1. Introduction
Over the last three decades, constant law reform projects have gradually introduced higher privacy and personal information protection standards in Vietnam (Greenleaf, Reference Greenleaf2021, p. 1). While these efforts slowly established Vietnam as a prominent player in the global data privacy law landscape, they have also constantly triggered new understandings of privacy among state and social actors and added to the complexity of the country’s privacy framework (Greenleaf, Reference Greenleaf2013, pp. 4–5, 7). Together with the perplexing regulatory system, the continuously refreshed regulatory logic resulted in the ambiguity of privacy law in general and posed a serious challenge to the digital transformation agenda in Vietnam.
In April 2023, after almost five years of heated discussions, the Vietnamese government officially enacted Decree 13/2023/ NĐ-CP concerning Personal Data Protection (hereafter referred to as PDPD). The decree introduced strict standards of personal data protection regulation to Vietnam and officially recognised concepts such as “personal data” and “sensitive data” for the first time. It also established a centralised and un-independent government authority to supervise data processing activities that fell under its scope (Nguyen, Tran and Piemwichai, Reference Nguyen, Tran and Piemwichai2023). It relates to Vietnam’s controversial Law on Cybersecurity in several ways, notably through the centralised oversight of personal data processing conducted mainly by the Cybersecurity department within the Ministry of Public Security (MOPS) and the probable exemptions granted to public sector entities regarding compliance with its regulations (Greenleaf, Reference Greenleaf2021, p. 2).
While most data privacy regulations worldwide today are based on the idea that individuals should be able to determine the communication of information about them to others, especially concerning governmental and institutional entities (Richardson, Reference Richardson2020, p. 23), the PDPD deviated quite considerably from this notion. It acknowledges the multiple rights of data subjects regarding their data while reinforcing state regulations regarding personal data processing. Additionally, it requires data controllers and processors to comply with thorough state oversight. In recent years, the Vietnamese party-state has emphasised data security goals in a National Digital Transformation Program (Griffith Asia Institute, 2023). These goals were designed to foster a digital business-friendly environment, prevent transnational crimes, and ensure national safety and state sovereignty in cyberspace (Vietnamnet Global, 2023). While the impact of the global privacy frameworks on the development of data privacy principles in Vietnam remains doubtful (Greenleaf, Reference Greenleaf2009, pp. 39–40; Greenleaf, Reference Greenleaf2012, p. 2), the centralised approach to data privacy regulation raises concerns about the potential legitimisation of state involvement in individual affairs, polished by the narrative of ensuring the safety of all (Nguyen, Reference Nguyen2023). This article uses empirical research to explore the perplexed layers of meaning underlying the PDPD’s data privacy regulations. Building on the recursive nature of regulatory interpretations, this article explores how concepts of safety and security that inform personal data protection have evolved within a framework of meaning shaped by common regulatory beliefs among state and social actors in Vietnam.
Research on the global interpretations of privacy shows that the meaning and value of privacy are commonly determined by individuals’ claims for the enjoyment of private life free from outside intrusion (Richardson, Reference Richardson2020, pp. 16, 21); under the advent of surveillance technologies in the mid-twentieth century, the notion extended to encompass “the claim of individuals, groups, or institutions to control when, how, and to what extent information about them is shared with others” (Westin, Reference Westin1970, p. 7). Privacy can thus be understood in terms of the recognition of individual privacy rights in formal human rights law or a set of rules that ensure individuals’ experiences of privacy and personal autonomous growth by retaining their control in decisions about the use of personal information and securing the integrity of information flows (Hughes, Reference Hughes2012, p. 810; Burdon, Reference Burdon2020, pp. 101–103, 106). Based on such understanding, information privacy regulation systems across the globe commonly revolve around limiting state and corporate surveillance power by preventing unlawful access to and unauthorised use of personal information/data. These models grant data subjects the ability to exercise self-determination over personal data, protecting them from misuse by data processors, controllers, and government entities; some also subtly secure the legitimate interests of controllers in processing personal data by constructing balancing mechanisms (Bygrave, Reference Bygrave2014, pp. 119–122).
In contrast to these individual-based approaches, the research in this article shows that the Vietnamese PDPD adopted a more relational understanding of privacy. This article contends that Vietnam’s PDPD is founded on the idea that safeguarding personal data serves the collective goals of public safety and national security, positioning it as a vital task of the state in digital transformation. Such an approach is underpinned by the complication between the meanings of “safety” and “security” in Vietnam’s political, social, and legal discourse. In the Vietnamese language, “safety” is represented by the term “an toàn,” while “security” is denoted by “an ninh.” Although these terms are semantically interrelated, “an toàn” carries a more civic and private connotation, often associated with the subjective feeling of being secure, while the term “an ninh” has been customarily linked to the role and authority of public security forces responsible for maintaining communal safety and national security.
This centralised approach to data privacy—strengthening state authority to oversee data processing activities and enhance its legitimacy as the ultimate protector of citizens’ privacy—is slowly taking place in socialist East Asian countries like China (Jia, Reference Jia2024, p. 803) and Vietnam (Nguyen, Reference Nguyen2023). The transformation of privacy—from a concept focused on individual rights and scepticism towards state surveillance to one that aligns personal interests with governmental agendas regarding cybersecurity in Vietnam—raises important questions about the reasons and dynamics behind this change. This investigation would also shed light on China’s complex approach to data privacy, which shares a similar focus on public security concerns over personal privacy (Bui and Lee, Reference Bui and Lee2022, pp. 652–664; Pernot-Leplay, Reference Pernot-Leplay2020, p. 68).
The article outlines a framework based on social constructivist approaches to regulation to understand the complexities underpinning the PDPD. Lawrence Lessig famously claimed that social meaning arises from and within a complex regulation model, with subjective behaviours restrained and adapted to the regulatory modalities (Lessig, Reference Lessig1995, pp. 951–1000; Lessig, Reference Lessig2006, pp. 122–130). As a corrective to Lessig’s theory, Murray’s networked communitarianism offers a framework to analyse how regulatory meaning is constructed within shared networks involving state and non-state actors. The theory posits that the regulated also shapes regulatory meanings through their acceptance of or contention with regulation, fostering a collective understanding of regulation that reflects shared ideas, beliefs, ideals, and opinions (Murray, Reference Murray2011b, p. 205). Schrepel further complicates the theory by adding that those subjected to the modalities of regulation can, in effect, proactively adapt and bring corresponding modifications to the set constraints in a complex dynamic “feedback loop” (Schrepel, Reference Schrepel2022). The theoretical framework prompts the central question of to what extent the regulators and regulated participate in regulatory dialogues and shapes the meaning of state-initiated data privacy regulation.
