Khóa luận tốt nghiệp: Personal data: The idea of a new intellectual property

LEGAL FRAMEWORK OF VIETNAM INTELLECTUAL PROPERTY LAW ON PROTECTING PERSONAL DATA .... Legal Framework of Vietnam Intellectual Property Law on Protecting Personal Data; Section 3.. LITERA

MINISTRY OF JUSTICE MINISTRY OF EDUCATION AND TRAINING

HANOI LAW UNIVERSITY

LY THU HA

452845

GRADUATION THESIS

HANOI — 2024

Confirmation

DECLARATION Thereby declare that that work which is being presented in the thesis, entitled “Personal Data: The Idea of a New

Intelectnal Property”, is an original piece of research workunder the guidance of Dr Vuong Thanh Thuy, Department ofIntellectual Property Law, Hanoi Law University The

conclusions and data provided in the thesis are researched and presented with academic integrity, ensiwing clarity and reliability in the research outcomes./

Student’ s Signature

Decree No 64/2007/ND-CP on Information Technology Application in State Agencies

OperationsExempli gratia (for example)

Et alia (and others) European Union General Data Protection Regulation Inter alia (that is)

Ibidem (previously cited) Intellectual Property

Issue Number The Organization for Economic Cooperation and Development

Personal Data Pages/page

VolumeThe World Intellectual Property Organization

TABLE OF CONTENTS DECLARATION ii INDEX OF ABBREVIATIONS

CHAPTER I INTRODUCTION

1 The Rationale Of The Thesis 1

2 Overview Of The Current Research Situation ceceeseerieee 2

1

3 The Significance Of The Thesis -cc+ccseerieerrerrrsrrser 5

4, The Objectives Of The Thesis ssssssssssssesnessneessneesneessseessneesneessneesnsessneessneeenaes 5

5 The Objects And Scope Of The Thesis csssssssssssscssssessssneesssssesessnsesssnneesssanees 5

6 The Methodology Of The Thesis ccsscsssssssssssneessesseessesneesseenecensensesneensesneeneense Xi

7 “The Structure Of The Thesis sssisscscsisssisssssecsssssisesssucssessossassississansnsasinssssoissisensiticens 7 CHAPTER IE ANALY SIS sicssssssssssosasssssssssssssscssnsssoszsonscosscossonssnasaaccoscessossonnesusenoaniesnes 8 SECTION 1 LITERATURE REVIEW ON PERSONAL DATA AND INTELLECTUAL PROPERTY PROTECTION OVER PERSONAL DATA

1.1 LITERATURE REVIEW ON PERSONAL DATA

1.1.1 Definition of Personal Date

1.1.2 Characteristics of Personal Data

1.1.3 Classification of Personal Data

1.2 THEORETICAL FOUNDATION FOR INTELLECTUAL PROPERTY PROTECTION

1.2.1 Rationales of Protecting Personal Data as an Intellectual Property - The Value of Personal Data Towards Related Subjects ò.ceece.c- AT 321.1 A CON DI ENESSCIĂE:s:sGsGGytsgtötttguijGfGSiàqogasgi—snuassvdlt 1.212 The Individhial Perspeciive à oi 20 1.2.1.3 The Society Perspective ìì c2

1.2.2 Co-existence of the Intellectual Property Mechanism and Other Mechanisms

fo Protect Persceial!D TƯ NNẢợẢẻẽ | 1.2.2.1 Protecting Personal Data as a Human Rầghi 22

1222 Advantages of the Intellectual Property Mechanism Compared to Other

CONCLUSION OF SECTION 1

SECTION 2 LEGAL FRAMEWORK OF VIETNAM INTELLECTUAL PROPERTY LAW ON PROTECTING PERSONAL DATA 27 2.1 OVERVIEW OF CURRENT VIETNAM LEGAL FRAMEWORK ON PERSONAL

21/1:;.0G0D6:00.AHDÙCSHDU:i6o11oeiGicsteeeoliadgiiaslttslltessaigtasssssaÐ

2.1.2 Principles and Rights of Data Ownes ào 2. - 2Ø

22 POTENTIALITY TO PROTECT PERSONAL DATA AS AN INTELLECTUAL

2.2.1 Property Rights in Personal Data sosscssscvcsasscstsissttcscctssssnstsnevssssvantastteenee BB 2.2.2 Personal Data as an Intellectual Prơperty - 38 2.221 Personal Data Protection under Moral Rights of Copyrights’ Authors

2.2.2.2 Application of Trade Secrecy Model for Promoting Information

2.2.2.3 Establishing a New Form of Intellectual Property Right on the Basis of the Sta Generis Righf Heo AD CONCLUSION OF SECTION 2 ccccciesiieriieeiiitiiiiriririee 49

SECTION 3 RECOMMENDATIONS TO IMPROVE LEGAL FRAMEWORKAND ENHANCE THE APPLICATION OF INTELLECTUAL PROPERTY

3.1 VIETNAM GENERAL CONTEXT OF PERSONAL DATA PROTECTION

3⁄2 CHALLENGES VIETNAM FACING IN APPROACHING THE INTELLECTUAL PROPERTY WAY TO PROTECT PERSONAL DATA ccssssssesssssessssenesssessecsnsensenneensesee §2

3):5 11ne:BtacHGal/ASDBGbSc66x.Sielsc6f610ieti5)8660sd040128tL0ac0650818sGãzanp OM 3.3 RECOMMENDATIONS FOR APPROACHING THE INTELLECTUAL PROPERTY WAY TO PROTECT PERSONAL DATA sessssssesssssssssnsssecsneensesneencsncesscensenecencensenneenses 56 3.3.1 Suggestions on the Legal Framework oo-ccccrcccrc- c c TỔ 3.3.2 Suggestions on the Practical Grounds sasaseasastbncsasien re th CONCLUSION OF SECTION - SH 58 CHAPTER TIT CONCLUSION scssssssscssssssesscossessorsessssoscenserscenscssconscosscsscensensssnssnsces 59

INDEX OF REFERENCES csssscssssssssesssesssssssneessnecssnecsnsesssecesneesnscesnecennecsneessneessneesne 61

CHAPTER I INTRODUCTION

1 The Rationale of the Thesis

In the modem world, characterized by advancements in science, technology and the internet, PD has evolved into a valuable commodity for exchange In the actual situation, the Draft of the Proposal for the Issuance of a Decree on Personal Data Protection states that Vietnam is one of the countries with the highest Internet development and application rates in the world The number of Internet users in V ietnam has reached over 64 million people, accounting for more than 2/3 of the population (66%), an increase of over 19% compared to 2018, ranking 13th in the world in terms of the number of users This includes 58 million Facebook accounts and 62 million Google

accounts! The abundant amount of PD being digitalized has urged the Vietnam

government to issue an official legal framework for protecting PD

After several Proposals and consultations, on 17/04/2023, the Government issued Decree No 13/2023/ND-CP on Personal Data Protection, being the first official specialized legal document regulating issues revolving around PD After Decree 13/2023/ND-CP onPersonal Data Protection, the Ministry of Public Security of Vietnam

has already proposed the establishment of a Personal Data Protection Law? These

initiatives demonstrate the special and close attention of the Vietnamese government to issues concerning PD.

However, these regulations approach the protection of PD as a human right, or the right to privacy, which inherently restricts data ex change in the market It'simportant

to recognize that in today’s interconnected information economy, information exchange

is essential for economic development, especially personal information, which holds unique cheracteristics and therefore adds even greater value to the market compared to

general information accessible to multiple entities Therefore, pioneering countries inestablishing mechanisms to protect PD always aim to build a legal system that balances

the rights of data subjects with the flow of data exchange in the economy From this

"nis of Public Secwray 2022), “Tam gia ý kin vào vie xây dừng Nghị định quy dink về bio vi đỡ liệu cánhân” ‘

` Government News (2024), ‘De nghi xây đựng Luật Bão vệ Dit Liu ca nhân!)

perspective, considering PD as a tradable asset and exchangeable for currency, is the most reasonable and beneficial approach Moreover, IP right creates an expectation that the data subjects have another level of control over the comm ercialization and tradability

of that data Also, protecting PD as an IP provides data subjects with protection against the misuse of their PD by downstream or third-party users with whom a subject does not

have a contractual relationship?

Being aware of the urgency and practical value of the topic, the student has chosen

to research “Personal Data: The Idea of a New Intellectual Property” as the topic for graduation thesis to resolve to questions:

@ Point out the significance of an IP protection mechanism to PD;

(i) Suggest potential IP mechanisms for protecting PD

2 Overview of the Current Research Situation

The imperative of safeguarding PD in the digital era is paramount for nations around the world While the concept of propertizing PD as anIP haslong been established

in many countries, Vietnam is relatively new to this perspective, primarily due to the recent emergence and enforcement of PD protection legal framework.

