CIRCUMSTANCES THAT CAN PROCESS PERSONAL DATA WITHOUT CONSENT

1. Legal basis

• Decree 13/2023/ND-CP

2. What is personal data?

Pursuant to Clause 1, Article 2 of Decree 13/2023/ND-CP interpret as follow:

“Personal data refers to electronic information in the form of symbols, letters, numbers, images, sounds, or equivalences associated with an individual or used to identify an individual. The personal data includes general personal data and sensitive personal data.”

Thus, personal data is information in the form of symbols, letters, numbers, images, sounds or similar forms in the digital environment that is associated with a specific person or helps identify a person. Personal data includes basic personal data and sensitive personal data.

3. Circumstances that can process personal data without consent

Pursuant to the provisions of Article 17 of Decree 13/2023/ND-CP, the cases where personal data is processed without the consent of the data subject are:

• The personal data shall be processed to protect the life and health of the data subject or others in an emergency situation. The Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party shall be responsible for proving such situation.
• Disclosure of personal data in accordance with the law;
• Processing of personal data by competent regulatory authorities in the event of a state of emergency regarding national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a threat to security and national defense but not to the extent of declaring a state of emergency; to prevent and fight riots and terrorism, crimes and law violations according to the provisions of law;
• The personal data shall be processed to fulfill obligations under contracts the data subjects with relevant agencies, organizations and individuals as prescribed by law;
• The personal data shall be processed to serve operations by regulatory authorities as prescribed by relevant laws.

The above are circumstances that can process personal data without consent of the data subject. However, the right of However, the right privacy and protection of personal data still needs to be observed and protected. Data processors must ensure that personal information is processed lawfully and securely. Processing of personal data without the consent of the data subject is an exception and should be applied responsibly and in accordance with the law.

----------

For more information, please contact:

Hoang Pham (James) / Managing Partner at: hoang.pham@vselawyers.com

© 2023 VSE LAWYERS LIMITED LIABILITY LAW COMPANY – All rights reserved.

Attention: This legal update is not an advice and should not be treated as such.