This article provides insights into the safety and security meanings of data privacy in Vietnam by analysing the state’s and other social discourses about privacy regulation during the drafting process of the PDPD. The data are gathered from publicly available online discussions and in-depth interviews with key actors involved in the deliberations about privacy regulation. The ideas circulated between state and non-state actors via various mediated channels during the PDPD’s drafting process demonstrate the dialogue between regulators and those regulated, shaping how privacy is conceived among them. The discursive materials also revealed the shared regulatory principles among different communities and how these principles shape the understanding of data privacy regulations among actors immersed in data privacy’s regulatory networks. This analysis enhances our understanding of how discussions across communities in networked environments shape the meaning of data privacy regulation in Vietnam.
The article proceeds as follows. Part 2 briefly reviews Vietnam’s privacy law paradigm and provides initial insights into its distinctions from other prominent approaches. Part 3 sets out a theoretical framework to explore how state and social actors complicated the meaning of data privacy regulation in Vietnam. Part 4 explains how data were collected and the methods used to study the social construction of data privacy regulation. The drafting process of Vietnam’s PDPD was chosen for this study as it highlights the interactions between state and non-state actors. In addition, the assumptions and beliefs of the regulatees in response to the regulatory modalities reveal the shared assumptions and implicit beliefs among actors who are part of different, overlapping networks subject to varying degrees of control. It is argued that the regulatee’s expectations of safety and security not only correspond to but also navigate their degrees of adaptation to different regulatory modalities; state actors being immersed within different regulatory communities also respond to the expectations and touch selectively upon the corresponding discourse to create consensus towards state authority to oversee data protection activities. In Part 5, the social meaning of the PDPD is reconstructed using discursive materials acquired from public discourses and in-depth interviews with representatives from both communities. Finally, Part 6 reflects on the theoretical framework and discusses how the shared ideas of privacy and the communitarian assumption of cybersecurity came together during the “dynamic feedback loop” of social meaning construction and complicated the understanding of data privacy regulation in a socialist country.
2. The development of privacy regulation in Vietnam
2.1. Political dynamics and human rights law
While economic factors have often been used to justify policy designs and regulatory approaches in Vietnam formally, research across different regulatory domains in Vietnam reveals that considerations of state authority, legitimacy of controls over economic sectors and civil society, and political ideology significantly influence regulatory choices and legal enforcement (Gillespie, Reference Gillespie2023, pp. 225–229). Political and economic agendas are generally formulated and approved by adherents of Marxist-Leninist principles who also hold key positions within the government (Sidel, Reference Sidel2008, pp. 142, 193; Sidel, Reference Sidel2009, pp. 137, 131; Pham and Do, Reference Pham, Do, Fu, Gillespie, Nicholson and Partlett2018, pp. 109–111). Most “regulatory elites,” such as legislators, policymakers, legal scholars, and economists, are devoted members of the ruling party (Gillespie, Reference Gillespie, Fu, Gillespie, Nicholson and Partlett2018, p. 349; Pham and Do, Reference Pham, Do, Fu, Gillespie, Nicholson and Partlett2018, p. 101). Therefore, policy and regulation are generally construed in accordance with core socialist principles and reflect a struggle to retain state control in critical regulation domains (Gillespie, Reference Gillespie, Fu, Gillespie, Nicholson and Partlett2018, p. 348). Despite the collapse of socialist legal systems elsewhere, the intertwining of the socialist-oriented political ideology and socioeconomic initiatives continues to shape policy development and the legal framework in Vietnam (Pham and Do, Reference Pham, Do, Fu, Gillespie, Nicholson and Partlett2018, pp. 110–114).
It is generally accepted that privacy necessitates appropriate recognition and protection within national human rights law frameworks. But human rights issues in Vietnam bear a long and winding road. The concept of human rights was absent from Vietnamese law for centuries. Although some notions of natural rights were partially acknowledged in the 1946 Constitution of Vietnam, official state discourse had not touched upon the concept of human rights for almost 30 years before Doi Moi. At various points in time, the discussion surrounding human rights was unwelcomed due to a widespread belief that human rights discourse is a strategic tool by which powerful global nations could potentially interfere with Vietnam’s sovereignty (Mai, Reference Mai2023). The concept of human rights was only partially acknowledged in the 1946 Constitution, and it was not a prominent feature in political and legal discussions between the 1950s and the 1990s in Vietnam (Bui, Reference Bui2022, p. 304).
The idea of human rights, particularly in the liberal and universal sense, was only reintroduced and made one of the central objectives of legal reform after the 11th National Party Congress in 2011 (Bui, Reference Bui2014, p. 95). Notably, writing by party cadres on human rights law traces the root of human rights ideas back to Ho Chi Minh’s thinking and international inspirations like the Universal Declaration of Human Rights (Phương, Reference Phương2013) to legitimise the restoration of human rights into formal legal instruments like the amended Constitution in 2013 (Bui, Reference Bui2014, p. 91). For Western-origin human rights discourses to be accepted in Vietnam, they need to be adapted to the existing epistemologies. Research shows that liberal, universalist notions of human rights had influenced constitutional reforms in Vietnam. But they got mixed up with the more orthodox understanding of “socialist legality,” which emphasises, among others, the centralised rule of the party-state and the predominance of collective interest over individual rights (Bui, Reference Bui2014, pp. 80, 94). A well-known declaration from the party-state illustrates this thinking: “The State takes care of and serves the people, ensuring the legitimate rights and interests of all people.” (The Communist Party of Vietnam, 2011, p. 247).
The notion of “the State taking care of people’s rights” has been deeply ingrained in formal human rights discourses. An article in the Journal of Party Construction (Tạp chí Xây dựng Đảng), one of the official media outlets of the Vietnamese Communist Party (CPV), explains that implementing measures like “social security and welfare, human security, creating significant changes in social development management, advancing social progress and justice, and enhancing the quality of life and well-being of the people” are fundamental objectives for state-building in Vietnam. The objectives also include “maintaining political security, ensuring order, social safety, human security, economic security, and network security.” All of these objectives are aligned with the promotion of human security protection, which is closely associated with notions of human rights and national security (Nguyễn, Reference Nguyễn2021). Furthermore, this notion of public security, underpinned by a communitarian meaning, enigmatically requires citizens to give up personal interests for more outstanding collective interests justified by the party-state (Gillespie, Reference Gillespie, Fu, Gillespie, Nicholson and Partlett2018, pp. 326–327).
In this sense, there is a broad consensus among state and social actors that the protection of human rights can be reached by ensuring social safety, human security, and cybersecurity in cyberspace. The relation between party policy, institutional reform, and the makings of human rights law is clarified in the passage excerpted from a 2013 Communism Review article as follows: “The most important thing is that the Party leads the entire people to continue promoting socioeconomic reform, deepening the cause of industrialization and modernization of the country and further promoting socialist democracy.” (Phương, Reference Phương2013).