2.1 Global Research Situation The idea of propertizing PD has been discussed and proposed by several scholars

in the world for a while The followings serve as principal references that closely align with this thesis’s approach to researching the topic of this thesis.

- Pamela Samuelson (2000), Privacy as Intellectual Property ? (“Liêu có thé coi sự

riêng tư là một tài sản trí tué?”), University of California at Berkeley*

This article approached the definition of PD asa scarce commodity in cyberspace Then, to overcome the failure market that a company can gain benefits but suffer no

losses from the disclosure of PD, the author proposed that the lay should grantindividuals a property right in their PD The author first considered both the appeal and

*'L Tralaman et al (2019), “Is Privacy and Personal Data Set to Become the Neve Intellectual Property?”,

International Review of Intellectuat Property and Competition Law , University of New South Wales Law Research Series, Vol 50, Iss.8,pp 937-970,p 944

3 Available at: https://people ischool berke lay edul-pamapapersiprivasip_ draft pat

limitations of the intellectual property rights model and then explored an alternative market-oriented legal regime for protecting PD via certain trade secrecy licensing default rules This article builds a basis for the idea of propertizing PD though its approach seems

to be too market-oriented.

- MMS Karki (2005), Personal Data Privacy and Intellectual Property ( “Quyên riéng tu đối với dit liệu cá nhân và tài sản trí hệ”), Journal of Intellectual

Property Rights, vol 10, January 2005.

In comparison to the above article, this article approached PD in both human tights and property rights views It initially defined privacy and PD, which remain the idea that PD has become an economic resource that many businesses need and use for

the supply of their products and services, hence, greater protection of PD should beconsidered by granting data subjects an intellectual property right Legal protection of

PD in several countries also has been analyzed in this article Then, this article has proposed a potential mechanism under IP law to apply to PD However, in the scope of

a journal article, the article merely suggests potential protective mechamsms without

delving into their advantages, disadvantages, and the necessity of practical implementation for PD protection.

- L Trakman et al (2019), Is Privacy and Personal Data Set to Become the New

Intellectual Property? ( “Sư riêng tư và dit liệu cá nhân có thé trở thành một loat

tài san trí tué mới hay không?”), International Review of Intellectual Property andC ompetition Law, University of New South V/alesL aw Research Series, V ol.

50, Iss 8, pp 937-970.

This paper is a recent study on PD protection in which it explored the idea of PD

as the new IP to provide data subjects with a higher level of protection for their PD First

and foremost, the paper declared the significance of a right to privacy but stressed theeconomic rationale for the commercialization of PD Then, several emerging case laws

in jurisdictions beyond the EU, Australia and Singapore demonstrate the tendency of courts to protect PD through an IP right Based on theoretical analyses and case laws, the author illustrated a pathway ahead for opening the door to such IP protection through

the data subject’s consent to use his PD The paper has established a solid theoretical foundation for applying IP rights to PD protection However, it has failed to provide general directions or specific mechanisms for applying IP law to PD protection.

2.2 National Research Situation

In Vietnam, there is still little research work on applying IP rights to protect PD.

- Nguyen Nhu Ha & Dang Minh Phuong (2024), Báo vệ dit liệu cá nhân dưới góc

đồ quyền sở hữm tri tué, National Scientific Conference Proceedings “Dữ liệu cá

nhân trong dòng chảy kinh tế số Viét Nam”

This article might be the first to propose a perspective of an IP protection mechanism for PD The article provided an overview of PD and analyzed the condition

of protecting PD from the perspective of IP rights under the umbrella of copyright.Though having significance in pioneering the idea of propertizing PD, the article hasfeiled to prove the rationale and significance of layering more protection on PD by

as property or not.

- Nguyen Thi Long (2022), Thực trang pháp luật Viet Nam về bảo vệ dit liêu cả

nhân trong thời kỳ hội nhập, Journal of Procuratorate Studies, No 03 — 2022 Similar to the previous article, this one also examines some deficiencies in the existing legal framework concerning PD protection in Vietnam and addresses the unresolved question of whether PD should be considered property The author of the

article leans towards the notion of treating PD as property, proposing that it is essential

to contemplate designating certain PD as non-traditional assets to capitalize on their

economic worth.

3 The Significance of the Thesis

The scientific aspect: The thesis is one of the first comprehensive and direct scientific research on applying intellectual property law to the protection of PD, contributing to refining both theoretical foundations and practical approaches concerning safeguarding the rights and legitimate interests of data subjects amid the Fourth Industrial Revolution This research is conducted within the context of Vietnam's ongoing digital transformation efforts, including the establishment of electronic

government and courts Upon completion, the thesis will serve as a valuable referencefor further research and leaming about PD and its protection

The practical aspect: The thesis serves as a valuable reference for theoretical and practical research on PD, conceptualized as an intellectual property It can be consulted and applied in the process of drafting and enacting the PD Protection Law in Vietnam in the future.

4 The Objectives of the Thesis

The objective of the thesis is to explore theoretical issues conceming PD and its protection as intellectual property This involves analyzing the nature, characteristics, and value of PD, aswell as the strengths and limitations within the legal framework and practical implementation of PD protection in Vietnam Based on this analysis, the thesis aims to propose solutions and recommendations to enhance legal regulations on PD protection and improve the effectiveness of PD protection practices in reality.

5 The Objects and Scope of the Thesis

§.1 The Objects of the Thesis

To achieve the objectives of the thesis, within the scope of the topic, the author

focuses on researching

Firstly, the author researches the definition and nature of PD along with the personal value and economic value of PD Determining the economic value of PD is

crucial in the process of PD assetization Additionally, the author also investigates the perspectives of other countries regarding the assetization of PD in the form of intellectual

property rights.

Secondly, the author investigates the current legal framework in Vietnam regarding the protection of PD and the practical implementation of PD protection in Vietnam This analysis aims to provide subjective evaluations regarding the feasibility

of applying intellectual property law mechanisms to the protection of PD.

5.2 The Scope of the Thesis Within the scope of a graduation thesis, the author conducts this research within the parameters set by legal documents, as well as specific spatial and temporal limitations:

Limitation for legal doctanents: The author examines regulations related to the protection of PD in relevant legal documents, including intemational intellectual property conventions of which Vietnam is a member, such as the Berne Convention for

the Protection of Literary and Artistic Works, the Agreement on Trade-Related Aspects

of Intellectual Property Rights (TRIPS Agreement) Domestic legal frameworks governing issues related to PD are also analyzed, such as the 2005 Civil Code, the 2015 Civil C ode, the 2017 amended and supplemented Civil Code, the 2015 Law on Network Information Security, the 2018 Cybersecurity Law, specifically the 2005 Intellectual Property Law along with the 2022 amended and supplemented Intellectual Property Law, and various decrees such as Decree No 13/2023/NĐ-CP on Protection of Personal Data, Decree No 15/2020/NĐ-CP on penalties for administrative violations in the fields

of postal services, telecommunications, radio frequency, information technology and electronic transactions, Decree No 14/2022/ND-CP to amend and supplement several

provisions of Decree No 15/2020/ND-CP Additionally, the author conductscomparative research with the PD protection legal frameworks of the European Union

and Chine.

Spatial limitation: The author conducts research on legal perspectives and activities related to PD protection globally, not limited to the territory of Vietnam.

Temporal limitation: The author primarily investigates legal perspectives on PD protection worldwide over the past 30 years and in Vietnam over the last 10 years, along with relevant legal regulations and the practical aspects of PD protection in Vietnam over the past decade, influenced by the remarkable development of the internet.

6 The Methodology of the Thesis

The thesis incorporates the principles of Marxism-Leninism and the ideologies of HoChi Minh, particularly focusing on dialectical materialism and historical materialism

In particular, the author underscores the utilization of specific research methodologies such as systematic and analytical approaches, comparative analysis, logical inference, statistical methods, expert opinions, and sociological surveys.

7 The Structure of the Thesis

The thesis contains three chapters: Introduction, Development and Conclusion

The content of Development is subdivided into the following sections:

Section 1 Literature Review on Personal Data and Intellectual Property Protection over Personal Data;

Section 2 Legal Framework of Vietnam Intellectual Property Law on Protecting Personal Data;

Section 3 Recommendations to Improve Legal Framework and Enhance the Application of Intellectual Property Mechanisms to Protect Personal Data.

CHAPTER II ANALYSIS SECTION 1 LITERATURE REVIEW ON PERSONAL DATA AND INTELLECTUAL PROPERTY PROTECTION OVER PERSONAL DATA

Under the impact of the Fourth Industrial Revolution, PD and data privacy is a pressing issue not only in Vietnam but also in many countries around the world An increasing number of our interactions with the world are being tracked: the goods we purchase, the photos we post, and the places we visit are stored electronically by service

providers e.g Google, Facebook who are always in the quest for more data’ PD has

become an economic resource that many businesses need and use for the supply of theirproducts and services In the digital age, where information is a valuable commodity,

companies leverage PD to tailor marketing strategies, refine product offerings, and

enhance customer experiences The exponential growth of data generation and collectionhas ushered in a new era of economic activity, where insights derived from PD fuel

innovation and drive competitive advantage® The widespread collection and analysis of

PD by corporations constitute a form of surveillance capitalism, wherein human

experiences are commodified and exploited for profit” This transformation underscores

the intricate interplay between privacy, economics and technology in contemporary society, prompting debates over data ownership, consent and regulation.

