Proposal to fine up to 50 million VND for storing personal data even though it has been requested to delete

The Ministry of Public Security has just submitted to the Government a draft Decree regulating penalties for administrative violations in the field of network security and personal data protection.

In which, in Article 62 of the draft, the drafting committee has proposed fines for violations of regulations on storing, deleting, and destroying personal data.

Clause 1 of Article 62 stipulates a fine of between 25,000 VND and 50,000 VND for one of the following acts:

Continue to store personal data when it is no longer consistent with the purpose of collection, when the data subject has withdrawn the consent or requested to delete or cancel its personal data;

Storage of personal data without a contract or without a document from a competent state agency stipulating the functions and tasks assigned in accordance with the storage of personal data;

Continue to process personal data when there is objection from the data subject and the Personal Data Controller, the Personal Data Control and Processing Party has no legitimate reason to continue processing personal data;

Data deletion must not be carried out within 2 working days after the request of the data subject with all personal data collected by the Personal Data Controller, the Personal Data Controller and Handling Agency, unless otherwise provided by law;

Clause 2 of the above article stipulates a fine of between 500,000 VND and 70,000 VND for one of the following acts:

Personal data is processed not in accordance with the agreed purpose or the processing of personal data is a violation of the provisions of law;

Do not delete personal data that is subject to deletion according to the provisions of law.

In addition to the fine level, the drafting committee mentioned additional penalties: Confiscation of exhibits and means of administrative violations for violations specified in clauses 1 and 2 of this Article; Suspension of personal data processing for a period of 01 month to 03 months for violations specified in clauses 1 and 2 of this Article.

Individuals and organizations are forced to cancel or delete to the point where personal data cannot be recovered for violations of the provisions of clauses 1 and 2 of this Article; Forced to change the purpose of using products, equipment, services, and software related to the storage, deletion, and cancellation of personal data;

Forced to return or force the return of illegal profits obtained from the act of violating the provisions of Clauses 1 and 2 of this Article; Publicly apologize in the mass media for the act of violating the provisions of Clauses 1 and 2 of this Article.

See the original here