Having built upon this mixed tenet, the concept of privacy protection in Vietnam could hardly escape the confused understanding which complicates individual claims for private spaces and control over information with deep state involvement in private data protection matters. Privacy is recategorised into a system of civil law “personality rights” (quyền nhân thân) in the 2015 Civil Code; it is constructed as a right to “private life, personal secrets, family secrets” (Article 38). However, the epistemic connection between “the right to privacy” and “personal data protection” is not clearly predicated. Unlike China, Vietnam has not recognised a specific civil right towards personal information/personal data (Pernot-Leplay, Reference Pernot-Leplay2020 p. 67; Wang, Reference Wang, Wang and Shi2022, p. 35).
2.2. Complicating privacy regulations
Privacy, in the general sense of “the value of being able to enjoy a private life, free from unwanted intrusion from the outside” (Richardson, Reference Richardson2020, p. 21), was not explicitly recognised as a norm in traditional Vietnamese morals and laws. Under the influences of Confucian ethics, an individual’s reputation (danh) held great significance to one’s choices of behaviours in daily commune lives; privacy could rather be understood in the sense of withdrawal from public life into private spaces to cultivate one’s virtues and as a defensive mechanism to save their face values from being deteriorated if exposed with shameful actions. However, the Confucian (and Taoist) thoughts did not generate sufficient tenets to conceive privacy as a separation between things properly of government concern and those of no concern to anyone but the individual (Whitman, Reference Whitman, Munro and Arbor1985, p. 93). In the imperial codes of the Lê and Nguyễn dynasties, laws acknowledged and protected individuals from unlawful infringements on their honour and reputation. However, research shows that these imperial codes did not provide for privacy in the sense of personal freedom and integrity from public forces as it has been conceived in modern Western laws (Tạ, Reference Tạ1989, pp. 66–68).
Privacy in a liberal language appeared scantily in some publications after the establishment of modern Vietnam; the idea of a legal right to privacy was paid little attention before Đổi Mới. There had been several rules to protect personal correspondence and the privacy of homes since the 1950s, but an explicit recognition of privacy rights only debuted in the 1995 Civil Code as “the right to private life secret.” The 2013 Constitution established, for the first time at the constitutional level, the right to the inviolability of private life, personal secrets, and family secrets using the affirmative language of a universal human right (Article 21). The 2015 Civil Code adopted the Constitution’s vocabulary. It granted individuals the right to “private life, personal secrets, family secrets” (Article 38) alongside other categories of personality rights such as the right to protection of honour and dignity (Article 34) and guaranteeing confidentiality of private communication, including correspondence, telephone calls, telegrams, and other means (Article 38, subsection 3). The protection of personal information is categorised under subsection 2 of Article 38, but it was presented as a requirement to obtain subject consent when collecting, storing, using, and disclosing their personal information.
Moreover, privacy lacks adequate discussion beyond the statutory analysis found in legal scholarship. The Civil Code has no specific provision for privacy-related tort liability. Instead, a particular tort liability has been constructed for reputation-related harms, resembling privacy-related tort (Nguyễn, Reference Nguyễn2020, p. 236). In practice, Vietnamese courts have rarely directly addressed privacy claims. In some instances, the court has even seemingly treated infringements on reputation as equivalent to privacy violations (Nguyễn, Reference Nguyễn2020, p. 236; Nguyễn, Reference Nguyễn2023, pp. 90–92). Without clear judicial interpretations of privacy, most discussions about privacy law in Vietnam rely merely on the limited expressions of privacy in statutes and regulatory decrees. Altogether, the insufficient theorisation of privacy resulted in a fragmented regulatory framework and scattered rules across the laws.
The introduction of the PDPD further complicated the already complex privacy regulation framework. While the recognition of data subject’s rights and the corresponding responsibilities of data controllers and processors in the PDPD may appear to align with the existing privacy rights framework, these concepts are implemented using distinct regulatory methods. The PDPD was developed under the explicit directive of the CPV, as clearly stated in the documents of the 13th National Congress of the CPV, with a primary objective of “ensuring cyber safety and security.” Furthermore, the PDPD indicated explicitly that it mapped onto the regulatory tenets inscribed in the Law on National Security and the Law on Cybersecurity. In addition, the use of strong administrative terms such as “disciplinary” (xử lý kƴ luật), “administrative penalties” (xử phạt hành chính), and “criminal prosecutions” (xử lý hình sự) in Article 4, as well as the authorisation for the application of “investigation and procedural measures” by the “competent authority” in Article 26 to safeguard personal data, implies a centralised regulatory approach that authorises public security authorities to oversee personal information/data protection matters and enforce the rules using discipline measures, such as penalties and fines. It has been suggested that such an approach is immersed in a broader national policy designed to ensure state intervention in cyber activities to protect cybersecurity (Bui and Lee, Reference Bui and Lee2022, p. 635).
This study concerns the process by which the PDPD overlays current understandings of privacy in the statutory framework. While the cybersecurity policy has been widely implemented in Vietnamese laws and regulations, how the PDPD is integrated into the cyber regulation strategy remains unexplored. The article delves into this issue through an examination of the regulatory dialogues which took place during the drafting process and of the PDPD. The study seeks to understand how the notion of security and safety in data protection law has been developed through the dialogues between regulatory authorities and those subject to regulation during the formulation of the regulatory framework. By examining the discursive elements within this process, the article contributes to a deeper understanding of the evolution and transformation of cyber regulation in a socialist state with a centrally promoted digital transformation agenda. The findings will also shed light on how regulatory ideas are shaped through the exchange of formal and informal opinions during the drafting process of a legal text in Vietnam. For privacy scholars, the findings align with a “third approach” to privacy law in East Asian countries, where a party-state strategically adopts a safety and security narrative to influence public perception, legitimising its portrayal as the ultimate protector of civil rights, and mitigate criticism of its encroachments on privacy (Pernot-Leplay, Reference Pernot-Leplay2020, p. 110; Jia, Reference Jia2024, p. 799).
3. The social construction of privacy regulation
3.1. Modalities of regulation and social meaning of privacy
One needs a theoretical framework that accounts for epistemic communities and changes to understand the regulatory dynamics in Vietnam’s cyberspace. Social constructionists like Lawrence Lessig and Andrew Murray argue that regulatory changes occur because regulators and the regulated, who belong to different epistemic communities, formulate different assumptions about what generates proper protection of privacy in cyberspace; by being embedded in both communities, actors can reflectively force desired behavioural constraints contained by members of one community against the epistemic tenets of another (Lessig, Reference Lessig1995, pp. 958–961; Murray, Reference Murray2011b, pp. 204–210).
Lessig manifests a framework in which a “pathetic dot”—the object of regulation—subjects to the effects of four “modalities of regulations,” or four kinds of behavioural constraints (Lessig, Reference Lessig1999, p. 506). These four constraints—the law, social norms, the market, and architecture operate in tandem to restrain or enable behaviours, thus driving changes to the regulatory domain (Lessig, Reference Lessig2006, p. 123). Lessig believes social behaviours of the regulated will change when these four modalities take effect together with the embedded assumptions, beliefs, and epistemologies. The sum of these four modalities can effectively stimulate subjective behaviours (Lessig, Reference Lessig1999, p. 507). Moreover, Lessig also points out that depending on the scenarios, some of these modalities might be more effective than others in stimulating desired outcomes. For example, if opportunity costs are high, data processors are discouraged from integrating a consent-acquirement form onto their service platform. However, when the market dynamics are weak, Lessig believes governments can intervene and achieve policy outcomes by applying different regulatory techniques to stimulate markets or impose behavioural barriers to regulate “coders,” who contribute to the domain’s architecture through their programming ability. These behavioural directions would affect their opinions and choices of subjects immersed in the field and create different understandings about social phenomena that fall within the scope of that specific regulatory domain (Lessig, Reference Lessig1995, p. 1000).
