Vietnam

Vietnam has no comprehensive personal data protection laws. On November 11, 2010, it passed the Consumer Protection Law which becomes effective July 1, 2011.

Under the new law, consumers have the right to have their information protected and kept secret when they participate in business transactions or use goods and services. Consumer information can be disclosed only at the request of competent authorities.

If business entities want to collect, use and transfer information about consumers, they must:

• expressly and publicly inform consumers about the purpose of the collection and use of their information before actually collecting, using and transferring such information;
• use information about consumers only for the stated purpose;
• obtain consent from consumers before using their information;
• ensure the secrecy, accuracy and completeness of consumer information during collection, use and transfer;
• update and correct information or have a mechanism allowing consumers to update and correct information when it is discovered that such information is not accurate; and
• obtain consumers' consent before transferring their information to a third party, except in cases where the law provides otherwise.

The new law does not define consent, consumer information or personal information.

“Consumer Information” and “Personal Information” – they are not defined in the new law.

Personal Information from websites: the receipt and use of personal information on e-commerce websites must comply with the following requirements:

• There must be clearly publicized or supplied on the homepage a mechanism for customers to access and inquire into policies on the protection of personal information on such websites.
• The receipt and use of each customer's personal information must be consented to by each customer, unless otherwise provided for by law.
• A customer's consent must be obtained through a separate step so that the customer may opt to accept or refuse (an opt-out mechanism is not sufficient). A definitive consent mechanism must not be established for customers.