Recently, after the implementation of the new legal framework for protecting PD

in Vietnam, PD has even been argued more at the center of controversies amongacademics and law experts The revolution of technology and automation along with theincrease in PD trade via the Internet of Things, which is a network of interconnectedphysical objects, each embedded with sensors that collect and upload data to the Internetfor analysis or monitoring and control, has brought tzo conflicting sides On the bright

side, PD fuels the economy and plays an essential role in technological development.

Ý Hu Ying (2021), ‘Private and Common Property Rights mn Personal Data”, Singapore Academy of Lave Journal,

Vol 33,pp 173-201,p 174.

° Viktor Mayer- Schanberger & Kemmeth Cukier (2013), Big Data: A Revolution That Wil Transform How We Live,

Work, and Thank, Houghton Mifflin Harcowt Publishing Company,p 183.

Ì Shoshana Zuboff (2019), The Age of Surveillance Ccgntalism: The Fight for a Hianan Future at the New Frontier

of Power, Public Affazs Publishing Company ,p 51.

* Ha Yung (2021), ‘Private and Common Property Rights n Personal Data”, Singapore Academy of Lase Jotwnal,

Vol 33,pp 173-201,p 177-178; Ian Goldberg (2007), “Privacy Enhancing Teclmologies for the Intemet TH: Ten.

On the other side, it is attributed to the loss of privacy and data-related harm cases, especially negative situations that are related to privacy issues e.g identity theft,

discrimination, social stigma’ Hence, it is imaginable to protect PD as a property,

specifically as a form of intellectual property Moreover, PD is considered an important currency in the new millennium which brings massive monetary value to both data subjects and data controllers Therefore, itis argued that providing an additional layer of

control over PD through IP rights may be better at dealing with the case rather than

implementing only one mechanism on PD”.

1.1 Literature Review on Personal Data

To discuss whether to apply a further protection mechanism on PD or not, itis amust to comprehend the definition and characteristics to PD

1.1.1 Definition of Personal Data

In some institutions, PD is closely related to information privacy, or the right toprivacy Privacy itself has been influenced by culture, regional and global events It islargely a Western concept that has evolved in response to mass violations of personalsecurity that occurred during World Wer II Privacy protection has evolved further in thenew world and emerged as a fundamental right across the EU after the introduction of

the EU Convention on Human Rights” The concept of privacy always existed

throughout history as itis related to key values inscribed in human nature such as human

dignity and independence, even if the content and definition of privacy differ according

to the historical period, society, culture and even from individual to individual.Nowadays, the vast majority of nations recognize privacy as a fundamental human right

and, therefore, it is explicitly or implicitly protected at a constitutional level? In many

‘Years Later”, m Ian Goldberg (2007), Digital Privacy: Theory, Tecimologies and Practices , Chapter 1, Auerbach Publications pp 3-18.

Dorothy J Glancy (2005), Personal byformation as Intellectual Property, Santa University School of Law,p 1;

Sasha Romunosky & Alessandro Acquuisti (2009), “Privacy Costs and Personal Data Protection: Economic and Legal Perspectives”’, Berkeley Tecimology Law Joranal, Vol 24,No.3,pp 1062-1091 ,p 1064.

‘© L Trakman et al (2019)., “Is Privacy and Personal Data Set to Become the New bnteliectual Property?”,

Snternational Review of Intellectual Property cad Competition Law , University of New South Wales Law Research Series, Vol S0, Iss $ ,pp 937-970, p 939.

}1L, Trakaman et al (2019)., bid ,p 941.

12 Solove Daniel J (2008), “Understanding Privacy”, Cambriige , Harvard University Press pp 2-3.

countries, privacy is interpreted in terms of management of personal information or ‘data

protection’ Outside this rather strict context, privacy protection is frequently seen as a

way of drawing the line at how far society can intrude into a person’s affairs The understanding and acceptance of the right to privacy differ greatly amongst countries and regions of the world.

In their famous article “The Right to Privacy’, Warren and Brandeis defined the right to privacy as the right to be let alone whichis a separate and general right ensuring

protection against the unwanted disclosure of private facts, thoughts, emotions, etc!

Simply, privacy can be understood as a control over personal information and the claim

of an individual to determine what information about himself or herself should be

revealed to others!®, There should be four separate yet related concepts of privacy: (i)

information privacy — which also known as data protection; (ii) bodily privacy — whichconcerns the protection of people’s physical selves against invasive procedures, (iii)privacy of communications — which covers the security and privacy of forms ofcommunication and (iv) territorial privacy — which concems the setting of limits on

intrusion into the domestic and other environments’,

Several legal frameworks in the world have defined PD Pursuant to Article 4(1)

of the GDPR”,

“[PJersonal data’ means any information relating to an identified oridentifiable natural person (‘data subject’); an identifiable naturalperson is one who can be identified, directly or indirectly, in particular

by reference to an identifier or to one or more factors specific to the

physical, physiological, genetic, mental, economic, cultural or social

identity of that natural person;

ở Viét NomTM , Master

© Lo Chi Anh Duc (2022), “Bao về quyển riêng ne cá nhiên trong mồi trường mang xế

Thesis, Hanoi Law University,p.$.

Sammie] D, Warren & Louis D Brandeis (1890), “The Right to Privacy”, Havard Lav Review, Vol 4,No 5 ,pp.

193-220,p 195.

* Lukacs, A (2016), What is privacy? The hnstory œxi definition of privacy.

‘© MM S Karki (2005), “Personal Data Privacy and Intellectual Property”’, Jounal of Intellectual Property Rights , Vol 10 pp 59-63,p 59.

* Available at: https://gdpr-mfo eu/.

In other words, PD is information that directly or indirectly allows the identification of individuals it refers to and may include contact data such as name, mailing e-mail address, telephone number, etc, credit information; medical records covering medical and genetic information of the patients, government or public records

containing tax identification number or an individual’s social security number’® The

definition given by EU is broader than that by the US in the guidance of the National

Institute of Standards and Technology: “Information that can be used to distinguish ortrace an individual’ s identity, either alone or when combined with other information that

is linked or linkable to a specific individual.” Moreover, the definition given by the

Organization for Economic Co-operation and Development encompasses a broaderscope than any other: “Personal data means any information relating to an identified or

identifiable individual (data subject)”

Another widely-used phrase that is interchangeable with PD is ‘personalinformation’ as referred to by Recital 6 of the GDPR or simply just as ‘information’related to a natural person There is a conceptual distinction between data andinformation Data is deemed as the source of information, no matter whether weunderstand the data display or not Data themselves have no intrinsic value and theirvalue depends on the context of their use as well as on how personal information can be

extracted from them”! That is to say, data only become information once conveys

meanings to readers, which means there is no date-less information”.

In Vietnam, the term ‘personal information’ is sooner to appear and seems to beused more frequently in other legal documents e.g Article 21.1 of the 2006 Law on

Information TechnologyTM: “Unless otherwise provided for by law, organizations and

individuals that collect, process and use personal information of other people in the

‘MM S Karki (2005), “Personal Data Privacy and Intellectual Property”’, 7002] of Intellectual Property

Rights, Vol 10,pp 59-63,p 59.

'* Available at: https ://csrc nist.gov/glossary Remm/personal_ data.

*° OECD (2001), OF CD Gradelnes on the Protection of Privacy œx Transborder Flows of Personal Data,p 13,

para.)

`! OECD (2015), Data Driven bmovation: Big Datafor Growth and Well-Being,p 197.

+ Vaclav Janecek (2019), “Ovmership of Personal Data m the Intemet of Things”, Comprter Law & Sectaity

Review , Vol 34,No 5,pp 1039-1052,p 1044.

» Available at: hitps:/Avipolexres wipo att/edocs/lezelocs/latws/enavkm]l34en hin).

network environment must obtain the consent of those people.”, Article 91.1.c of the

2016 Law on Pharmacy”: “A clinical trial subject has the rights to: [ ] have relevant

personal information kept confidential” The definition of ‘personel information’ has

been firstly regulated by Article 3.5 of the Decree 64/2007/ND-CP*.