Lessig’s theory claims that the meaning of regulation is perceived through the prints of its power upon social subjects’ responding behaviours. The modalities of regulation stimulate behavioural responses from the regulated individuals. The reactions are programmed based on socially shared beliefs or regulatory traditions. In return, these responses generate normative expectations of regulatory modalities and determine the standards for reacting to stimulations. An accepted and even expected behaviour resulting from the existence of regulation is an instance of Lessig’s “social meaning of regulation.”
Lessig’s theory provides an useful way to conceptualise privacy regulation in Vietnam. The regulators could partake in the recursive process and complicate existing privacy laws towards commonly agreed goals on privacy from the regulatee’s perspective. In return, behavioural responses to different modalities might reflect the embedded assumptions about data privacy, yield signals of the effectiveness of the law, and help regulators navigate the possible changes to privacy laws. It might be exaggerated to say that Lessig supports an authoritarian intervention in civil self-dealing relations. But he did posit that “Government can act to impose a change in the code, making self-regulation less costly and thereby facilitating increased self-regulation.” (Lessig, Reference Lessig1999, p. 519). Lessig’s theory offers a framework to regard the PDPD as a source of constraints set to subjective behaviours within a dynamic interaction with market constraints, technological limits and possibilities, and social norms.
Nevertheless, the major problem in Lessig’s framework is the vulnerability and passivity of the “pathetic dot” against governmental deliberate acts of regulation. Much of Lessig’s analysis focuses on how the “dot,” representing a specific individual, a technology, or a “use case,” reacts against the aware constraints upon their behaviours. It is also unclear how each individual’s reaction to the regulations shapes the community’s understanding of them.
3.2. Murray’s networked communitarianism and social meaning in regulation
Murray’s networked communitarianism (Murray, Reference Murray and Levi-Faur2011a, p. 275) addressed the problem by modifying Lessig’s metaphor of the “dot,” synthesising it with actor-network theory and social systems theory to describe how interconnected communities contribute to constructing the meaning of regulation in a communitarian order.
Based on actor-network and social systems theories, Murray argues that, in effect, the “dot” always exists as a member immersed in a complex matrix of dots. The objects of regulation in Lessig’s framework must always be integrated parts that form a closed community which is togetherly influenced by the modalities of regulation (Murray, Reference Murray2011b, p. 205). According to Lessig, social meaning is constructed by a dynamic feedback loop between the modalities and the isolated regulatee, but laws, markets, and norms are a proxy for community-based control. Furthermore, although communities are closed in their autopoietic logic, their members are linked by networked interactions generated on similar accounts of ideas. As such, the responses stimulated are not discrete individual psychic constructs but are influenced by the beliefs, assumptions, and norms shared between members of the regulated community.
In addition, Murray’s networked communitarianism highlights the role of discourses in a “networked community (or matrix) of dots which share ideas, beliefs, ideals and opinions.” He also stressed that the regulatory process is “in nature a dialogue, not an eternally imposed set of constraints” (Murray, Reference Murray and Levi-Faur2011a, p. 276). Lessig’s modalities are effective only when the regulations are conceived within an interactive dialogue between communities of regulators and the regulatees. The social meaning of regulation is, thus, the community interpretations of the restraints and opportunities according to the shared values, notions, and conceptions between members of the regulated communities.
Within the restructured cyber regulatory domain, the effect of regulation is explored through “gravity”—the effects that nodes exert on the surrounding regulatory environment. In practical terms, these could be understood as major actors in various communities who have considerable influence on public opinions and, eventually, individual understanding of regulation, facilitating bonding and bridging discourse to generate consensus among members. In real-life scenarios, these major players are simultaneously members of different groups subject to various regulatory effects. In Vietnam’s privacy regulation context, these “major nodes” represent the party-state and public authorities, civil society organisations, large business firms, and other influential individuals. Through mediated channels, these influential actors facilitate opinions about privacy, sympathise with other actors, and exert gravitational force to inscribe an understanding of data privacy regulation.
This article adopts this assumption and portrays the process of constructing the safety/security meaning of data protection as a dialogue between members of the regulators and the regulated communities:
-
(1) The regulators community. The regulators’ community in Vietnam comprises party-state members and public authorities subject to the CPV’s order. The research revealed three key regulators groups: the Department of Cybersecurity and High-Tech Crime Prevention and Control (A05) under the Ministry of Public Security (MOPS), the Ministry of Information and Communication (MoIC) and its subordinate agencies.
-
(2) The regulated community. The PDPD classifies relevant subjects into four distinct groups: Personal Data Controller, Personal Data Processor, Personal Data Controller-Processor, and Third Parties, and enforces distinct responsibilities for each. Digital service providers, banks, financial institutions, and other technology-immersed business firms most likely fall under these obligations. Governmental entities and party institutions were ambivalently excluded from this classification. Mass civilian users benefit greatly from these regulations, but their opinions are often unrecognised or insignificant during the deliberative processes of laws and regulations.
This epistemic division between the duty-imposer and duty-obeyer aligns different social subjects into two overlapping communities of controllers and the controlled.
In addition, this research has revealed four gravity groups traversing two communities: an alliance between MoIC and selective digital business firms, the Institute of Policy Studies and Media Development, and scholars. It would be argued that the information absorbed by and mediated through these traversing actors during the drafting process of the PDPD contributed to varying degrees to the way technology firms, service providers, and civilian users understand and implement the PDPD.
3.3. The “not-so-pathetic” dot theory: Constructing meaning through feedback loops
Much of Murray’s networked communitarianism is based on social discourse theories (Murray, Reference Murray2011b, p. 206). Regulatory communities are developed based on social systems theory’s model of autopoietic systems. But if networked communities operate in a closed and autopoietic manner, how do they construct safety/security ideas simultaneously and influence the way subjects understand the control imposed by the PDPD rules? Since systems are epistemically closed, outside ideas cannot be absorbed and acquired in an environmental-based, from-system-to-system pattern (Koch, Reference Koch2005, p. 6). Instead, changes in the environment introduce irritations to the internal operation of systems and generate changes in shared beliefs and ideas autopoietically (Luhmann, Reference Luhmann2008, p. 383). Although they operate autopoietically, the regulatory communities are sensitive to the regulatory irritants (Teubner, Reference Teubner1998). Regulatory events or messages conceived by community members lead to a shared understanding in closely linked communities, which are connected through the key actors who belong to both groups.
