Vietnam may fine data violators up to $7,600

The draft reflects growing concern over the illegal collection, trading and misuse of data, particularly personal and sensitive information.

According to the ministry, recent investigations have uncovered hundreds of individuals and organizations involved in the sale of personal data.

The volume of illegally collected and traded data detected has reached thousands of gigabytes, including large amounts of internal and sensitive personal information.

The proposed decree aims to establish a strict, transparent and timely enforcement mechanism to address violations in data-related activities.

Fines for unlawful data collection and creation

As per Article 9 of the draft decree, fines ranging from VND20 million (US$760) to VND40 million ($1,520) are proposed for acts such as collecting or creating data without the consent of the data subject or data owner, or without a clear legal basis.

This penalty level would also apply to acts that distort the origin, timing or content of original data.

Other violations in this group include the creation of fake or untruthful data; collecting data without a clear purpose; failure to notify or register with competent agencies as required; using fraudulent or deceptive methods to collect data; or failing to comply with officially prescribed data collection procedures.

More serious violations would be subject to fines ranging from VND40 million ($1,520) to VND70 million ($2,660).

These include collecting or creating data beyond the declared scope or purpose, actions affecting multiple agencies, organizations or individuals, or cases involving core data, important national data or sensitive data.

Penalties at this level would also apply where violations cause serious consequences, such as leaks of sensitive information, harm to legitimate rights and interests, or threats to national security.

Fines of up to $3,800 for refusal to provide data

Article 17 of the draft proposes fines of VND20-40 million ($760-1,520) for failing to provide data, or providing it late, to competent state agencies in cases where provision is mandatory by law.

Fines of VND40-80 million ($1,520-3,040) would apply to supplying incomplete data, incorrect data types, insufficient detail or volume, or data provided in a manner that does not meet lawful requirements.

This category also covers the provision of inaccurate or manipulated data, unjustified delays in data provision, or failure to notify authorities when data no longer exists or has been damaged or altered.

Notably, refusing to provide data when lawfully requested by competent authorities in situations specified by data regulations would result in proposed fines of VND80-100 million ($3,040-3,800).

The same penalty range would apply to acts such as concealing, destroying, erasing or falsifying data to evade lawful requests; abusing data provision or non-provision to obstruct state activities or seek illicit gain; disclosing state requests for data classified as official or state secrets; or knowingly providing fake or misrepresented data.

Sharing data involving state secrets may be fined up to $6,090

Article 14 of the draft focuses on violations in data connection and sharing.

Fines of VND30-60 million ($1,140-2,280) are proposed for connecting, sharing or providing data without approval from competent authorities or outside approved procedures.

This includes failures to ensure data safety and information security during data sharing or exploitation, as well as sharing data beyond permitted scope or purpose, or without the required consent of data subjects or owners.

Harsher fines of VND60-100 million ($2,280-3,800) would apply to failures to carry out mandatory data sharing within the political system, deliberate delays or obstruction of data sharing with the National Data Center or competent authorities, or providing data in incorrect formats or standards that hinder integration.

The most severe penalties in this section, ranging from VND100 million ($3,800) to VND160 million ($6,090), are proposed for unauthorized sharing or provision of core data, important data or national data, or sharing such data beyond the permitted purpose.

This also includes illegal sharing of data involving state secrets related to national defense, security or foreign affairs, as well as deliberate alteration, distortion or concealment of data during the sharing process.

Cross-border data violations: fines up to $7,600

For violations related to cross-border data transfer and processing, the Ministry of Public Security proposes the highest level of fines, from VND100 million ($3,800) to VND200 million ($7,600).

These would apply to the transfer or processing of core or important data across borders where such actions affect or pose risks to national defense, security, social order and safety, national or public interests, or the legitimate rights and interests of data subjects.

The same penalty range is proposed for abusing cross-border data activities to conceal illegal data transfers, evade data protection obligations, or commit other acts in violation of the law.