SANCTIONS FOR ACTS OF BUYING AND SELLING CUSTOMER INFORMATION
In the era of high technology, any business wants to own a huge amount of customer information to serve the purpose of "closing sales" and expanding business operations. However, not many businesses understand the risks of having this kind of sensitive information. If disclosing or trading customer information, how will businesses be punished for the above behavior?
Through this article, DTD will analyze and clarify penalties for buying and selling customer information.
1. General overview of the behavior of buying and selling customer information
Customer information (or customer data) is the personal information (personal information) of consumers, aggregated and stored by businesses providing products and services. Consumers, in most cases, will be required to provide personal information to businesses to serve transactions.
The two most basic information commonly collected by parties is the name and phone number. For specific industries, more detailed information about users will be collected for the purpose of behavioral or advertising research.
Buying and selling customer information means an individual or an organization buying and selling its customer data to another third party for the purpose of making a profit. In fact, the price for each customer data package varies from a few hundred to several million, depending on the "potential" level of customers.
2. Sanctions apply to acts of buying and selling customer information
The Constitution, the Civil Code, the Consumer Protection Law and many specialized legal documents such as Vietnam's laws on telecommunications, information technology and electronic transactions all have basic rights. of citizens and protect personal information. The 2013 Constitution states: "Everyone has the right to inviolability of private life, personal secrets and family secrets; have the right to protect his honor and reputation. Information about private life, personal secrets and family secrets is guaranteed by law ”
Article 38 of the Civil Code 2015 stipulates: “Personal privacy rights are respected and protected by law” or “Letters, telephone, telegrams, other forms of electronic information of individuals. security and confidentiality ".
Clause 5, Article 7 of the Law on network information security stipulates prohibited acts:
“5. Illegally collecting, using, distributing or trading other people's personal information; take advantage of loopholes and weaknesses of the information system to collect and exploit personal information. ”
Thus, the act of buying and selling customer information is against the law. In addition to the provisions on rights and obligations of data owners, data collectors, data processors, Vietnamese law also provides sanctions for acts of distributing and sharing personal information. According to the seriousness and behavior, violating organizations and individuals will be handled with administrative violations or criminal liability. Specifically:
* Administrative responsibilities
According to Clause 5, Article 102 of Decree 15/2020 / ND-CP stipulating sanctions against administrative violations in the fields of post, telecommunications, radio frequency, information technology and electronic transactions:
“5. A fine ranging from VND 50,000,000 to VND 70,000,000 shall be imposed for any of the following violations:
a) Illegally trading or exchanging private information of users of telecommunications services; "
For acts of trading, exchanging customer information, individuals and organizations may be fined from 50 million to 70 million dong. In addition, individuals and organizations that commit the above acts may be deprived of the right to use social networking establishment licenses for between 22 months and 24 months and forcible remittance of illicit benefits gained from committing acts of violation. (Points a and b, Clause 9, Article 102 of Decree No. 15/2020 / ND-CP)
* Criminal responsibility
Those who commit the purchase and sale of customer data, depending on the nature and severity of their violations, may be handled according to the 2015 Penal Code, amended and supplemented in 2017 on charges of “Giving or using illegal information on computer networks and telecommunication networks” with the highest penalty frame of 7 years imprisonment.
As such, Vietnamese law also has strict sanctions against those who illegally collect and use personal information of consumers.
