The
2013
e-‐commerce
Decree
In summary, the protection of data privacy in Vietnam first occurred through a number of ecommerce,
IT and consumer laws enacted by the National Assembly, the highest source of law in
Vietnam. The 2013 Decree is made by the Government pursuant to both the IT and Consumer Laws
(and other laws), and is what in some other countries would be considered a regulation, although
one made by the government as a whole, not one made by a Ministry.
Under the IT law, the Ministry of Post and Telematics has the prime responsibility, but this Decree
gives the implementation responsibility to the Ministry of Industry and Trade (MoIT), which is
responsible for the Consumer Law. Although Decree 52 therefore seems to state that Industry and
Trade now has the responsibility for data privacy in Vietnam (at least in relation to all forms of
consumer-oriented business), local experts point out 11 that the new Decree 72 on Internet
management imposes the obligation to implement this broader decree on internet management onto
the Ministry of Information and Communication (MoIC), and consider that this is likely to spill
over into the data privacy aspects of Decree 72 as well. Article 2.2 of Decree 52 requires MoIT to
coordinate with MoIC.
Decree 52 defines e-commerce activity broadly, as the conducting of any part of commercial
activities ‘by electronic means connected to the Internet, mobile telecommunications network or
other open networks’ (A 3(1)). ‘Personal information’ is defined as ‘the information contributing to
identify a specific individual, including his/her name, age, home address, phone number, medical
information, account number, information on personal payment transactions and other information
that the individual would like to keep confidential’ but ‘does not include work contact information
and other information that the individual has published himself on mass media’ (A 3(13)).
Collection of personal information is also defined as ‘the collection of information to put it into a
database’ (A 3(14.)).
The scope of the Decree limits it to those businesses ‘involved in e-commerce activity in Vietnam’s
territory,’ including ‘foreign individuals residing in Vietnam’ and ‘foreign traders and organizations
with their presence in Vietnam through investment operation, establishment of branches and
representative offices or website set-up under Vietnamese domain name’ (A 2(1)). So some extraterritorial
activities may be subject to the law, but the requirement of ‘e-commerce activity in
Vietnam’s territory’ must still be satisfied. Decree 52 grants MoIT and MoIC authority to adopt
separate regulations for purely foreign players conducting e-commerce with Vietnamese counterparties,
although local experts note that it is not yet clear when these will be adopted.12 Where a data controller authorises a third party (‘processor’) to collect personal information, there
must be an agreement between the parties specifying which has responsibility for compliance with
the various obligations of the Decree, and if they do not then both will be liable (A 68(2)).
One of the ‘prohibited acts in e-commerce activities’ is ‘stealing, using, disclosing, transferring and
selling information related to business secrets of other traders, organizations or individuals or
personal information of consumers in e-commerce without the consent of the parties concerned,
unless otherwise regulated by law’ (A 4(4)(a)).