Chương V Nghị định 52/2013/NĐ-CP thương mại điện tử: An toàn, an ninh trong giao dịch thương mại điện tử

Chapter V

SAFETY AND SECURITY IN E-COMMERCE TRANSACTIONS

Section 1. PERSONAL INFORMATION PROTECTION IN E-COMMERCE

Article 68. Responsibility to protect personal information of consumers

1. When conducting e-commerce business activities, traders, organizations or individuals that collect personal information of consumers shall comply with this Decree and relevant regulations on protection of personal information.

2. In case a trader, organization or individual engaged in e-commerce business activities authorizes a third party to collect and store personal information of consumers:

a/ The contract between the two parties must clearly define the responsibility of each party to comply with this Decree and relevant regulations on protection of personal information;

b/ If the contract between the two parties does not clearly define the responsibility of each party, the trader, organization or individual engaged in e-commerce business activities shall take responsibility in case the collection, storage and use of personal information of consumers violate this Decree and relevant regulations on protection of personal information.

Article 69. Policy on protection of personal information of consumers

1. Trader, organizations or individuals that collect and use personal information of consumers shall formulate and announce their personal information protection policy with the following details:

a/ Purpose(s) of collection of personal information;

b/ Scope of information use;

c/ Duration of information storage;

d/ Persons or organizations that may access such information;

dd/ Address of the information collection and management unit, indicating how consumers can ask about the collection and processing of information relevant to them;

e/ Method and tools for consumers to access and modify their personal data on the e-commerce system of the information collection unit.

2. The above details must be clearly displayed to consumers before or at the time of information collection.

3. If the information collection is conducted through e-commerce websites of information collection units, the personal information protection policy must be publicly displayed at an easy-to-spot position on these websites.

Article 70. Asking for consumer permission upon information collection

1. Except the cases specified in Clause 4 of this Article, traders and organizations that collect and use personal information of consumers on their e-commerce websites (below collectively referred to as information collection units) shall obtain prior consent of consumers having such information (below referred to as information subjects).

2. Information collection units shall develop a mechanism for information subjects to express their consent explicitly through online functions on their websites, emails, messages or otherwise as agreed upon by the two parties.

3. Information collection units shall develop a separate mechanism for information subjects to choose to permit or not to permit the use of their personal information in the following cases:

a/ Sharing, disclosure or transfer of information to a third party;

b/ Use of personal information for sending advertisements, product introductions and other commercial information.

4. Information collection units are not required to obtain prior consent of information subjects in the following cases:

a/ Collection of personal information already published on e-commerce websites;

b/ Collection of personal information for concluding or performing goods and service purchase and sale contracts;

c/ Collection of personal information for calculating prices or charges for use of information, products and services online.

Article 71. Use of personal information

1. Information collection units shall use personal information of consumers for purposes and within scopes already notified, except the following cases:

a/ They have separate agreements with information subjects on use purpose and scope other than those they have notified;

b/ To provide services or products at the request of information subjects;

c/ To perform the obligations prescribed by law.

2. The use of information prescribed in this Article includes sharing, disclosure and transfer of personal information to third parties.

Article 72. Assurance of personal information safety and security

1. Information collection units shall assure safety and security of personal information which they have collected and stored, and prevent the following acts:

a/ Hacking or illegally accessing information;

b/ Illegally using information;

c/ Illegally altering or destroying information.

2. Information collection units shall formulate mechanisms for receiving and settling consumer complaints about the use of personal information for improper purposes or beyond the notified scope.

3. In case an information system is hacked, posing a risk of loss of consumer information, information storing units shall notify the incident to a functional agency within 24 (twenty-four) hours after detecting it.

Article 73. Checking, updating and modification of personal information

1. Information subjects may request information collection units to check, update, modify or delete their personal information.

2. Information collection units shall check, update, modify or delete personal information of information subjects when so requested or provide information subjects with tools for self checking, updating or modification of their personal information.

Section 2. PAYMENT SAFETY IN E-COMMERCE

Article 74. Responsibilities of traders, organizations or individuals that own e-commerce websites with the online payment function

1. Traders, organizations or individuals that own e-commerce websites with the online payment function shall assure safety and confidentiality of payment transactions of their customers, settle complaints and pay damages in case customer payment information via e-commerce websites is illegally altered, deleted, destroyed, copied, revealed, removed or appropriated, causing damage to customers.

2. In case of self-developing payment solutions to exclusively serve their own sales e-commerce websites, traders, organizations or individuals that own these websites shall apply the following measures to assure safety and confidentiality of customer payment transactions:

a/ Setting up an information system to serve payment activities and assure online connection around the clock 24 (twenty-four) hours a day and 7 (seven) days a week. The suspension of the system for maintenance must not exceed 12 (twelve) hours each time and be notified in advance to customers;

b/ Encrypting information and using security protocols to prevent information leakage during transmission;

c/ Deploying applications which are capable of detecting, warning and preventing illegal accesses and various online attacks against the information systems serving their online payment activities;

d/ Having plans to control the right to access the system and the right to enter or leave places where information system equipment are installed to serve their online payment activities;

dd/ Establishing processes and systems for copying, storing and recovering data when the information systems serving payment activities encounter incidents, assuring copying and storage of payment data on media or online copying and caching of all data;

e/ Storing data on each payment transaction for a time limit prescribed in the Accounting Law;

g/ In case customers make payments before purchasing goods and services, customers’ payments must be kept at payment service providers and customers must be provided with tools to monitor their payment balances on the system.

3. Traders, organizations or individuals that own e-commerce websites with the online payment function shall publicize on their websites the policy on confidentiality of customer payment information.

Article 75. Responsibilities of traders and organizations providing payment intermediary services for e-commerce websites

1. To comply with regulations and technical regulations on payment intermediary services promulgated by the State Bank of Vietnam.

2. To store data on each payment transaction conducted via their systems for a time limit prescribed in the Accounting Law.

3. To take joint responsibility with traders, organizations or individuals that own e-commerce websites using their payment intermediary service for cases in which payment information of customers is illegally altered, deleted or destroyed, copied, revealed, removed or appropriated, causing damage to customers.

4. Before the 15th of January every year, to report to the Ministry of Industry and Trade statistics on the provision of services to traders, organizations or individuals involved in e-commerce activities.