INTRODUCTION

In the context of the Fourth Industrial Revolution, personal data has become a highly valuable economic asset. Commercial companies, digital platforms, mobile applications, and other online service providers frequently exploit user data for advertising, market research, or data-sharing purposes with third parties.

However, the collection, exploitation, and sharing of personal data without explicit consent may constitute an infringement of users’ privacy rights. This raises the following legal question: How does Vietnamese law protect personal privacy in such circumstances, and can unauthorized exploitation of personal data be considered a violation of privacy rights?

This article analyzes the issue from a legal perspective based on the provisions of the Civil Code 2015, the Cybersecurity Law 2018, the Draft Law on Personal Data Protection 2023, and judicial guidelines issued by Vietnamese courts.

I. CONCEPT OF PRIVACY RIGHTS AND PERSONAL DATA

1. Personal Privacy Rights

Pursuant to Article 32 of the 2013 Constitution:

“Citizens shall enjoy the inviolability of their body, health, honor, dignity, reputation, and private life secrets.”

According to Article 21 of the Civil Code 2015:

“Personal rights of individuals include rights relating to honor, dignity, reputation, private life secrets, images, voice, and other privacy rights.”

Accordingly, personal privacy rights are recognized and protected under Vietnamese law, and any infringement thereof must be based on legal grounds or the consent of the concerned individual.

2. Personal Data

According to Article 4 of the Draft Law on Personal Data Protection 2023:

“Personal data means any information relating to an identified or identifiable individual.”

Examples include:

• full name, telephone number, email address, and residential address;
• consumer behavior information, location data, and shopping habits;
• medical records, personal images, and videos.

II. ACTS CONSTITUTING PRIVACY INFRINGEMENT THROUGH UNAUTHORIZED COMMERCIAL DATA EXPLOITATION

1. Legal Basis

a. Civil Code 2015

• Article 132: Rights relating to private life secrets and personal data shall not be infringed;
• Article 624: Liability for damages arising from infringement of personal rights.

b. Cybersecurity Law 2018

• Article 19: Prohibits unlawful collection and use of personal data;
• Article 25: Requires organizations and enterprises to ensure confidentiality of users’ personal information.

c. Draft Law on Personal Data Protection 2023

• Article 15: Explicit consent must be obtained prior to collecting, storing, or sharing personal data;
• Article 23: Victims of data infringement have the right to request deletion of data and compensation for damages.

2. Common Acts of Privacy Infringement

• Collecting personal data without transparency or without notifying users;
• Sharing personal data with third parties without specific consent;
• Using personal data for advertising or behavioral analysis without users’ knowledge.

Such acts may be deemed violations of privacy rights, constitute breaches of civil obligations, and may result in administrative sanctions or criminal liability.

3. Legal Liability

a. Civil Liability

Pursuant to Article 605 of the Civil Code 2015, individuals or organizations infringing privacy rights must:

• cease the infringing acts;
• restore the original condition;
• compensate for material and moral damages.

b. Administrative Liability

According to Article 102 of the Cybersecurity Law 2018:

• A fine ranging from VND 5 million to VND 10 million may be imposed for unlawful collection or exploitation of personal data;
• Violators may also face suspension or revocation of business or service licenses.

c. Criminal Liability

Pursuant to Article 159 of the Criminal Code 2015 (amended in 2017) regarding the “Offense of Infringing Personal Secrets”:

• offenders may be subject to fines or non-custodial reform;
• serious offenses causing substantial consequences may result in imprisonment.

III. DETAILED LEGAL ANALYSIS

1. Explicit Consent Is Mandatory

Without explicit consent, the use of personal data for commercial purposes constitutes an infringement of privacy rights and may give rise to civil, administrative, or criminal liability.

2. Parallel Legal Enforcement

For example, if Company A sells user data to Company B:

• Civil liability: users may claim damages and request termination of data usage;
• Administrative liability: regulatory authorities may impose fines or suspend business operations;
• Criminal liability: if the conduct causes serious consequences, criminal prosecution may be initiated.

3. Practical Enforcement

In practice:

• courts generally prioritize civil remedies to protect victims’ interests;
• administrative authorities handle sanctions against violating enterprises;
• criminal liability is usually imposed only where intentional appropriation or serious consequences are established.

IV. RECOMMENDATIONS FOR IMPROVING THE LEGAL FRAMEWORK

• Clarify lawful mechanisms for personal data collection;
• Introduce clearer provisions regarding concurrent civil, administrative, and criminal liability;
• Strengthen regulations concerning compensation for emotional and moral damages;
• Enhance awareness campaigns and guidance for enterprises and users regarding privacy rights and explicit consent requirements.

📞 CONTACT LEGAL CONSULTANT:

TLA Law is a leading law firm with a team of highly experienced lawyers specializing in criminal, civil, corporate, marriage and family law, and more. We are committed to providing comprehensive legal support and answering all your legal questions. If you have any further questions, please do not hesitate to contact us.

1. Lawyer Vu Thi Phuong Thanh, Ha Noi Bar Association

Email: vtpthanh@tlalaw.vn

2. Lawyer Tran My Le, Ha Noi Bar Association

Email: tmle@tlalaw.vn

Khuong Ngoc Lan