[Plersonal information means information which is adequate to accurately identify the identity of an individual, covering at least one of

the following information: full name, date of birth, profession, title,contact address, e-mail address, telephone number, ID number and

to keep confidential

The first law to delineate ‘personal information’ is the 2015 Law on Network

Information Security” with Article 3.15: “Personal information means information

associated with the identity by the personal information.” Most recently, the Decree No

13/2023/ND-CP* has introduced the new legal term ‘personal data’, specifically defined

by Article 2.1:

[P]ersonal data means any information that is expressed in the form ofsymbol, text, digit, image, sound or in similar forms in electronic

environment that is associated with a particular natural person or helps

identify a particular natural person

+ Available at:

‘https /vvnw 2 conomica xiv Content files/L AW 20% 26% 20REGI105 2016 QH13%20Law% 200n% 20Phammac af.

able at: https english mic gov vm/Upload/Store //VanBa/6176/121028616 pdf.

\vailable at: https /Anetramalarrenglish blogspot com/20 13/05 krietmam decree-no-522013nd-cp-on-e html

Available at: https english mac gov m/Upload/VanBavLavs-on-Netwrork- Information Se curity- 16-05-30 pdf.

** Availble at: https ://eurochanwn orgkrp-cortertÁiploads/2023/02/Decree-13-2023-PDPD_EN chanpdf.

While former definitions of ‘personal information’ only stresses ơn the identifiability of the information towards an individual, the latest definition of PD is much more precise in clarifying its expression form and also the environment where it appears The provision has proposed a broader but still specific definition of PD, which additionally covers the conceptual distinction between data and information It shows an adaptation of Vietnam laymakers towards global trend whereas the concern for personal

information leakage is rising out of the spatiotemporal data trade context Also, the term

‘personal data’ will be used in this thesis as it has a larger scope of objects and, hence,

is more compatible with the object of the thesis Moreover, ‘personal data’ is such atopical newly-adapted term in Vietnam legal documents and a common legal termglobally, which guarantees the rationale of the thesis Otherwise, the term ‘personal data’

is extremely significant in illustrating the impact of new technology development fromthe 1970s that resulted in easily accessible datasets, which urges several governments to

establish a comprehensive data protection framework”.

Dispatching from all definitions above, PD encompasses the following aspects:

@ PD is information relating to an individual; (ii) PD is distinctive and unique, whichiscapable of distinguishing one individual from another; (iii) PD is a combination ofinformation comprising various details about an individual rather than a single piece ofinformation and (iv) PD can be collected through various forms and methods Inconclusion, the author proposes PD as ‘a combination of information about a specific

individual which is collected processed and stored in any form that is closely related to

an individual or can be used to identify, determine or specify that individual *

1.1.2 Characteristics of Personal Data

From which has been analyzed above, PD has five following features:

Firstly, PD is a combination of information about a specific identified personEach person has his or her own PD sets from the time he or she was born Hence, thedata sets of organization, collective, entity, etc are not considered to be PD

* Article 29 Data Protection Working Party (2007), Opinion 4/2007 on the Concept of Personal Data, European.

Commuission,p 5.

Secondly, PD is unique and can be used to identify or distinguish a person from another in social relationship PD is so unique that there is nearly zero percent for two

or more individuals to have the same PD sets Therefore, PD is associated with a particular person allowing them to be uniquely identified and contributing to distinguishing them from other individuals with similar information From the PD of an individual, itis possible to determine who that individual is and conversely, various types

of PD can be collected from a specific individual

Thirdly, PD exists via abundance of forms e.g symbols, writing numerals,images, sounds or similar forms in electronic platforms PD is the objective form of theexistence of personal information Currently, with the rapid development of science andtechnology, there is an increasing diversity in the forms of expression of personalinformation for others This raisesnew challenges in protecting PD against risks that canlead to its swift spread, sharing and dissemination As a result, the policymakers arepresently facing with an extremely significant question to protect PD through smartdevices on digital platforms

Fouwthly, PD embodies distinctive characteristics of a human right whileconcurrent represents features of a new right to property, specifically the right to

intellectual property” Traditional opinions of renowned scholers suggest that PD bears

the distinction of individual privacy rights, intimately linked to each individual and

requiring an absolute protection mechanism as a human right?) However, in the context

of the Fourth Industrial Revolution, many new viewpoints have emerged asserting that

PD holds value towards both related individuals and the society and can be transferred

as ownership rights as well as exchanged on par with money currency, thus, exhibiting

characteristics akin to a type of property” Particularly, given the unique nature of PD,

© Pham Hoang ‘Thanh (2022), “Báo về oft liệu cá — Một số vấn để lý luân và Đưực tiến”, Master Thesis, Hanoi

Law Univesity,p 14

`! Saamel D Wasren & Louis D Brandeis (1890), “The Right to Privacy”, Hevard Law Review, Vol 4,No 5 ,pp 193-220, p 205; Case 4/737 Nold Kohken- trả Baustofgrofñhandhmg v Commission of the European Communuties.

* Schyvartz, P.M (2004), “Property, Privacy, and Personal Data”, Harvard Loew Review, Vol 117,No 7, pp.

2056-2128; Sarah Spiekermam & Jana Konmovska (2017), “Towards 2 value theory for personal data”, Joraral

of ñƒormaien Tecimology, Vol 32 ,pp.62-84; Hu Ying (2021), ‘Private and Common Property Rights in Personal Data”, Singapore Academy of Law Joranal, Vol 33 ,pp 173-201

it also possesses the sui generis trait of intellectual property Determining what constitutes PD will significantly impact the development of the legal framework and the application of laws in the process of protecting PD.

1.1.3 Chssification of Personal Data

Pursuant to Article 2 of the Decree 13/2023/ND-CP, PD is divided into two types

based on the potential impact of PD on human psychological well-beingTM: (i) Basic PDTM

— consisting of specific identifiable information e.g name, age, sex, race; (ii) Sensitive

PDŠ — including information directly related to fundamental the rights and freedoms of

an individual e.g political views, religious beliefs, sexual orientation, genetic traits,health status, legal violations, information about social relationships, etc Thisclassification shows an adaptation of Vietnam lavmakers towards other existing legalframeworks on PD ie EU with the GDPR This classification seems clear andstraightforward to apply in practice in the first place However, there exists difficulty indetermining which PD is sensitive as the regulation is such a subjective and qualitativecriterion Different pieces of information will matter differently to different people In

this aspect, Vietnam would refer to the methodology recommended by ENISA in the

assessment of PD** Additionally, this classification seems too narrow in comparison

with the definition of PD given by Article 3.13 of the Decree No 52/2013/ND-CP

Besides, there are some other grounds to classify PD

Grounded on the confidentiality of PD, it is classified into two distinct categories:Public PD and Confidential PD Public PD is fundamental personal information held bygovernmental agencies to serve public interests, utilized primarily for the government'sease of managing its citizens, may include names, dates of birth, and residentialaddresses Confidential PD includes information that is not permitted for publicdisclosure andis only provided to entities carrying out specific tasks This data is subject

to restricted access and usage so data processors are not entitled to freely utilize such

data and must require the consent of data owner Legal protections safeguard confidential

» Thai Thi Tuyet Dong (2021), “Bão vệ dit liệu cá nhân rửr thể nio?”, Ho Chi Minh City Legal E-Magazine

M Article 2 3 of the Decree 13/2023/ND-CP

Article 2.4 of the Decree 13/2023/ND-CP

'° Available at: https:JAvymy anisa europa ewbublications/dbn-severity

PD from unlawful infringement by entities seeking to exploit it for malicious purposes and gains Access to this type of data requires legal authorization or must undergo a series of state- approved usage licensing procedures Examples of such data may include bank account numbers, financial information, data containing sensitive details of

individuals’ private lives.

Based on the relationships with other types of data, PD can be categorized into

linked PD and independent PD Linked PD is data that must be combined with other data

to identify an individual There is a supportive correlation in searching, exploiting orusing PD Furthermore, the interconnection between these data opens up the possibility

of supporting, interacting, tracing, and parallel searching other important types of humandata Conversely, independent PD operates in isolation from other datasets Each datasetfunctions as an independent one, devoid of mutual influence during the process of dataextraction and utilization Essentially, a single independent PD can identify a specificindividual The exploitation of independent PD predominently targets isolated dataretrieval, without comprehensive oversight of all associated data relevant to the primary

dataset being utilized.

Depending on the data structure, PD can be sorted into simple PD and complex

PD Simple PD typically consists of fewer characters, numbers, symbols, etc Currently,this type of PD is not prevalent as it restricts user exploitation and fails to meet the needfor expanding interconnections among data sources for efficient collection and optimalutilization Complex PD, on the other hand, has a much broader scope of use compared

to simple PD It contains more information and may include political views, personalidentification characteristics, banking data, marital status, among others Collecting such

PD is often more arduous than simple PD

1.2 Theoretical Foundation for Intellectual Property Protection of Personal Data

Conforming to Article 2.5 of the Decree 13/2023/ND-CP, PD protection meansany act of prevention, detection, suppression and handling of violations regarding PD inaccordance with the law However, the definition only covers the aspect of fightingagainst the violations of PD but forgets about the issue of remedying the consequences

of these infringements Hence, protecting PD can be comprehended as the establishment

and implementation of necessary legal safeguards to prevent, mitigate or remedy the consequences of infringements on PD, ensuring that PD remains intact andis not abused

by others?”

