Decree 13/2023/ND-CP ("Decree 13") was enacted at a time when the digital transformation of Vietnam's economy was occurring rapidly. At the same time, data protection is gradually becoming a major concern for parties. In previous articles, we have also mentioned the most general impact of Decree 13 on business operations, while listing some difficulties and challenges for businesses in complying with the Decree.
In this article, we will again refer to Decree 13, but under a narrower aspect, in particular the conclusion and implementation of employment contracts during the period of validity of Decree 13.
The need to comply with personal data protection regulations in the field of labor
Generally speaking, labor issues are the biggest concern for many companies, especially when data protection regulations have come into effect and directly affect the operation of companies.
Labor can be considered as one of the aspects involving the processing of personal data, such as the collection and processing of employees' personal data or the outbound transfer of personal data.
Currently, the Labor Code requires employees to provide their employers with accurate information, such as name, date of birth, gender, place of residence, education, professional qualifications, certification of health status and other issues directly related to the conclusion of the employment contract, if required by the employer. The law has left a wide scope of information that the employer may require the employee to provide, resulting in the case where employees are required to provide a lot of sensitive personal information and data, even if such information is not related to the employee's work. In addition, not enough attention has been paid to the management and protection of employees' personal data, which may pose legal risks to companies as they often share employees' data with third parties, such as human resources service companies, tax authorities, insurance agencies, or multinational companies transfer employees' personal data overseas.
Vietnam is a country with rapid development, especially the development of digital economy, the illegal exploitation of employee data is a rather painful problem that requires strict management by the relevant authority. Therefore, Decree 13 was issued to solve such problems.
The impact of Decree 13/2023/ND-CP on the implementation of the employment contracts
As mentioned above, Clause 2 of Article 16 of the Labor Law 2019 stipulates that the employee must provide accurate information such as name, date of birth, health status, place of residence, education, professional skills, and other information related to the conclusion of the labor contract as requested by the company. However, within the scope of the law we are not clear whether the employee is only obliged to provide information to the company and the company uses this information only to conclude the employment contract or is allowed to use the information provided by the employee to provide to other third parties or serve the implementation of labor contracts, management of employees. In order to avoid the possible risk, these provisions shall be understood only in the relationship between the employee and the Company, in which case the employee shall provide information to the Company to conclude the employment contract without using such information to provide to other third parties. The reason for such provision is that Decree 13 has provisions on cases of personal data without the consent of the data subject, including the case of disclosure according to the law. Comparing the aforementioned provisions, it can be seen that the provision that the information provided by employees to companies cannot be considered as public disclosure of personal data. Therefore, almost every activity of the company related to the processing of employees' personal data, including collection, storage, analysis, transfer to third parties and transfer abroad, must be approved by the employees. This has a major impact on the way companies operate, as it has been common practice for employees to provide information to companies. At the same time, how companies process employees' personal data is also a private matter for companies, and employees do not seem to know, and it is very difficult to control. However, under Decree 13, companies must obtain employee consent for almost all personal data processing activities and inform employees when personal data is processed.
.png)
It's worth noting that obtaining the consent of employees must be expressed in forms that can be printed, copied in writing, or in a verifiable form, as established by Decree 13/2023/ND-CP, such as in writing, by voice, by ticking the yes box, by agreeing to the syntax via message, by choosing the opt-in technical settings, or by any other action. In the simplest way, companies usually obtain the consent of employees by including the direct opinion of the employee in the employment contract. Under such regulations, it is expected that companies will have to make adjustments to their employment contract templates.
Not to mention, in the process of implementing the employment contract, if the processing of personal data arises without being notified at the time of signing the employment contract, companies must notify employees and this notice must be expressed in a format that can be printed, reproduced in writing, including in electronic form, or in a verifiable format. In addition, there are many other obligations that companies must comply with during the implementation of the contract, including the provision of personal data, correction of personal data, withdrawal of consent, deletion of personal data, etc. Among the above obligations, the obligations to ensure the employee's withdrawal of consent and request for deletion of personal data are the most notable obligations.
The circumstances in which the employee withdraws consent or requests the company to delete personal data are considered to be vague provisions and difficult to apply in practice. This is because, according to Decree 13, the data subject has the right to withdraw consent and request the data controller, the data controller cum processor to delete personal data. Under these provisions, it can be understood that the employee, upon termination of the employment contract, has the right to object to the continuation of the storage and processing of personal data by the company and has the right to request the company to delete his or her personal data. However, the storage of personal data may be used not only for the performance of the employment contract, but also for the resolution of any disputes that may arise after the termination of the contract (if any). Therefore, allowing employees to request companies to delete personal data would have a negative impact on companies. At present, the above-mentioned provisions have not yet been clarified, which may create obstacles for companies in complying with Decree 13.
Some recommended solutions for companies
Company shall first obtain the Employee's consent to provide personal data for the purpose of entering into and performing the Agreement. The company shall emphasize the implementation of the contract, including the settlement of disputes arising from the implementation of the contract. At the same time, the company must list all personal data processing activities related to the employee's personal data, such as storage, analysis, evaluation, transfer to the human resources management service provider, transfer to the company's event organizer, etc. The more detailed the list at the time of the contract's execution, the more detailed the list will be. The more detailed the list at the time of signing the employment contract, the more it will help the company to avoid repeating this activity when new personal data processing activities arise.
In addition, regarding the method of obtaining the employee's consent, the company may include this content in the appendix attached to the employment contract or make a separate agreement with the employee, which can be easily adapted in practice.
.png)
Regarding the withdrawal of consent and the request for the deletion of employees' data, although the regulations seem to be vague when it comes to compliance in practice, companies should still pay attention to certain issues related to this obligation. In order to continue to store employees' personal data after the termination of the employment contract, in addition to clarifying the purpose of storing the personal data for dispute resolution as mentioned above, the company should avoid making the employees' consent dependent on the validity of the employment contract. In other words, the company shall extend the storage of personal data for an additional period of 1 to 2 years from the date of termination to prepare for possible disputes. To solve the problems, we believe that the company can prepare a written authorization to obtain the employee's consent, which is separate from the employment contract, to ensure that the employee's consent is independent of the employment contract and does not end when the employment contract is terminated.
In conclusion, labor is an aspect that may be greatly affected by Decree 13. However, due to the vague provisions and the lack of an official guide for the implementation of Decree 13, the difficulties and pressures for companies to comply with this decree are great. However, in the context of the gradual completion of the Decree on administrative sanctions for violations in the field of cybersecurity, which mentions sanctions for failure to comply with personal data protection regulations, companies still need to review their activities in the labor aspect to make prompt adjustments to avoid risks of being sanctioned by the law.
