In the digital era, personal data has become a valuable asset while also posing significant risks if not properly protected. When personal data is infringed upon, data subjects have the right to claim compensation for damages in accordance with the law. This article analyzes the current legal framework governing non-contractual damages arising from personal data violations in Vietnam.
I. Legal Basis for Non-Contractual Damages Arising from Personal Data Violations
The primary legal grounds for claiming compensation when personal data is violated include:
- The 2015 Civil Code (Civil Code 2015): This provides general regulations on non-contractual liability for damages. Specifically, Article 584 of the Civil Code 2015 stipulates that: “Any person who infringes upon the life, health, honor, dignity, reputation, property, lawful rights, or other lawful interests of another person and causes damage must provide compensation, except where otherwise provided by this Code or other relevant laws.”
- Government Decree No. 13/2023/ND-CP on Personal Data Protection (Decree 13/2023/ND-CP): This is Vietnam’s first specialized legal instrument comprehensively regulating personal data protection and the responsibilities of relevant parties. Clause 10, Article 9 of Decree 13/2023/ND-CP expressly provides: “Data subjects have the right to request compensation for damages in accordance with the law when violations of personal data protection regulations occur, except where otherwise agreed by the parties or otherwise prescribed by law.”
II. Conditions Giving Rise to Non-Contractual Liability for Damages
Non-contractual liability for damages arises when all of the following conditions are satisfied:
1. Illegal Acts Infringing Personal Data
This refers to acts of personal data processing—including collection, storage, exploitation, use, transfer, purchase, sale, or destruction—that violate the will of the data subject and legal regulations. Such acts may include collecting or processing personal data without the data subject’s consent, processing data for improper purposes, or failing to implement necessary security measures, thereby causing data leakage or loss.
2. Actual Damage Occurs
Damage refers to actual material or emotional losses suffered by the affected individual as a result of the unlawful act.
3. Causal Relationship Between the Infringing Act and the Damage
The damage must be the inevitable consequence of the personal data infringement, and conversely, the infringement must be the direct cause of the damage.
III. Types of Compensable Damages
When personal data is violated, data subjects may request compensation for the following damages:
1. Material Damages
- Reasonable costs incurred to prevent, mitigate, and remedy damages: Including actual expenses incurred to restore data, handle incidents, and remedy consequences arising from data loss.
- Actual lost or reduced income: Where the loss of personal data disrupts business operations, reduces revenue, or causes loss of income opportunities.
- Property losses: Including the value of assets lost, destroyed, or infringed upon in connection with data loss, particularly where the data is associated with economically valuable assets.
- Other provable material damages: Including actual damages arising after the compensation request is made.
2. Emotional and Mental Damages
Compensation for emotional damages shall be determined by agreement between the parties. If no agreement can be reached, the maximum compensation amount shall not exceed ten times the statutory base salary as prescribed under Article 592 of the Civil Code 2015.
Emotional damages are understood as adverse impacts on the honor, dignity, reputation, or psychological and emotional well-being of the injured party.
IV. Principles of Compensation for Damages
Pursuant to Article 585 of the Civil Code 2015, the principles governing non-contractual compensation for damages include:
- Actual damages must be compensated fully and promptly.
- The parties may agree on the compensation amount, forms of compensation (money, property, or performance of certain acts), and methods of payment (one-time or multiple installments), except where otherwise prescribed by law.
- Where the injured party is partially at fault for causing the damage, compensation shall not be granted for the portion attributable to their own fault.
- If the party causing the damage is not at fault, compensation is generally not required. However, in certain circumstances, liability for damages may still arise even in the absence of fault, unless otherwise agreed by the parties or provided by law.
V. Procedures for Claiming Compensation for Damages
To claim compensation when personal data is infringed, data subjects may follow these steps:
1. Collect and Record Evidence
This is a crucial step in proving both the violation and the resulting damages. Evidence should be preserved and, where appropriate, formally documented.
2. Submit a Compensation Request Directly to the Violating Party
The data subject may send a written compensation request clearly stating the damages incurred and the amount claimed.
3. File Complaints or Reports with Competent State Authorities
If the violating party fails to cooperate or resolve the matter satisfactorily, the data subject may submit complaints or denunciations to competent authorities such as the Department of Cybersecurity and High-Tech Crime Prevention (A05) under the Ministry of Public Security.
4. Initiate Legal Proceedings Before a Competent Court
If the above measures do not achieve satisfactory results, the data subject has the right to initiate a civil lawsuit before a competent court to request compensation for damages. The statute of limitations for filing a compensation claim shall be determined in accordance with the Civil Code and other relevant legal regulations.
CONTACT LEGAL CONSULTANT:
TLA Law is a leading law firm with a team of highly experienced lawyers specializing in criminal, civil, corporate, marriage and family law, and more. We are committed to providing comprehensive legal support and answering all your legal questions. If you have any further questions, please do not hesitate to contact us.
1. Lawyer Vu Thi Phuong Thanh, Ha Noi Bar Association
Email: vtpthanh@tlalaw.vn
2. Lawyer Tran My Le, Ha Noi Bar Association
Email: tmle@tlalaw.vn
Nguyen Thuy Duong