The protection of PD is becoming increasingly essential in the process of digital development, as the collection, storage, transfer, and analysis of data are becoming simpler, leading to easier access to PD In the era of digital technology, information data

in general, and PD in particular, are always considered valuable resources PD is a crucialresource for economic development, utilized in various sectors of the economy such asbanking, financial services, and insurance It serves as an abundant source of economicgrowth, providing significant benefits to the economy as a whole

Furthermore, the recent advancements in the Fourth Industrial Revolution alsopose a series of new challenges for protecting PD The ease of access to information,including PD, in today's era has led to infringements even on democratic rights withinpolitical systems The development of algorithms and artificial intelligence, in manycases, has surpassed the capacity of legal systems to protect rights Additionally, therapid dissemination of information on social media can lead to blatant infringements on

PD As it attributes vast value, both rational and material, to related subjects, manycountries worldwide are compelled to enact laws on data protection in the context oftechnological advancements, with particular emphasis on the responsibility of businesses

to safeguard privacy rights and personal information, which including the application of

IP law The thesis, then, would elaborate the significance of protecting PD as an IP andpoint out its predominance in comparison with other PD protection methods

1.2.1 Rationales of Protecting Personal Data as an Intellectual Property - The

Value of Personal Data Towards Related Subjects

Electronic services collect data so ubiquitously today and are so interconnectedthat it is hard to control who transfers and processes what data for what purposes Thedigitization of communication and information has given rise to an abundance of data-shering practices People share details about their whereabouts, their moods and their

`' Pham Hoang ‘Thanh (2022), “Baio về dit liệtcánhân— Mbt số van để lý luận và Điực tiến”, Master Thesis Hanoi

Law University,p 17-18.

activities through a multitude of platforms They leave traces that go unnoticed themselves, such as their geo-location when carrying a mobile phone, or their click behavior The Internet has evolved from an architecture of decentralized and possibly anonym ous interactions to one where packets of data capturing all types of behaviors are uniquely and sometimes personally identified In this environment, a few data controller firms are in a position to control the tracking and linking of behaviors of billions of users

across platforms, online services, sites Consequently, people’s actions, desires, interestsand mere intentions are collected by third parties, often without individuals’ knowledge

of explicit consent®.

Economically, when shared, PD has characteristics of a public good such as rival nature and non-excludability The use of a data point by one party does not preventanother party from using the same data point as well These characteristics lead to well-known market problems for public goods, namely, asset overuse and potential

non-degradation” V alue degradation in particular is a data market challenge because PD is

abundantly supplied Another core tenet of protecting PD is the ability to keep that dataprotected, in other words, to exclude someone from knowing or using certaininformation The value of keeping some personal information protected and the value of

it being known are almost entirely context-dependent and contingent on essentially

uncertain combinations of states of the world”?

The value theory of PD leads to the only big question: How much PD can ever beworth? PD is an intangible asset class The domain of corporate accounting has

developed cost-, market- and incomeapproach methods to derive appropriate valuations

for intangible assetst! What’s more, PD valuation cannot be approached without

considering the human-rights boundaries of PD use Some legal scholars argue that PD

* Alessandro Acquisti et al (2016), “The Economics of Privacy”, Jona7xal of Sconomic Literanae, Vol 54,No.2,

pp 442-492, p 444.

`* Ritenberg L & Tregarthen T.,(2011), “Measuring Total Output and Income” in Rittenberg L & Tregurthen T.,

(011), Principles of Macroeconomics , Chapter 6, FlatWorld Publishing Company.

+9 Alessandro Acquisti et al (2016), ‘The Economics of Privacy”, Jounal of Sconomic Literanae, Vol S4,No.2,

pp 442-492,p 446

4! Reilly R kr & Schuveihs R (1999), Vahang bươngrble Assets , Mc Grav’ Hill Companies.

is the ‘property’ of people'2 Therefore, recognizing personal information as IP may

undermine, not only the freedom to trade in that information but also the public’s right

to have access to that information’?

Then, to propose the value of PD, three main perspectives can be used The first

is by assessing the value of the firm that collects, aggregates, processes, stores and disseminates the PD The second perspective determines which value persons attach to

their data The last would revolve around the values of privacy towards society

have specific drawbacks" Costs can vary considerably between firms and between

markets This may influence the value of PD as well

A general feature of data is that it can be sold over and over again without loss ofits intrinsic value The copy is just as good as the original, enabling multiple offerswithout loss of price or value A single item of PD thus will hardly have a commercialvalue Itis the composite of PD that makes a commercial difference C ombining specificclasses of PD with profiles is another way to realise commercial value Profiles can becreated bottom-up (using the available data to create meaningful subsets of data) or top-down (using pre-configured profiles to check in what group specific people wouldbelong) Both forms of profiles add to the monetary attractiveness of PD since the

grouping of data adds to the original value of the data'”

+ Sduyartz, P.M (2004), “Property, Privacy, and Personal Data”, Harvard Leow Review, Vol 117, No 7, pp

2056-2128; Petova N N (2011), Property Rights in Personal Data: A Biopean Perspective , Doctoral Thesis, Thug University.

* Dorothy J Glancy (2005), Personal Fyformation as InteNectual Property, Santa University School of Law,p 1.

OECD (2013), Exploring the Economics of Personal Data- A siavey of methodologies for measiapig monetary

value, OECD Digital Econamy Papers (2013).

+ Marc van Lieshout (2015), “The Vaằu of Personal Data”, m Jan Camenisch, Simone Fischer-Hubner, Marit Hansen (2015), Privacy and Identity Management for the Fine Snternet in the Age of Globalisation,

‘Springer Etermational Publishing, p +

Such vast amounts of collected data have obvious and substantial economic value and are increasingly regarded as business assets that can be used to target services or offers, provide relevant advertising or be traded with other parties To leverage the value inherent in PD, new services, new companies, and evennew markets have emerged The tools and products made possible by the increased availability of PD have borne benefits

for data subjects and data holders alike*®,

1.2.1.2 The Individual Perspective

PD must ultimately have some manifested utility and transparent value for theirpotential owners It must therefore be possible to embody this value in PD as a tradable,

controllable, and protection-worthy commodity*” In respect of an individual, PD or

privacy shows both non-monetary and monetary value e.g human dignity, personality

and human autonomy The non-monetary value can protect or promote otherfundamental rights and freedoms e.g self-development, autonomy, liberty and freedom

or even maintain human relations and other related interests®® These non-monetary

values have been effectively guaranteed under the human rights model

On the other hand, the valuation of the monetary value could vary considerablybetween individuals That one individual might consider this information to be highlyprivate information does not mean that another individual has the same thought andbothers to share or sell the information For example, while PD concerning health status

is legally considered to be sensitive data, on the web forum ‘Patients like me’, patientsare willing to share confidential sensitive PD with the hope that it will help in improving

treatments for the rare diseases which they suÊfe+' In other circumstances, some people

attribute a specific monetary value to their PD like Shawn Bucklets, who set up anauction in 2014 to sell his PD to the highest bidder The firm that offered the highestprice for his PD would acquire a subscription of a year to data that were collected on

** Alessandro Acquisti et al (2016), “The Economics of Privacy”, Jounal of Sconomic Literanae,Vol $4,No.2,

pp 442-492,p 444.

3' World Economix Forum (2011), Personal Data: The Emergence of a New Asset Class (Geneva 2011), An

Initiative of the World Econom Forum Jaruary 2011 — Ex Collaboration with Bain & Company, Inc.,p 7.

*° 8myarmak‡, Methinee (2023), The protection of privacy and private nyformation in the digital age: a

comparative study of Engiish and Thai lae appiving to individual me cia ses Ph D thesis , University of Glasgow, p.25

3° Available at: http -/Árvriy patentshkeme com/.

Shawn Buckles These data encompassed his personal profile, his location track records,

his train track records, his personal calendar, his email conversations, his onlineconversations, his consumer preferences, his browsing history, and his thoughts The

Next Web is the firm that pay the highest price equivalent to €350 This case of Shawn Buckets raised awareness for the commercialization of PD and the way the market of PD

‘lures’ people into the trap of sacrificing privacy for free services.