In Murray’s theory, the “community of dots” absorbs regulations and the underpinned assumptions, and the regulatory settlements are not coercively imposed. The meaning of settlement is concluded through “a dialogue in which the regulatory settlement evolves to effect changes in society.” (Murray, Reference Murray2011b, p. 206). This article posits that during the recursive communication process in the drafting period of the PDPD, opinions, norms, beliefs, and ideals of security and safety are instilled in the thinking of community members. It is a dynamic and complex process of mediated communication between the regulators and regulatee communities through which shared assumptions and epistemologies about privacy shape the safety/security discourse and generate a common understanding among community members.
From a complexity science perspective, Thibault Schrepel proposes that contextual changes deriving from regulatory techniques may challenge the regulated objects/communities’ robustness and affect the actors’ gravity in the network, but the reverse could also be the case (Schrepel, Reference Schrepel2022). Schrepel modified the Lessigan concept of “feedback loops” into a hypothetical model to analyse the reactions from both sides in the existence of the constraints introduced. The modified feedback loops acknowledge the proactive role of the regulated “dots” in influencing changes within the current regulatory environment, prompting regulators to develop innovative regulatory approaches (Schrepel, Reference Schrepel2022).
The dynamic “feedback loop” model offers two valuable insights to this study. First, it helps explain how mass internet users and other businesses distant from regulators’ communities respond to data privacy legal rules and how this prompts regulators to revisit responsive regulatory concepts during the PDPD drafting phase. Second, it adds to networked communitarianism’s account of the diffusion of regulatory ideas across communities by extending the analysis into a recursive, both-way interaction between regulators and regulatees traversing four regulation modalities. It also explains how changes in responding to communicative actions resulted in changes in the regulatory ideas of both communities.
These theoretical insights suggest three research questions:
-
• In what ways are regulatory ideas mapped onto the epistemic assumptions and normative beliefs that shape the thoughts of regulators and regulated communities regarding privacy?
-
• How did the safety/security interpretation of personal data protection win out from the regulatory dialogues?
-
• Will the security-based approach alter the right-based approach to privacy law in Vietnam?
4. Data and method
This article applies discourse analysis to excavate the underpinned regulatory ideas from publicly said and communicated materials. These communication materials are understood as things said in public channels, spread through media and open communicative sites, and other discourses intended to be spread and shared through cyberspace. Discourse analysis unravels the latent assumptions that guide the exchange and interaction of regulatory ideas, which formed the materials for this article’s analysis.
The data used to analyse the shared ideas among the regulators’ community are collected from publicly circulated communication during the drafting period of the PDPD, such as articles published on the internet by state-backed media agencies, news reported on television, and other writings published in cyberspace. Research shows that regulators in Vietnam tend to facilitate regulatory signals on publicly controlled media and other social media channels to clarify policy initiatives and direct public opinions on socioeconomic and legal issues (Bui, Reference Bui2016, p. 95; Gillespie, Reference Gillespie, Fu, Gillespie, Nicholson and Partlett2018, pp. 347–349). Articles and reports on VTV News (the National Telecommunication agency), Nhân Dân (The People), and other media agencies under the direct control of public institutions like People’s Public Security (Công An Nhân Dân), Procuracy (Kiểm sát) are paid special attention because they specifically mentioned public security and regulatory measures such as penalties, disciplines, and administrative measures as solutions to increasing data protection issues.
Meanwhile, non-regulators often express reactions and opinions towards regulation in private exchanges and through public discourses (Bui, Reference Bui2016, p. 97). However, it has been found that public opinion exchanges about information privacy on social media faced severe challenges from the state’s continuous efforts to control public discourse (Bui, Reference Bui2015, pp. 97–98).
In-depth interviews with ten actors were conducted to excavate the ideas from the regulated community formed during the drafting process of PDPD. Participants were selected among legal academics, firm representatives, and specialised consultation agencies based on a combination of snowballing and other referral strategies. These interviews took place from March to September 2023 via web-based conference software and face-to-face exchanges. Virtual interviews were conducted via Microsoft Teams on an appointment basis, while direct interviews were done in Hanoi and Ho Chi Minh City in semi-structured formats.
The interview with Ms Nguyen Lan Phuong, the representative of the Institute of Policy Studies and Media Development (IPS), brought fruitful insights into the dynamic feedback loop through which the regulated community’s perceptions will affect the total regulatory meaning. IPS is an independent research institution under the Vietnam Digital Communication Association (VDCA). It had been the sole institution in Vietnam to conduct in-depth research into data privacy regulation and advocate for regulatory change. The IPS maintains close relations with representatives of the MoIC as well as many National Assembly representatives. Accordingly, it receives various consultation requests from state authorities upon cyber regulation statutory documents. A research project by the IPS in 2023 on the possibility of social participation in data privacy lawmaking introduced the IPS to many valuable sources. Many of the secondary data collected for this article are generously provided by the IPS, bringing quality to the result of this article.
Lessig believes the “dynamic feedback loop in which technological changes are followed by market adjustments, social norms and legal standards” is vital to facilitate normative thinking and create regulatory change. Murray and Schrepel contribute additional insight into the changes that occur due to the proactive dialogues of both the regulators and regulated communities in recursive feedback loops. Based on this framework, the analysis of cross-community dialogues is located within a dynamic loop comprising prominent actors’ responses to triggers from four modalities of privacy regulation in the Vietnamese context: architecture, market dynamics, social norms, and the law. In a feedback loop, regulatory ideas operate simultaneously but not in a temporal pattern. They can be presented simultaneously or reconstructed in a complex order, but in a systemic context, their operations generate an environment proper for social meaning to be constructed. Therefore, readers are invited to view the subjective responses to regulatory modalities in a dynamic and recursive order.
5. Constructing the safety/security idea: Dialogical perspectives
5.1. Setting up the architecture: Contextualising dialogues
5.1.1. Political narratives
In Vietnam, cybersecurity and data control have been the prominent fronts by which the state exercises surveillance and manages the population while protecting state sovereignty in cyberspace (Bui, Reference Bui2015, p. 98). Since 2012, the party-state has introduced administrative decrees with strict measures to force foreign content providers to increase cooperation with Vietnamese authorities by removing illegal content and potentially housing data centres within the country (Bui, Reference Bui2015, p. 98). However, since 2018, the state has subtly incorporated data protection policies into the cybersecurity policy. This part explores how the state has constructed a semantic data privacy domain within the broader cyberspace regulation architecture.
Data privacy regulation has been constructed as a semantic subset of public security and national interests in three ways. Firstly, the viral news of massive global data breaches in mid-2018 had been widely portrayed by Vietnamese state-sponsored media agencies as a threatening risk. The widespread messages reached the audience through mediated channels, generating public worries about the danger that the lack of data protection rules would bring to civilian lives. Secondly, public discourse has subtly included the epistemic link between mass citizen data protection and national sovereignty interests. Thirdly, the “imperative-compliance” logic has been constructed through the apparent choice of words related to criminal law and administrative measures. These constructive discourses generated a canvas against which the dialogues regarding data privacy are deployed.
