Vietnam: Experts Propose Collective Lawsuits for Personal Data Violations

Ho Chi Minh City University of Law recently hosted an international conference focused on the critical issue of personal data protection in the digital age. The event brought together a diverse group of legal experts, government representatives, and industry professionals to grapple with the evolving challenges of safeguarding sensitive information.

“

How to protect personal data effectively?

A key takeaway from the discussions was the urgent need to bolster Vietnam's legal arsenal against data privacy violations. Scholars like Dr. Tran Thanh Thao pointed out the glaring absence of specific criminal offenses for data-related crimes, contrasting it with the existing nine distinct offenses in the Penal Code. The proposed solution involves creating new provisions that encompass the entire data lifecycle, from collection to destruction, and shifting the focus from consequences to the inherent danger of the act itself.

Further underscoring the legislative gaps, Dr. Tran Thi Thu Ha highlighted the lack of a dedicated decree for administrative penalties concerning personal data breaches. Current regulations are scattered and often subsumed under the broader concept of "personal information." This fragmentation hinders effective enforcement and leaves individuals with limited recourse.

“

In Vietnam, there are no specific criminal charges for personal data, while the current Penal Code already stipulates 9 separate criminal offenses.

From an international perspective, Associate Professor Phan Hoai Nam suggested improvements in damage assessment and expanding the liability of data controllers and processors. Crucially, the conference emphasized the need for a more robust mechanism for data subjects themselves. Associate Professor Nguyen Thi Phuong Hoa advocated for an independent body to handle collective lawsuits, recognizing that individual damages are often too small to warrant separate legal action. Furthermore, data subjects should have the right to be directly informed about breaches and the remedial measures taken, rather than relying solely on state agencies.

“

Vietnam does not yet have a specific decree on administrative sanctions for violations of personal data.

This conference signifies a proactive step by Vietnam's legal community to align its data protection framework with international standards and address the practical realities faced by citizens in an increasingly digital world. The call for collective litigation and direct notification rights reflects a growing understanding that effective data protection requires empowering individuals and establishing clear, enforceable legal consequences for violations.

“

It is necessary to build an independent mechanism for collective lawsuits in the face of data violations that often affect many people, while the damage to each person is difficult to determine and not large enough to sue individually.