Nowadays, personal data becoming a valuable resource in the digital age, the protection of user privacy is gaining increasing attention. To ensure safety and transparency in the collection process of personal data, the draft Personal Data Protection Law proposes strict regulations regarding the consent rights of data subjects. This right not only guarantees users’ autonomy in controlling their personal information but also imposes stringent legal requirements on organizations and individuals involved in data processing.

This article will analyze in detail the regulations concerning the consent rights of data subjects in the draft Law, helping to clarify the rights and responsibilities of the parties involved in today’s digital environment.

1. The consent of the data subject is mandatory

The draft Personal Data Protection Law emphasizes the crucial role of consent from data subjects in the process of handling personal data. This is a fundamental and mandatory principle to ensure users’ rights in today’s digital environment.

Consent is mandatory: The law stipulates that consent from the data subject is a prerequisite for all personal data processing activities, except in specific cases provided by law.

Validity of consent: Consent is only valid when the data subject voluntarily and fully understands the relevant factors, such as the type of data, purpose of processing, related organizations, and their rights.

No compulsory conditions: Organizations cannot require data subjects to consent to the transfer of personal data for purposes other than those initially disclosed. Data subjects have the right to refuse such requests.

Clear affirmative action: Consent must be expressed through specific actions, such as writing, speaking, selecting a consent checkbox, or responding via message, ensuring clarity and transparency.

Specific purposes: When processing data for multiple purposes, organizations must list each specific purpose so that data subjects can consent to each one individually.

Easy storage and verification: Consent must be able to be printed, copied, or stored in either written or electronic form to ensure transparency and easy verification.

No automatic consent: Silence or without response from the data subject shall not be considered as consent.

Partial or conditional consent: Data subjects have the right to provide partial consent or consent under certain conditions when providing personal data.

Sensitive data: When processing sensitive data, organizations must clearly inform data subjects so that they can decide whether to consent.

Validity of consent: Consent remains valid until the data subject changes their mind or until requested by an authorized governmental authority.

Responsibility of proof: In the case of a dispute, the responsibility to prove consent lies with the personal data controller.

Right to authorize: Data subjects can authorize an organization or individual representative to carry out procedures related to personal data processing, provided that they have been informed and have consented in advance.

Thus, the draft Personal Data Protection Law provides a comprehensive legal framework to protect users’ rights, ensuring that the consent of data subjects is always a core and mandatory element in all activities related to personal data. This is something enterprises need to pay attention to in order to ensure legality and transparency in handling the data of employees, customers, and users…

2. The Right to Withdraw Consent of Data Subjects

In the draft Personal Data Protection Law, Article 12 outlines specific provisions regarding the right of data subjects to withdraw their consent. This protects privacy and ensures transparency in the processing of personal data. Here are the key points regarding the withdrawal of consent:

Legality not affected: The withdrawal of consent does not affect the legality of data processing activities that were conducted based on prior consent. This ensures that data already processed will not be deemed unlawful.

Transparent format: Requests to withdraw consent must be made in a format that can be printed, copied in writing, including electronic formats or verifiable methods. This creates transparency and provides related parties with clear evidence when necessary.

Notification of consequences: Upon receiving a request to withdraw consent, the personal data controller and relevant parties are responsible for informing the data subject about the potential consequences and damages that may arise from withdrawing consent. This helps data subjects to carefully consider their decision.

Stop Data Processing: After completing the consent withdrawal process, all relevant parties, including the Data Controller, Data Processor, and third parties, are responsible for ceasing the processing of personal data. They must also request that other organizations or individuals stop processing any previously collected data.

The provisions regarding the withdrawal of consent in the draft Personal Data Protection Law emphasize the rights of data subjects in managing their personal information. This not only ensures the legality for data processing parties but also provides users with flexibility in protecting their privacy.

We can see that the draft Personal Data Protection Law lays a crucial foundation for safeguarding individual privacy in the context of rapidly advancing digital technology. The regulations on data subject consent affirm the right to control personal information and create transparent and strict legal mechanisms for organizations and individuals involved in data processing. The clarity and specificity of these regulations will help build user trust while promoting sustainable development in the digital environment. Understanding and adhering to these regulations is the responsibility of all parties to ensure safety and transparency in the use and management of personal data.

Time of writing: 15/10/2024

The article contains general information which is of reference value, in case you want to receive legal opinions on issues you need clarification on, please get in touch with our Lawyer  at  info@cdlaf.vn

You can refer for more information:

• Is on-behalf salary payment for employees a service or a support activity?
• Distinguishing Between Labor Outsourcing and Service Provision
• Is it allowable for a business to transform foreign loans into capital contributions?