Since the outbreak of global privacy concerns, with repeated news on large-scale breaches and threats in mid-2018, the information security problem has received effervescent social interest. In Vietnam, state-controlled and private media agencies reported major data infringement cases in alerting tones, igniting discussions on social media posts and private conversations.
The media’s propaganding efforts consolidated awareness of data protection as a matter of public security in Vietnam. While many news and media agencies operate simultaneously in Vietnam, news and messages reported by state-sponsored agencies such as Nhân Dân or VTV News often represent the official party-state opinion. These articles send clear and authoritative signals of the seriousness of the issue. In these reports, personal data processing by non-state and foreign entities is portrayed as a high-risk practice that could affect civil safety and people’s ordinary lives. In addition, strict controlling measures for personal data management are depicted as the only effective tool to confront the risks. As this news received flaming attention, state-based and private agencies swiftly called for implementing the Law on Cybersecurity, justifying the need for state control over the internet to ensure national security. A People (Nhân Dân)’s article bluntly declared in its title that “Protecting Cybersecurity is for the interest of the nation and the interests of the people” (Nhân, Reference Nhân2018a; Nhân, Reference Nhân2018b; Nhân, Reference Nhân2020a).
The security discourse was soon extended to include national sovereignty. For example, an article published on Tuoi Tre, a major media agency under the authorities of the Ho Chi Minh Communist Youth Union, stated bluntly, “To protect personal data is to protect national sovereignty in cyberspace.” In the Tuổi Trẻ article, data breaches are “calamities” (vấn nạn) that should be “eliminated” (xóa sổ) (Tuổi Trẻ News, 2023). In the Vietnamese language, social issues are often referred to as “problems” (vấn đề). The term “calamity” is only used when referring to serious social problems, such as crimes that must be controlled and moderated by public security forces. Within a broader cybersecurity framework, data is regarded as a form of civil information that, once mined by powerful entities, will cause collective harm to the people. In a closed meeting with various stakeholders, a high-class cadre who assumes superior leadership in the Department of Radio, Television and Electronic Information under the MoIC claimed that the “information problem” was “a problem of ideology” that needed effective state control. This discourse is later extended by floods of news and report articles on many governmental news agencies.
5.1.2. The PDPD drafting program: Timeline, major events
The preparation of the PDPD started in early 2019. Initially, communications of regulatory ideas were done in a highly open and formal manner, and a first draft was issued for public consultation after one and a half years of preparation. However, after the COVID-19 outbreak, the drafting and deliberating processes went into a stagnated period. Since mid-2021, all regulatory communications have been highly confidential; the number and content of the drafts circulated between 2021 and 2023 were unknown to the public. It was only on the promulgation date that the final draft was released to the public, and formal exchanges were allowed again.
Two major events with significant social impact occurred during the drafting period—first, COVID-19 and relevant social distancing measures. Between early 2020 and mid-2022, several COVID-19 outbreaks led to extensive social distancing and preventive measures. Although the “new normal” policy (bình thường mới) introduced softened community rules starting in 2022, citizens, especially those residing in urban areas, have been used to communitarian thinking and behavioural adjustment in compliance with governmental control.
Second, the 13th National Congress of the Communist Party of Vietnam. Among other highlights, the 13th Congress was marked by its specific focus on cyberspace policies. The Resolution of the 13th Congress emphasises grand objectives such as “Building and developing national data infrastructure synchronously, forming a system of national data centres, regional and local data centres with synchronous and unified connections, forming reliable and stable data systems for the State and enterprises. Invest in equipment systems for collecting, storing, processing, and protecting public data.” More than a stipulation of a political objective, the cyberspace regulatory agenda requires a change in the “perception,” as publicly called by the Prime Minister in the Decision 749/QD-TTg “Introducing Program for National Digital Transformation by 2025 with Orientations towards 2030.” The state’s aim at changing public perception towards cyberspace regulation makes up an important task for the PDPD regulators to contextualise dialogues and generate consensus about cybersecurity. Figure 1 demonstrates the key milestones that led to the enactment of Decree 13/2023/ND-CP on Personal Data Protection.
A timeline of the promulgation of the Decree 13/2023/ NĐ-CP Personal Data Protection in Vietnam
5.2. Market dynamics
5.2.1. Firms as data controllers and processors: From “developmental subjects” to “fellow travellers”
In parallel with the security discourse, the tech-for-development (tech-dev) narrative shared by market players systematically scaffolded the normative belief in the state’s authority to impose control over the use and control of population data. Since 2018, the term “fourth industrial revolution” has been popular among state-owned and private digital service providers to refer to the necessity of implementing a state-wide digitalisation agenda, incorporating developmental goals with security measures under the state’s central direction. The regulatory signals from the highest central authorities generated an ideological tenet for this approach. For instance, Resolution 52-NQ/TW promulgated by the party legitimised state control upon data management activities, scaffolding the cybersecurity and enhancing infrastructure into narratives of data regulation. The Prime Minister, in Decision 749, also stipulated the objective of
developing digital infrastructure that is ready to meet the explosive demand for connection and data processing, functions of network monitoring to each network node, and ensuring network safety and security are integrated by design and default right from the start.
A large-scale National Summit on Industry 4.0 was held in 2018 and has been held annually under the direction of the CPV Central Committee’s Economic Commission. As the implementing force of the party, the MoIC organised the translation, publication, and dissemination of Klaus Schwab’s works, including “The Fourth Industrial Revolution” and “Shaping the Future of the Fourth Industrial Revolution: A Guide to Building a Better World” (co-authored with Nicholas Davis). The books were published by the National Political Publishing House (nhà xuất bản Chính trị Quốc gia Sự thật), the official political publisher of the CPV and the Socialist Republic of Vietnam (SRV).
In the epistemic tenet constructed by the governmental entities, the “digital infrastructure” consists of a large bulk of population, industrial, and other profitable data. Because personal data exist inseparable from this shared data pool, the government publicly emphasised the need to construct a wide-span legal right system applied to “digital data” (dữ liệu số), but it avoided any direct reference to the discourse of a right to privacy towards personal data. The disseminated signal was that the bulk data of the Vietnamese population was “valuable assets” and should be subject to “strict protection measures.” (Nhân, Reference Nhân2020b). Within this framework, state control by regulating personal data processing activities is justified by security considerations, scaffolded by digital market practices under the direction of the party-state. A prominent example is seen in September 2023 through an article by Công Lý (Justice), the Supreme People’s Court’s official media agency, which bluntly declared that “Digital data is the property of the state” (Dữ liệu số là tài sản của quốc gia) (Hồ, Reference Hồ2023).
