CIRCUMSTANCES THAT THE PERSONAL DATA SHALL NOT BE DELETED AT THE REQUEST OF THE DATA SUBJECT

1. Legal basis

- Decree 13/2023/ND-CP

2. What is personal data?

According to Clause 1, Article 2 of Decree 13/2023/ND-CP, Personal data refers to electronic information in the form of symbols, letters, numbers, images, sounds, or equivalences associated with an individual or used to identify an individual.

The personal data includes general personal data and sensitive personal data. Specifically,

General personal data includes:

• Last name, middle name and first name, other names (if any);
• Date of birth; date of death or going missing;
• Gender;
• Place of birth, registered place of birth; place of permanent residence; place of temporary residence; current place of residence; hometown; contact address;
• Nationality;
• Personal image;
• Phone number; ID Card number, personal identification number, passport number, driver’s license number, license plate, taxpayer identification number, social security number and health insurance card number;
• Marital status;
• Information about the individual’s family relationship (parents, children);
• Digital account information; personal data that reflects activities and activity history in cyberspace;

Information associated with an individual or used to identify an individual other than that specified at Clauses 2 of Article 2 Decree 13/2023/ND-CP

Sensitive personal data is personal data associated with an individual's privacy rights that, when violated, will directly affect the individual's legitimate rights and interests as stipulated in Clauses 3 and 4 of Article 2 Decree 13/2023/ND-CP:

• Political and religious opinions;
• Health condition and personal information stated in health record, excluding information on blood group;
• Information about racial or ethnic origin;
• Information about genetic data related to an individual's inherited or acquired genetic characteristics;
• Information about an individual’s own biometric or biological characteristics;
• Information about an individual’s sex life or sexual orientation.
• Data on crimes and criminal activities collected and stored by law enforcement agencies;
• Information on customers of credit institutions, foreign bank branches, payment service providers and other licensed institutions, including: customer identification as prescribed by law, accounts, deposits, deposited assets, transactions, organizations and individuals that are guarantors at credit institutions, bank branches, and payment service providers;
• Personal location identified via location services;
• Other specific personal data as prescribed by law that requires special protection.

3. Cases where personal data cannot be deleted upon request

According to the regulations, data subjects are entitled to delete or request deletion of their personal data, unless otherwise provided by law. However, deletion of personal data will not apply when requested by the data subject in the cases specified in Clause 2, Article 16 of Decree 13/2023/ND-CP:

• The deletion of personal data is prohibited by law;
• The personal data is processed by the competent state agency with a view to serving operations by such agency as prescribed by law.
• The personal data has been disclosed as prescribed by law.
• The personal data is processed with a view to serving law, scientific research and statistics as prescribed by law;
• The personal data shall not be deleted in the event of a state of emergency on national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a risk of threatening security and national defense but not to the extent of declaring a state of emergency; to prevent and combat riots and terrorism, to prevent and combat crimes and law violations according to regulations of law;
• It is required to respond to emergent cases that threaten the life and health or the safety of the data subject or other persons.

The above are general cases of not deleting personal data upon request. However, determining specific cases requires considering each case individually and complying with the law to ensure reasonableness and protect the rights of users.

----------

For more information, please contact:

Hoang Pham (James) / Managing Partner at: hoang.pham@vselawyers.com

© 2023 VSE LAWYERS LIMITED LIABILITY LAW COMPANY – All rights reserved.

Attention: This legal update is not an advice and should not be treated as such.