1.2.1.3 The Society Perspective

Besides bringing value to individuals and data processor/controller firms, sometheories argue that protecting privacy also conveys to society Self-dependent values do

not separate oneself from society but rather prepare one to be continuous with society’)

Protecting individual privacy is not only protecting individuals’ rights, but differentforms of social interaction are also protected Privacy, therefore, has an irreducibly socialvalue The value of privacy in promoting human relationships is no longer about

individual interests but rather about the interests of society Moreover, there are three

types of privacy values beyond individual interests: a common value, a public value, and

a collective value? More importantly, privacy is a functional necessity of democratic states since it limits surveillance from the public and ensures free societies,

The benefits arising from individuals sharing their information may be enjoyed

by society as a whole thanks to advances in data mining For instance, aggregation of

online searches may unveil unexpected interactions between pharmaceutical drugs, or

possibly provide early alerts for epidemics Conversely, other individuals’ comfort withshering data may legitimize expansions of intrusive surveillance programs that affect therest of society

1.2.2 Co-existence of the Intellectual Property Mechanism and Other Mechanisms

te Protect Personal Data

5° Available at: http //shavmbuckles nldateforsale/.

*' Dorothy Lee, Freedom coud Culture, Waveland Press pp 74-75.

** Roessler B & Mokrosinska D (2013), “Privacy and social] mteraction”, Pinlosophy & Social Criticism, Vol 39,

The process of establishing mechanisms to protect PD is influenced by two interrelated perspectives One traditional perspective revolves around granting individuals, as data subjects, a human rights model, or the right to privacy, to ensure their tights are preserved during their PD’s exploitation However, with the development of the digital economy recently, PD is gradually becoming valuable and can be exchanged

on par with currency, creating a separate market for PD As aresult, perspectives emerge

regarding granting data subjects property rights over their own PD

1.2.2.1 Protecting Personal Data as a Human Right

After World War II, the establishment of the United Nations paved the way forsubsequent recognition of human rights, including privacy rights or the right to privacy

In 1948, the Universal Declaration of Human Rights (UDHR) proclaimed the right tothe protection of privacy against interference in Article 12 Before that, privacy rights

were not recognised or acknowledged by any state constitution or domestic laws®* The

tight to privacy is the inviolable right of individuals regarding their bodies, personalinformation, secrets, images, correspondence, and personal activities Within the scope

of their private space, individuals are not subject to any unauthorized interference or

access to private factors Individuals have the freedom within their private space They can choose to disclose or not disclose content related to their private lives, choose the

timing, content, and method of sharing, and publicizing information about their privatelives if desired The right to privacy is only restricted in cases where the intrusion intoprivate space aims to protect the common interests of society, the community, or others,

and those interests are more important than the interests of the nghts holder Privacy

plays a role as a means of preserving one's intrinsic value and individuality:

The man who is compelled to live every minute of his life among othersand whose every need, thought, desire, fancy or gratification is subject

to public scrutiny, has been deprived of his individuality and human

dignity Such an individual merges with the mass His opinions, being

'* Oliver Diggehmam & Maria Nicole Cleis (2014), “How the Right to Privacy Became a Human Right”, Hioncot

Rights Leow Review, Vol 14,No 3,441-458

'+ Tran Hoang Duc (2016), “Qiagen nông ne đưới góc độ lý luận và pháp luật thaec dindt” , Master Thesis, Hanoi

Law Univesity,p 1+

public, tend never to be different; his aspirations, being known, tend always to be conventionally accepted ones; his feelings, being openly exhibited, tend to lose their quality of unique personal warmth and to become the feelings of every man Such a being, although sentient, is

fungible; he is not an individual’”.

Other than that, the right to privacy protects individuals from umvanted access to

their PD, allowing each individual to safeguard their relationships and sensitive aspects

of their personal life Furthermore, it shields them from criticism and curiosity,promoting individual autonomy and interpersonal relationships Privacy is essential for

a democratic society asit fosters the autonomy of every citizen’ In Vietnam institutions,

the recognition of moral rights is a state affirmation of honoring and protecting thespiritual values of individuals From a legal perspective, acknowledging personal rightsreflects the comprehensive development of the legal system Furthermore, regulations

on personal rights serve as the foundation for individuals to exercise their rights, as well

as for judicial and executive agencies to protect the rights and interests of individuals

Additionally, it serves as a basis for enhancing international integration®.

Privacy rights and IP rights may seem unrelated at first glance, but actually, theyhave a unique relationship When an individual creates a work of art, it is initially anintellectual product and generates property rights However, from another perspective,the work is also considered part of the individual's private sphere When that work is

copied or published without the owner's consent, it simultaneously violates both the

intellectual property rights and the privacy rights of the author However, the protection

of intellectual property rights safeguards material aspects and protects the owner fromfinancial loss, while the protection of privacy rights aims to prevent psychological harm

when one's private space is violated or personal information is disclosed Conversely,

© Easvard J Bloustein (1964), “Privacy as an Aspect of Human Dignity: An Ansvrer to Dean Prosser”, New York

University Law Review , Vol 39,pp.962-1007,p 1003.

'* Ruth Gavision (1980), “Privacy and the Limit of the Law”, The Yale Law Jovnal, Vol 89, No 3,pp 421-471,

LCs “0iyển bi mật đời ne theo guy dinh cha pháp luật đến su Việt Nam” PhD Thesis , Hanoi

Law University p 65

'° Sannuel D Warren & Louis D Brandeis (1890), “The Right to Privacy”, Havard Law Review, Vol 4,No 5,pp.

193-220,p 197

if PD such as name, age, and address are used and disseminated for profit without consent, a question arises: While individuals may be protected in terms of privacy rights, are they also protected as a form of IP ownership?

1.2.2.2 Advantages of the Intellectual Property Mechanism Compared to Other

Mechanisms

In recent years, many economists and legal commentators have argued that the

lew ought now to grant individuals property rights in their PD“ Some favor propertizing

PD as a way to allow individuals to make appropriate deals for selling their PD and toreceive compensation for uses of their PD so that markets in personal information will

work more fairly Others favor propertizing PD as a way of forcing companies to

internalize more fully the costs associated with the collection and processing of PD, inthe hope that this will lead to greater privacy There is at the moment a “lively market”

in PD, but it is a market in which individuels play at most a very small role® However,

there are still economists and legal authors who stick to the traditional perspective and

doubt whether a property rights approach to protecting PD would achieve the desiredeffect of achieving more information privacy

Viewing individuals as owners of their PD holds the potential to grant themgreater control over their data By considering PD as private property, it becomesfeasible to regard an organization as having a possessory interest in the PD lawfully

acquired from its owner Consequently, an organization may have the right to take legal

action against individuals who interfere with its possessory interest in that PDAdditionally, individuals have the strongest incentive to maximize the value of their PD;

possessing property rights in their data can help prevent others from misusing it, thereby

addressing the tragedy of the commons issue Furthermore, individuals are best

*! Kenmeth C Laudon (1993), Markets cand Privacy, Working Paper Series, STERN IS-93-21; Lawrence Lessig

(2999), “The Architecture of Privacy”, Veouderbilt Jounal of Entertcinment Law aoxd Practice pp 56-65; Patricia Mell (1996), “Seeking Shade in a Land of Perpetual Smlight: Privacy as Property m the Electronic Wildemess”, Berkeley Teclmology Law Jounal, Vol 11, No 1, pp 1-92; Richard S Murphy (1995), “Đroperty Rights in Personal Infomation: An Economic Defense of Privacy”, The Georgetown Law Jornal, Vol.96,No 1 ,pp 2381- 2419.

* Landon (1993), biả., p 92-100; Carl Shapiro & Hal Varian (1997), US Goerrmemt Syormation Policy, University of Calfomis , Berkeley.

® Landon (1993), did.,p 92.

positioned to determine the value of their data, owning property rights in their data enables them, either directly or through agents, to negotiate its sale to data collectors at

a mutually agreeable price As data collectors and users are compelled to internalize the costs associated with collecting and utilizing PD, they are likely to collect and use less

data overall.

The situation at the moment is that many firms collect and process PD because it

is valuable and because information technology makes it so much easier and cheaper to

gather and use Furthermore, they avoid internalizing the societal costs associated withprivate sector processing of PD Due to their investment of time, money, and effort incompiling, organizing, or processing data, they may perceive themselves as the rightfulowners of the data they have collected or acquired Firms would possibly reduce thecollection or processing of PD if they were required to compensate individuals for thetight to do so This approach could simultaneously achieve goals related to information

privacy while allowing individuals who are willing to sell their data to reap some benefits

from this market Moreover, a property rights regime might lead to fewer wastefulinvestments in PD by firms and the development of higher-quality databases This isbecause individuals would likely only release PD to firms from which they expect toreceive valuable information, and they would have less incentive to falsify information

to safeguard their privacy

Furthermore, a property-rights approach presents an additional potential benefitcompared to other legal methods of safeguarding privacy, as it could protect PD withoutnecessitating the creation of a significant government bureaucracy, as some countrieshave done to oversee the regulation of PD protection For example, the EuropeanDirective mandates that all member states establish "supervisory authorities" to enforcedata protection regulations, and many European countries already have established data

protection authorities in place.