The scaffolding discourses received strong support from prominent market players, who are also data controllers and processors. Their support is crucial to consolidate the state’s comprehensive digital transformation agenda because these service providers have been identified as the primary subjects that lead the digital transformation of Vietnam, and they are considered to contribute significantly to the success of the state’s digital transformation in recent years. According to the Vietnam E-Commerce Report 2023 released by the MoIT’s Vietnam E-Commerce and Digital Economy Agency, B2C retail e-commerce revenue jumped from $8 billion in 2018 to $16.4 billion in 2022, accounting for 7.5% of total retail sales of goods and services around the country (Nhĩ, Reference Nhĩ2023). In October 2020, during the “Promoting Productivity of Small and Medium-sized Enterprises in the Context of COVID-19 Based on Scientific and Technological Innovation and Administrative Regulation Reform” conference co-organised by the Ministry of Science and Technology and Small Business Association, Deputy Minister of Science and Technology Le Xuan Dinh emphasised that firms are pioneers of innovative technologies and thus should actively seek measures to develop and expand the application of technologies. During the PDPD’s drafting, the Prime Minister sent a unified message that policies in the new digital economy regime are proposed with firms and enterprises as the primary beneficiaries of developmental policies. In a meeting with firms’ representatives in 2021, the Prime Minister said:
Enterprises are primary, so all policies are oriented towards enterprises. Enterprises are the subjects, so they accompany the Party, State, and Government to implement policies, detect problems and outstanding policy issues, and join hands to solve them in the spirit of harmonious benefits and risk sharing between state entities, people, and enterprises.
Firms and enterprises answered this call with enthusiasm. With 74% of the population using the internet, these service providers are currently processing a considerable amount of personal data. They would constitute a large community of duty-bearers under PDPD. Over the years, an alignment between large tech-based firms has been formed to join the regulatory processes sincerely and assist state agencies on governmental tasks. Known as a “group of fellow travellers” (nhóm đồng hành), the government ministries select firms based on their sizes and business fields to form accompanying interest groups to directly acquire opinions upon drafting regulations. Taking advantage of this opportunity, these firms actively join the regulatory conversations and discuss socioeconomic and regulatory issues. According to some interviewees who wished to remain anonymous, these firms formed a close-tie relationship with each other and critical persons from government entities to ensure they could reach and comment on the latest policies and regulations for their business benefit. In this way, selective firms and businesses can gain preliminary access to regulatory drafts and express their concerns towards the upcoming change in how they do business.
Through this “fellow-travelling” channel, firms and businesses who are to-be data processors gained access to primary drafts of the PDPD. In the early stages, firms and enterprises have been consulted formally and informally by the MOPS and other co-authorities (including, among others, the MoIC). Firms’ and enterprises’ opinions are acquired through these “accompanied” channels and are filtered through the highest representatives of these co-authorities before being delivered to the MOPS. Through these alliances, state actors partake in the discussions and gain tremendous gravity regarding the back-and-forth diffusion of regulatory thinking across communities.
5.2.2. The Institute of Policy Studies and Media Development: The lone traveller
The Institute of Policy Studies and Media Development (IPS), a non-state research centre, is a keen advocate of the developmental approach to data governance in Vietnam. Among other non-governmental organisations, the IPS has been the only prominent actor to spread ideas of data protection in cost-and-benefit grammars (Bach Thi Nha Nam and other firm representatives confirm this). In detail, the IPS has been speaking out concerns over misuse of power while promoting a right-based approach to personal data protection regulation. According to Ms Nguyen Lan Phuong, IPS aimed to foster a “balanced approach” in which the privacy values of data subjects are ensured while maintaining low entry costs for technology firms by raising opinions and awareness against enforcing unnecessary technical barriers to digital businesses.
With the drafting authority of the MOPS established and the consolidation of public security discourse along the developmental discourse, the spaces for non-state advocacy had been narrowed down. To achieve their objectives, Ms Phuong and IPS acquired a clever strategy called “channelling and collective voice.” This involves utilising “personal relationship” (quan hệ cá nhân) to approach the National Assembly’s subordinate agencies, which are authorised to dissent or veto the draft, and the participants who have the potential to be invited to closed consultation events while releasing informal and simple messages on social media to raise the public awareness. However, the strategy still faced tremendous challenges. In Ms Phuong’s words:
In practice, it is still very tough because the MOPS powerfully fostered the public security discourse on public sites, aided by the idea scaffolded by other agencies that personal data situated in large citizen databases are national assets and should be protected by the highest security standards. In this condition, the right-based approach becomes less appealing to the public.
Due to the closure of the “fellow-traveller” groups and their focus on firms’ and market players’ opinions, the IPS was reluctant to shift their advocate discourses towards how strict controls towards data management activities could bring excessive costs to digital business models. According to Ms Phuong, because the perception of individual privacy interests in Vietnamese society was relatively low, and additionally the A05 had been “sending consistent messages (thông điệp nhất quán) of keeping domestic political security (an ninh chính trị nội bộ),” the IPS were not able to facilitate ideas of individual privacy in right-based approach during the deliberative process regarding the PDPD.
5.3. Social norms: Collective security and trust in the governmental state
5.3.1. COVID-19
The COVID-19 outbursts in Vietnam consolidated the public belief in the need for a centrally governed social system to respond to community crises. Four waves of pandemic outbursts between 2020 and 2022 renavigated public attention away from the PDPD to the tremendous efforts of central and local level governments in keeping people safe. Public sentiment towards the state increased as people were isolated, creating room for reflection upon social mores and values and cultivating trust in the governmental state. These reflections upon the state’s role are, in turn, diffused widely through social media and helped reaffirm the state’s critical role in ensuring civil safety. In this way, the disruption to public gatherings, the daily image of wholehearted state officials who sacrificed themselves for the public good, and the increasing reliance on social media and other channels which are put under strict state monitoring, the public sentiments and trust in regulators’ decisions had grown more potent than the previous period. The pandemic events also remind communities of the value of a collective spirit over individual needs. The public believed that the government’s determined public security measures had led to the success of anti-epidemic objectives (Le, Reference Le2022, pp. 130–137; Nguyen, Nguyen and Taylor-Robinson, Reference Nguyen, Nguyen and Taylor-Robinson2022). In short, through COVID-19 events, the governmental state stands out as the legitimate social safety and security protector.
But the state has also been actively promoting messages of unity and cooperation on mediated channels using inspirational terms such as “unity” (đoàn kết), “one-hearted” (đồng lòng), and “loving and aiding each other” (tương thân, tương ái). For example, in April 2021, an article was published titled “46 Years of Liberation of the South: A Lesson of the Strength of Great Unity” by the Vietnam News Agency (Thông tấn xã Việt Nam) and was re-posted on state authorities’ news agencies, including the National Assembly news agency and the Public Security News (Báo Công An), the very agency which promoted the public security discourse over the drafting of the PDPD. Notably, the article wrote:
Nowadays, the nation’s tradition of solidarity, mutual affection and mutual love (truyền thống đoàn kết, tương thân, tương ái của dân tộc) has always been upheld, they are most clearly reflected in the outbreaks of COVID-19 epidemics. In difficulties and challenges, the good morals of Vietnamese people shine even more brightly.
