electronic environment that is associated with a particular person or may lead to the identification of a particular person can be considered personal data.
2. Types of personal data
Personal data including basic personal data and sensitive personal data:
2.1 Ordinary personal data
Ordinary personal data is also considered basic personal data according to Clause 3 Article 2 of Decree 13/2023/ND-CP, then basic personal data including:
+ Family name, middle name, and first name as stated in a birth certificate, other name (if any);
+ Date of birth; date of death or missing;
+ Gender;
+ Place of birth, place of birth registration, place of permanent residence, place of temporary residence, current place of residence, native place, contact address;
+ Nationality;
+ Image of the individual;
+ Telephone numbers, people’s identity card numbers, personal identification numbers, passport numbers, driver’s license numbers, numbers on vehicles’ number plates, personal tax identification numbers, social insurance numbers, health insurance card numbers;
+ Marital status;
+ Information about family relationships (parents, children);
+ Information about the digital account of the individual; personal data on activities, history of activities in cyberspace;
+ Other information associated with a particular person or leading to the identification of a particular person, other than those specified in Clause 4 Article 2 Decree 13/2023/ND-CP
As such, personal data includes the above-mentioned data.
2.2 Sensitive personal data
According to Clause 4 Article 2 Decree 13/2023/ND-CP:
Sensitive personal data means any personal data associated with an individual’s privacy rights of which the violation directly affects the individual’s lawful rights and interests according to Clause 4 Article 2 Decree 13/2023/ND-CP, including:
+ Political opinions, religious opinions;
+ Health status and private information recorded in the health record, excluding information about blood type;
+ Information relating to racial origin, ethnic origin;
+ Information about the inherited or acquired genetic characteristics of the individual;
+ Information about physical characteristics, and unique biological characteristics of the individual;
+ Information about sex life and sexual orientation of the individual;
+ Data on crimes and offenses are collected and stored by law enforcement authorities;
+ Client information of credit institutions, foreign bank branches, intermediary payment service providers, and other authorized organizations, including client identification information prescribed by law provisions, information on accounts, deposits, deposited assets, transactions, organizations and individuals being securing parties at credit institutions, bank branches, intermediary payment service providers;
+ Location data of the individual identified through location services;
+ Other personal data being particular and requiring necessary security measures under law provisions.
As such, sensitive personal data includes the above-mentioned data.
3. What is personal data processing?
Personal data processing means one or more operations that are performed on personal data, such as collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, retrieval, withdrawal, encryption, decryption, copy, sharing, transmission, provision, transfer, erasure, destruction of personal data or other relevant operations under Clause 7 Article 2 Decree 13/2023/ND-CP.
4. The request for the data subject’s consent when processing the personal data
Consent of the data subject means any freely given and unambiguous indication of the data subject, signifies agreement to the personal data processing relating to them.
Pursuant to Article 11 Decree 13/2023/ND-CP regulate the consent of the data subject as follows:
– Consent of the data subject shall apply to all activities of the personal data processing procedure unless otherwise provided by law.
– The data subject’s consent is only valid when the data subject voluntarily consents and becomes acutely conscious of the following contents:
+ Categories of personal data to be processed;
+ Purposes of personal data processing;
+ Organizations, individuals allowed to process personal data;
+ Rights and obligations of the data subject.
– The data subject’s consent must be expressed clearly, specifically in writing, by voice, by checking the consent box, sending the consent syntax, selecting consent technical settings, or another action demonstrating such consent.
– Consent must be made for the same purpose. In cases of multiple purposes, the controller, controlling, and processing entity shall list the purposes in order that the data subject agrees to the stated purpose(s).
– The data subject’s consent must be expressed in a format that can be printed, and reproduced in writing, including electronic or verifiable formats.
– The silence or non-response from the data subject is not considered consent.
– The data subject may give a partial consent or a conditional consent.
– In cases of processing of sensitive personal data, the data subject must be informed that the data to be processed is sensitive personal data.
– The data subject’s consent shall be valid until the data subject makes a different decision or until the competent agency makes a request in writing.
– In the event of a dispute, the responsibility for proving the data subject’s consent shall be borne by the controller, controlling and processing entity.
– Organizations and individuals may, by the authorization under the Civil Code, on behalf of the data subject, carry out procedures related to the processing of personal data of the data subject with the controller, controlling and processing entity, in case the data subject knows and consents to it as prescribed in Clause 3 of this Article unless otherwise provided by law.
5. The case of personal data processing without consent of the data subject
Pursuant to Article 17 Decree 13/2023/ND-CP, the case of personal data processing without consent of the data subject includes:
One, in urgent cases, it is necessary to immediately process relevant personal data to protect the life and health of the data subject or others. The controller, processor, controlling and processing entity, and the third party shall be responsible for proving this case.
Two, the disclosure of personal data shall comply with the law.
Three, the processing of data of the competent state agencies in case of emergency on national defense, national security, social order and safety, major disasters, dangerous epidemics; or when there is a risk of threatening security and national defense but not to the extent of declaring a state of emergency; or in case of preventing and combating riots and terrorism, preventing and combating crimes and law violations in accordance with law.
Four, to fulfill the contractual obligations of the data subject with relevant agencies, organizations, and individuals as prescribed by law.
Five, to serve the activities of state agencies prescribed by specialized laws.
6. Apolat Legal consults about collecting, and processing personal data
With a team of professional staff, having extensive experience in legal fields. Legal consultancy related to collecting, and processing personal data activities at Apolat Legal shall be beneficial to clients as:
+ Update the latest regulations collecting, and processing personal data activities;
+ Consult the client about efficient legal and technical solutions to satisfy the provision of the law while guaranteeing the optimal operation of the enterprises.
The above is an article about cases of processing personal data without the consent of the data subject. Hope to help you with useful legal knowledge. If you still have questions, that need to be answered, especially personal data issues, do not hesitate to contact Apolat Legal immediately for the best consultation and support.
Disclaimers:
This article is for general information purposes only and is not intended to provide any legal advice for any particular case. The legal provisions referenced in the content are in effect at the time of publication but may have expired at the time you read the content. We therefore advise that you always consult a professional consultant before applying any content.
For issues related to the content or intellectual property rights of the article, please email cs@apolatlegal.vn.
Apolat Legal is a law firm in Vietnam with experience and capacity to provide consulting services related to Intellectual Property Rights and contact our team of lawyers in Vietnam via email info@apolatlegal.com.
