Data Law – Part 1: Necessity for a New Approach

18 May, 2024

With the emergence of new business models based on providing services online, digital data becomes a ‘new’ resource, properly exploiting and promoting the value of data will promote the digital economy development. However, fragmented regulations and a bias towards control methods have placed many limitations on the empowerment of business entities. This article by a group of authors from University of Economics Ho Chi Minh City (UEH) will discuss the challenges mentioned above and propose a new approach to balance the interests of all parties.

Facing the new industrial revolution, data plays a vital role in economic development and ensuring social and security. Because data is a means of transporting information, the correct combination of pieces of data will create meaningful information, supplementing and enriching human knowledge.If businesses properly and reasonably exploit the data generated in the business cycle, they will constantly create new value from the meaning that data promotes in specific business contexts. On the contrary, in terms of individuals, when data about their private lives is out of control and falls into the wrong hands, it will cause significant damage to themselves and their loved ones around them.Therefore, the legal framework governing relationships surrounding the right to use and to exploit big data in the digital economy must be recognized; concurrently, timely balancing with the personal rights of network users.

The distributed legal framework

Currently, Vietnam’s legal framework divides data into many relationship groups corresponding to the nature of the data, specifically as follows:First: Group of data is related to social control and management activities of state agencies, or population data. This group may include statistical data on the economic and social situation at home and abroad, national secrets, civil status data, people’ identities, population data, population data, and personal data regarding national resources and so on. Regarding these data, Vietnam’s legal regulations currently determine that the subject exercising rights on them is the State. Some typical legal documents include the Law on Archives, the Law on Citizen Identification and so on.Second, the group of data is for people that can freely access, possess, use and dispose of with the purpose of creating economic and social value.• Depending on the nature associated with personal interests, Decree 13/2023/ND-CP sets out criteria to determine ‘personal data’ and divides it into two categories: ‘basic personal data’ and ‘sensitive personal data’. This division assumes the existence of data that is not personal data, and therefore, not subject to regulation by the Decree.• Depending on the nature of population and civil status information, the Citizen Identification Law provides two types of data: ‘national population data’, ‘citizen identification data’, and ‘specialized data’, embedded in broader concepts.

From the above preliminary statistics, it is not difficult to recognize that, currently, the legal framework is fragmented both vertically and horizontally whereas it is too biased towards controlling the processing process to ensure user’s personal rights. Many studies have listed more than 70 groups of legal documents that regulate personal data while regulations creating property rights on industrial data are almost absent.

Although fragmented regulations will be effective in the short term, they, in the medium and long term, will cause overlap and complexity in terms of operation and management. In the current context of digital transformation, data often exists in large blocks, subjected to the processing of in-depth and complex algorithms. This poses a challenge for businesses in determining the nature of each type of data in a large data set as, in the same database, there can be both personal data and non-personal data, industrial data and other data.

Functional approach model

If data is considered an object of rights, the data must meet the criteria for the object of legal relations in accordance with legal theory. To unify the management mechanism for big data in the digital economy, it is necessary to change the approach from management – prohibition, placing emphasis on the personal rights of individual data subjects, to a more ‘open’ approach, based on the balance between the rights of relevant parties to large volumes of data. In other words, it is necessary to change from a ‘static’ approach based on the nature of data to a ‘dynamic’ approach based on the functions that data plays in specific contexts of the digital economy.A functional approach to data means that: when establishing and exercising data rights, one needs to shift the focus from the nature of the data to determining the ability of subjects to behave with respect to the data, associated with the context in which the valuable benefit of the data is brought to the rights holder. Therefore, instead of using the nature of data as a criterion to build legal regulations, in the functional approach model, lawmakers will change the focus, taking conditions on the subject, the purpose and the benefits that the parties hope to achieve when establishing and exercising data rights in a specific context so as to decide the legality of exercising rights to that data.To do that, first, the rights of personal information subjects (or personal data subjects) can be identified as an exception to the rights surrounding the exploitation and the use of digital data in business.Next, when establishing legal relations related to digital data, legislatures and relevant entities should not focus on the nature of the data as non-personal data, basic personal data, or DLCN is sensitive. If these are not put into use, the data is simply data, without any nature. In other words, what purpose the data is used for and how it is used are what determine the nature of the data.For example, given the following piece of data: “B is a Vietnamese citizen, whose religion is Buddhism, and likes to watch documentaries”. This piece of data is not enough to reflect whether this is basic data, sensitive data, or non-personal data as we do not know what purpose this piece of data is used for or whether to satisfy what purpose, whose purpose, and how. If this piece of data is held by a state agency to manage the civil status and the population, it can be determined that the state has the right to use this data for state administrative management purposes. If this piece of data is controlled by trader A for the purpose of analyzing the market and returning results for business expansion, this data is industrial data. If this piece of data remains in the hands of the individual and is shared with friends via messages in a closed conversation group on an online platform, this is the classification of data containing private information.In short, the recognition of rights over data should be based on the function of the data in a specific situation, not on classifying and imposing the nature of the data from the beginning. With this new approach, the value of digital data will be promoted while still ensuring the legitimate human rights of individual data subjects.

Please refer to the full research Legal approach towards digital data and mechanism to adjust the right regarding digital data in Vietnamese laws HERE.

Author group: MSc. Huynh Thien Tu, MSc.Le Thuy Khanh, School of Law – University of Economics Ho Chi Minh City (UEH).

This is an article in the series of articles spreading research and applied knowledge from UEH with the “Research Contribution For All – Nghiên Cứu Vì Cộng Đồng” message, UEH cordially invites dear readers to look forward to the upcoming UEH Research Insights No. #111.

News & photos: Group Author, UEH Department of Marketing & Communication