In discussing whether or not to establish any IP mechanism for protecting PD,three questions spring up The first question is how IP can provide meaningful rights to

“ Pamela Sannueson (2000), “Privacy as Intellectual Property”, Steyford Law Review ,vol $2,no 5,2000,pp

1125-1173,p 1127.

data subjects The second question is how IP can provide better protection than alternative measures, such as through the law of privacy or consent to contract, either of which could conceivably render a property right in PD unnecessary The third question

is whether the grant of an IP right to data subjects would undermine both freedom of expression in the use of that data, and the free trade in that data for commercial and

public interest purposes.

In the development of personel-information-based AI technologies, Big Data,Virtual reality (VR), Internet of Things (loT), protecting PD as an IP provides datasubjects with a higher level of protection of their PD It is necessary to consider themechanism for protecting PD from the perspective of IP law alongside traditionalmechanisms for protecting PD such as criminal, civil, and administrative measures to: i)enable data subjects to fully protect and utilize the utility of their own NPD; ii) allowdata holders to confidently exploit material benefits from NPD; ii) ensure a balance

between private and public interests, between the digital society and the digital

economy

CONCLUSION OF SECTION 1

In Chapter 1, the author employs analytical methods and a systematic approach

to highlight key theoretical content related to PD and PD protection Firstly, the thesisprovides definitions of PD worldwide and the newly defined terms in Vietnam with itscheracteristics and classification Then, the thesis analyzes the rationale of protecting PD

in the information economy itself, which elaborates on the seemingly unlimitedeconomic values of PD towards related subjects, and in comparison with othermechanisms The content of Chapter 1 lays a solid theoretical foundation for researchingthe application of IP law in PD protection in Chapter 2 and further proposesrecommendations to enhance effective legal regulations regarding the use and protection

of PD from the perspective of an IP

* Leon Trakman et al (2019), “Is Privacy and Personal Data Set to Become the New Intellectual Property”,

Snternational Review of Intellectual Property cad Competition Law , University of New South Wales Law Research Series, Vol S0, Iss 8 pp 937-970 ,p 943.

** Nguyen Nhĩ Ha & Dang Minh Phmong (2024), “Bio vé dit liệu cá nhân divi gor a quyền sở hữu trí mi”, Nanonal Scientific Conference Proceedings “Dữ tiéu ca nim tong dòng chạy kanh tế số Viet Nm”„p +15.

SECTION 2 LEGAL FRAMEWORK OF VIETNAM INTELLECTUAL PROPERTY LAW ON PROTECTING PERSONAL DATA

2.1 Overview of Current Vietnam Legal Framework on Personal Data Protection

Most regional conventions, recommendations, and standards regarding privacy tights and PD protection adhere to the Security Principles of the OECD These include the Council of Europe Convention for the Protection of Individuals about Automatic

Processing of Personal Data (Convention 108); United Nations Guidelines onComputerized Personal Data Files and Data, Asia-Pacific Economic Cooperation(APEC), Framework for Cooperation on Security, International Standards on PrivacyRights and Personal Data Protection (Madrid Resolution), Organization of AmericanStates (OAS) Data Protection Law of 2014, and the recent General Data ProtectionRegulation (GDPR) of the EU Currently, over 130 countries have enacted legalprovisions on PD protection, many of which apply to organizations and individuals inVietnam This necessitates the enactment of a Personal Data Protection Law, ensuringalignm ent with intemational standards and creating a level playing field for Vietnameseenterprises in foreign markets, as well as for foreign enterprises operating in Vietnam

In realizing how significant and valuable PD is, Vietnam lawmakers feel the urge

to research and implement a legal framework on the issue of PD In particular, Vietnamhas since 2006 gradually developed a range of data privacy protections inits e-commerceand consumer laws, to the level of the OECD Guidelines (or APEC Framework) by 2014Before the Civil Code of 2015 was enacted Vietnam's legal system only recognized thetight to inviolability of residence and correspondence in the 1992 Constitution and theright to private life in the 1995 and 2005 Civil Code In 2013, the 2013 Constitution

stipulated the right to inviolability of privacy:

Everyone is entitled to the inviolability of personal privacy, personalsecrecy and familial secrecy and has the right to protect his or herhonour and prestige Information regarding personal privacy, personalsecrecy and familial secrecy is safely protected by the law

Everyone enjoys the secrecy of correspondence, telephone conversations, telegrams, and other forms of exchange of personal

information

No one is illegally allowed to open, control, and confiscate others’

correspondence, telephone conversations, telegrams, and other forms of

exchenge of personal information”

By 2023, with the continuous development of science and technology along withthe rapid expansion of the PD market, Vietnam is required to issue a specialized legaldocument to regulate problems revolving around PD, which is the Decree 13/2023/ND-

CP In this legislation, data subjects are granted more rights to control and protect PDMany aspects of the right to privacy are reflected in these regulations, such as right to beinformed, right to consentAvithdraw consent, right to access, right to delete data, right to

restrict/object data processingSS.

The 2016 Law on Cyber Information Security, the highest-level law enacted bythe National Assembly, expanded existing scattering protections into the single mostdetailed set of data privacy principles, but with its scope limited to commercial

processing and only in cyberspace® However, the public data privacy legal regimes

have shown a lack of coverage in the private sector which requires different legislation

in principles and enforcement mechanisms” The 2018 Cybersecurity Law in Vietnam

for the first time requires businesses providing online services in Vietnam to directlynotify users if their data is breached, damaged, or lost Despite the similarity with therequirements outlined in the GDPR, the 2018 Cybersecurity Law bears moreresemblance to China’s Cybersecurity Law with its primary focus on enhancing thestate’s ability to control information flow and protect critical information

infrastructure’!

#7 Article 21 of the 2013 Constitution of the Social Republic of Vietram.

** Article 9 of the Decree 13/2023/ND-CP

°° Greenleaf , Graham (2014), Asian Data Privacy Laws: Trade & Inman rights perspectives

'° Bach Thi Nha Nam & Nguyen Thi Phnong Hong (2023), “Addressing the Challenges of Data Privacy Protection

Law mn Viet”, VNU 7otawd of Science : Legal Snuties Vol 39, No 1 (2023),pp 30-44,p 34 ¬

'! Vu Cong Giao & Le Tran Nim Tuyen (2020), “Bảo vệ quyền doi với dit liệu cá nhân trong pháp Mắt quốc ti, pháp hiật ở một so quốc gia và gid trị tham khảo cho Việt Nam”, Legislative Šu#es Journal, No 09 (409).

Until 2023, Vietnam did enact a specialized legal document on PD namely the Decree 13/2023/NC-CP As a Decree made by the Government, it will not be made by the National Assembly, and therefore does not have the highest legislative status as a law However, it still shows positive signs of bringing Vietnam’s domestic regulations

up to international standards and offers some welcome additions to the existing

regulations.

2.1.1 Scope of Application

The scope of the law is comprehensive, stating that it applies to agencies,

orgenisations and individuals related to PD”, with some exceptions Hence, its

application covers the public sector and the private sector The scope of the law extends

to anyone “doing business in Vietnam””>, not only those located in Vietnam Itis unclear

in some provisions if the text applies only to the data of Vietnamese citizens Other thanthat, the definition of PD processors includes both domestic and foreign entities, but itdoes not specifically regulate which provisions would apply to each of them

2.1.2 Principles and Rights of Data Owners

Eight fundamental principles of data protection are succinctly delineated inArticle 3 of the Decree, yet the definition of legitimate purposes remains unspecifiedexcept for the general provision that PD collection is limited to cases mandated by law.The principles set out amount to specific rights in Article 9: (i) Right to be informed; (ii)Right to consent; (iii) Right to access; (iv) Right to withdraw consent; (v) Right to deletedata; (vi) Right to restrict data processing; (vii) Right to provision of data; (viii) Right toobject to data processing; (ix) Right to complain, denounce and/or initiate lawsuits, (x)Right to claim damages and (xi) Right to self-defense In comparison with the DraftDecree, the Decree has a more specific approach to the rights of data owners by building

a list of protected rights instead of scattering them in the subsequent articles in the wholeDecree

Many of these rights can be infringed upon if other legal provisions disallow orlimit them in certain ways Waiving these rights can be done through the consent of the

” Article 1 of the Decree 13/2023/ND-CP.

» Article 4 2 of the Decree 13/2023/ND-CP.

data owner and may be disregarded in various situations, such as public interest, emergencies, for statistical or research purposes after de-identification, and per the

provisions of the law’ The exception is susceptible to public concem regarding

potential widespread abuse by the government's executive branch, particularly ministries, as it grants them de facto authority to interpret laws and regulations through the use of circulars and executive decisions This is compounded by the absence of

specified legitimate interest exceptions to justify such processing

2.1.3 Other Issue

Responsibilities of PD Controller, Processor and Third Parties By regulatingthese responsibilities, the Decree shows significant advances in comparison with thedraft version Article 28 of the draft Decree only regulates generally and subtly aboutresponsibilities of ‘related parties’, which does not show the importance of this subject

in the course of the data cycle Then, their liabilities have been regulated much morespecifically to guarantee the protection of PD In particular, PD Controller is required toimplement organizational and technical measures as well as appropriate safety andsecurity measures to demonstrate the compliance of the data processing with the law on

PD protection, and to review and update these measures, as necessary” On the other

hand, PD Processor must comply with the contract or agreement while fully

implementing measures for PD protection”’.

