Businesses must not provide customers' information to third parties

On November 10, the National Payment Corporation of Vietnam (NAPAS) signed a cooperation agreement with Alipay, a subsidiary of Alibaba.

Though Alipay has not been licensed to operate in Vietnam as a payment intermediary, the move is considered the Chinese group’s first step to enter the Vietnamese online payment market.

Local newspapers recently reported that a domestic consultancy firm is supporting Ant Financial, the holding company of Alipay, to step up a deal with a Vietnamese fintech. All the moves show the great ambition of Alipay in Vietnam.

The participation of Alilpay or other foreign companies is considered good news to help develop the e-payment market, but this will pose problems for users’ information security.

The draft of the Cyber Security Law, compiled by the Ministry of Public Security, has not satisfied experts because the provisions cannot ensure the legal benefits of institutions and citizens in cyberspace.  

Dong from IPS said a big loophole exists in the draft law – the lack of provisions to protect Vietnamese users. He said there are two issues that need to be added to the draft law and both of them relate to personal information security.

First, the security of personal information such as emails, credit and health records, and second, false news and hatred speech. Dong emphasized the former issue.

He said the ownership of personal information belongs to users, not businesses. Therefore, it is necessary to stipulate that one must receive users’ consent before collecting and using their information. 

It is also necessary to include a provision on the right for information preservation if businesses are transferred to other investors.

When JoomlArt took over Gavick.com, it was told to receive technical solutions from Gavick only. 

As for the personal information that clients provided to Gavick, the new owner will be able to use the information once they have permission from the clients.

In Vietnam, current laws only have general regulations which require that businesses not provide users’ information to third parties.

Dong said that serious matters related to information ownership lead to questions. How will users’ information be protected if businesses to which users provide personal information are dissolved or join other businesses?

This may occur when foreign companies take over Vietnamese companies, and when they get data about Vietnamese users.

“If Alipay or any foreign company buys Vietnamese e-payment firms, they will have to collect information from users from the beginning,” he said.

RELATED NEWS

Cyber law balances security, information freedom

Draft cyber security law mismatches WTO rules

Buu Dien