Cross-border Transfer of Personal Data The PD of Vietnamese citizens must bekept within the borders of Vietnam The PD of Vietnamese citizens can only be

transferred after the process of impact assessment by the competent authorities” The

Ministry of Public Security shall decide to inspect the cross-border transfer of PD once

ayear, unless a violation of the regulations on PD protection prescribed herein is detected

or there is an incident of disclosure and loss of PD of Vietnamese citizens’® The Decree

has reised significant concerns for private organizations, as they must navigate

TM Article 17 of the Decree 13/2023/ND-CP.

** Article 38.1 of the Decree 13/2023/ND-CP.

Article 39 of the Decree 13/2023/ND-CP.

Article 24 of the Decree 13/2023/ND-CP.

?* Article 25.7 of the Decree 13/2023/ND-CP.

administrative and financial barriers, leading to increased costs, time, and human resources across vatious industries For instance, in sectors like e-commerce, banking, travel, education, healthcare, etc., there is a substantial demand to transfer PD overseas.

Data Protection Authority While the draft Decree creates a new committee Personal Data Protection Committee, located within the Department of Cybersecurity and High-tech Crime Prevention — Ministry of Public Security, to be in charge of

-government surveillance”, the Decree finally places the responsibility on the Department of Cybersecurity and High-tech Crime Prevention on a whole This change

is reasonable because it helps to avoid excessive bureaucratization of a state agency,which could lead to redundant labor and wastage of the state budget Furthermore, suchregulations also enable the Department to be more flexible in organizing personnel as itcan still establish a Committee when necessary In many jurisdictions such as the EU,

the competent authority is a separate and specialized data protection body that can

investigate and make findings against the private sector, then and its role and function,the operation should be independent of any unnecessary influence including public

authority.

The Decree also covers other issues as well It addresses the processing of

children’s data®!, data of deceasedindividuals®, etc The Decree onPD protection shows

a move in the awareness among the public and the authority, and significant efforts oflegislators toward global standards Overall, Vietnam’s Decree would constitute astrengthening of its data privacy legal regime To some extent, it offers clarification topreviously confusing regulations although in others proceeds to increase that confusion

Overall comment on the current protection of PD: From the perspective of the human right — right to privacy, the current legal system has quite comprehensive and

adequate protection over PD However, from an economic standpoint and in the context

of the expanding information market, the existing mechanisms for protecting PD seem

to disadvantage data subjects While companies can profit from their PD, they are only

'° Article 23,24, 25 of the draft Decree on personal data protection.

% Article 29 of the Decree 13/2023/ND-CP.

`! Article 20 of the Decree 13/2023/ND-CP.

* Article 19 of the Decree 13/2023/ND-CP.

legally protectedin terms of moral rights related to PD According to a survey conducted

by Insight N etw ork in 2019, 79% of consumers expressed their desire to be compensated

when their PD is shared®? In fact, alongside individuals concerned about the issue of

unauthorized disclosure or theft of information, some are quite willing to sell their PD

to third parties Treating PD as a form of IP that can be bought and sold with currency may reconcile both privacy rights and the pursuit of economic value from PD.

2.2 Potentiality to Protect Personal Data as an Intellectual Property

While the companies are reaping the full benefit of using customers’ PD in theirmarketing efforts or in the fee they receive when they sell the information, customersoften do not learn of the over-disclosure of their PD They may not be able to disciplinesuch companies effectively Moreover, it can be daunting for an individual consumer tobargain with such companies To overcome this market failure, in recent years, several

economists and legal commentators have proposed that the law should grant individuals

a property right in their PD which would enable individuals to bargain over their PDOthers have recommended a contractual approach to protect PD Some suggest the lewshould try to facilitate the privacy agreement the two sides would reach if they were both

well informed and it was not expensive to reach an agreementTM In the context of the

constently increasing exploitation of PD, a number of solutions are advanced in theliterature for providing greater protection to PD There are both economic and non-

economic considerations that favor greater protection for PD, have been put forwerd®*.

The thesis would approach the issue from a property respective to a more specific point

of view, which is an idea of a new IP right to protect PD®*.

2.2.1 Property Rights in Personal Data

In Vietnam, the regulation of property rights is a central and fundamental issue ofall social relations in general and the law in particular However, in the context of the

© Nguyen Thi Long (2022), “Thực trang pháp Mật Vist Nam về dio vi đế lầu cá nhân trong thời kỳ hỏi nhập”,

Joanal of Procimatorate Xe: ,No 03 — 2022 ,p 33.

*t Pamela Sanme son (2000), “Privacy as Inte Tlectua1 Property”, Stoyford Lai: Review vol 52 mo 5,2000 ,pp

1125-1173,pp 1127-1128.

** MM S Karki (2005), “Personal Data Privacy and Intellectual Property”’, Jon7al of Intelecnual Property Rights , Vol 10 pp 59-63,p 59.

*+M.M § Karki (2005), did.,p 60-61

development of information technology and telecommunications, the question of the relationship between PD and property rightsis becoming a significant focus for Vietnam.

Several commentators have observed that in an information economy, it seems almost inevitable that information will increasingly be commodified and new property

rights will be created’ The modern economy heavily relies on companies’ ability to

access, monitor, and process both PD and non-PD from our daily lives When databases

are protected by IP rights, the company collecting this data becomes the rightful owner.This elucidates why companies like Facebook, Twitter, or Google generate profits bycollecting processing, and selling the personal and non-PD of their users instead ofcherging subscription fees U sers essentially "pay" for these services not with money but

by providing their own date®®.

Grenting individuals property rights in their data would seem to be consistent withthis general trend and with the emergence of an “attention economy.” A 2005 draft ofPersonal Information Protection Measures for the Personal’s Republic of China declared

that

[Personal information, as a part of a person's right of privacy, is acitizen's “intangible property,” and those who steal other's personalinformation for financial gain are in violation of the law and shall beduly punished.” (CRI, January 9, 2006)

Contrary to the opinions of human rights advocates, considering PD or privacy as

a general property is to treat the person who is the subject of that right as just an asset,

or asset-generator” The proposals of PD propertization have received considerable

attention in data protection literature asit provides an individual the opportunity to either trade data about him/her for money or services or waive his/her data protection rights

based on market conditions They argue that the waiver of data protection rights is only

* Rochelle C Dreyfuss (1988), “infomation Products: A Challenge to Intellectual Property Theory”, New York

University Joranal of International Law and Politics ,Vol 20, Issue +,pp 897-927; JH Reiclunm (1994), “Legal Hybrids Betvreen the Patent and Copyright Paradigms”, Colsaubia Leow Review , Vol 94,No 9,pp 2432-2558.

** Genxua Mavero Abjandre (2021), “Ovmership of Databases: Personal Data Protection and Intellectual Property

Rights on Databases”? Ziropean Review of Private Law , $-2021,pp 733-756, p 735

* L Trakmam et +1 (2019)., “Is Privacy and Personal Data Set to Become the New Intellectual Property?”’, International Review of Intellectual Property and Competition Law , University of New South Wales Law Research Series, Vol 50, Iss $ ,pp 937-970 ,p 953.

possible if one is deprived of the protection of a fundamental right to privacyTM In this

present day, Vietnam legal framework also adheres to the perspective that PD is the subject of privacy rights, which is a personal value, inseparable from an individual, and cannot be transferred or valued in terms of money However, there exists a notable absence of precise delineation regarding the legal status of PD, whether it should be

construed as the object of privacy rights or categorized as a form of property”.

A property rights model offers two principal benefits: (2) it would establish a right

in individuals to sell their PD and thereby capture some of the value their data have inthe marketplace; (ii) a property rights model would force companies to intemalize certainsocial costs now borne by others from the widespread collection and use of PD Thisapproach to PD protection would, in essence, establish a new form of IP rights ininformation But it would be an IP right of a very different sort than existing regimesprovide Deep differences raise serious doubts about the viability of a property rights

approach and about its prospects of achieving information privacy goals”,

Broadly speaking there are three main types of property: private property,common property and public property which represent three systems of rules governing

people’s access to and control over resources? Ina private property system, individual

asset owners determine who has access to their resources and how those resources shall

be used while in a common property system, the community or a class of defined usersdetermines how resources are to be used In addition, a public property system grantsaccess of resources to all members of society, subject only to restrictions that aim to

secure fair access for allTM.

”° Purtova N.N (2011), Property Rigits in Personal Data: A Frropean Perspective, Doctoral Thesis, Tiburg