The resolution of the National Steering Committee on Prevention and Control of COVID-19, issued June 2023, used the term “the all-people and global approach” (tiếp cận toàn dân, toàn cầu) to describe the achievement of epidemic control objectives (Ministry of Health, 2023). The resistance to the epidemic was imagined as a “fight” which irritated national cooperation in a collective spirit (Huynh, Reference Huynh2020, p. 2). Since the initial stages of controlling policies towards COVID-19, local government authorities contributed significantly to the perception by facilitating the “Great Unity” policies, encouraging and proposing contact-tracing measures between close-knit neighbourhoods and household units (Pham et al., Reference Pham, Nguyen, Bach, Le and Nguyen2023, pp. 155–159). These insights suggest that different levels of state authorities used subtle measures to foster collective sense-making and scaffolded the “collective security” discourse at a time when the PDPD draft was still in its early stages of deliberation. Figure 2 demonstrates additional examples of state media’s news and articles which promote the “collective security” discourse.
Data protection as security issue: messages sent by state-sponsored media agencies in public news articles
The “Great Unity” discourse not only aided the government in exercising control over religious practice and reducing voices concerning religious freedom issues but also softened the seriousness of privacy violations and criticisms of government violations of privacy during COVID-19 (Gillespie, Reference Gillespie2014, pp. 140–145; Pham et al., Reference Pham, Nguyen, Bach, Le and Nguyen2023, p. 161). The positive effect of the perceived benefits of contact-tracing apps soon overrode privacy concerns. Here, the collective good justified informal exceptions of individual privacy from state perspectives (Nguyen, Tran Hoang and Phung, Reference Nguyen, Tran Hoang and Phung2022, p. 183). Large-scale privacy violations, including disclosing sensitive personal data such as medical records, had often been overlooked, given the effectiveness of centralised social control measures (Sun et al., Reference Sun, Wang, Xue, Tyson, Camtepe and Ranasinghe2020, p. 10; Nguyen et al., Reference Nguyen2021, p. 6). As Nguyen, Tran Hoang, and Phung contended, the rise of public trust in governmental decisions generated social consensus and justified the exceptions to privacy (Nguyen, Tran Hoang and Phung, Reference Nguyen, Tran Hoang and Phung2022, p. 185). This change in public attitude towards privacy matters would result in the common opinion in the MOPS’s regulatory authority regarding the PDPD. Due to lockdowns and mass relocation to cyberspace communications, collective safety became the public consensus, which justified state control measures for civil society in cyberspace. These normative beliefs would later be carried on as the state reactivated the post-COVID dialogues about the PDPD and generated a robust epistemic tenet for the security/safety meaning of data protection.
5.3.2. The intermediate community: Academia
In Vietnam, academic opinion from legal scholars often contributes theoretical tenets on which governmental bodies ground their regulatory decisions. Historically, legal scholars have been considered state members who provided highly valued comments for top decision-makers. Today, opinions from the legal academia are still considered with a certain degree of authority regarding state and law issues (Bui, 2022a, pp. 375–385).
During the deliberative process that led to the PDPD, legal scholars imprudently aided and extended the sense of safety/security of privacy to both the regulators and the regulatees’ communities. Scholars have contributed to the interactive dialogues between actors in two ways. First, by introducing concepts like “the right to be forgotten,” “data subject’s right,” and “consent” to the scholarly literature and public news channels, scholars raised public awareness of privacy matters (Vũ and Phạm, Reference Vũ and Phạm2017, pp. 67–74; Bạch, Reference Bạch2020, pp. 38–47; Bạch, Reference Bạch2022, pp. 50–57; Vũ and Lê, Reference Vũ and Lê2020, pp. 55–64). However, since most legal scholars are working in the university system subjected to governmental oversight, their discussions on privacy matter only to the extent of it being an inalienable human right and a civil right to personality (Phùng, Reference Phùng1996, p. 39). Almost no scholars have written publicly about privacy as against governmental control, except those addressing this matter subtly from a “balancing” between public good and private rights (Thái, Reference Thái2012, pp. 178–202; Huỳnh, Reference Huỳnh2022).
Second, by rapidly conducting several research projects into the concepts and the implementation of the “fourth industrial revolution,” scholars had exaggerated the assumption that the state is the primary force leading socioeconomic changes, thus legitimising its authority to oversee personal data management activities. Between 2017 and 2019, Vietnamese economists and legal scholars focused their research on the theme of “technology advances and economic development”; their findings, in turn, generated solid theoretical tenets for the diffusion of ideas of development under the state’s direction. Economists and legal scholars, in particular, were interested in identifying the “problems” and “challenges posed” by the “revolution” and suggesting law reforms to increase state control in specific regulatory domains (Nguyễn, Reference Nguyễn, Nguyễn and Ngô2018, p. 37–52; Nguyễn, Reference Nguyễn2019). Within this strand of research, some legal scholars view personal data issues through the lens of economic rights; some further imagined a regime of personal data protection based on the free negotiation of property (Đỗ and Đào, Reference Đỗ and Đào2023, pp. 3–11). These opinions categorise personal data into broader sets of “profitable data” and suggest a comprehensive legal reform to treat data as a resource entitled to the people of the nation (Ngô and Nguyễn, Reference Ngô and Nguyễn2023; Đỗ and Đào, Reference Đỗ and Đào2023, p. 6). This view supports the state’s scaffolding discourses since it supports the “enterprise-centred” approach adopted by the government-enterprise alliance.
5.4. The law
Although privacy was recognised in the Constitution and the 2015 Civil Code in the language of “rights,” the rapid growth of e-commerce and data-driven models has increased the collection and use of personal information, leading to more frequent data breaches and concerns about how businesses manage this information. In response, Vietnamese regulators have developed rules for privacy protection in e-commerce and consumer laws. In 2013, the promulgation of Decree 52/2013/NĐ-CP on Electronic Commerce introduced a new set of information privacy principles (Greenleaf, Reference Greenleaf2013, pp. 4–5) to Vietnam. Over the last decade, these rules have expanded into about 70 sectoral laws. While only a limited number of laws, such as the Law on Information Safety and the Law on Cybersecurity, address issues of personal information, many rules have been developed in special administrative instruments which are considered sources of law in Vietnam. These regulations are drafted and implemented by specially authorised government agencies in their fields. Compared to rules promulgated by the National Assembly, the effects of these regulations are limited to shorter periods and applicable only to limited domains. These fragmented regulations create overlapping regulatory approaches and challenge both enforcement and compliance.
5.4.1. Clashing regulatory signals and technologies
The fresh rules on data privacy protection were promulgated in a Decree (Nghị Định). In the Vietnamese regulatory context, a decree contains lesser formality than a statutory law but reflects clearer signals of governmentality. In Vietnam, as stipulated by Article 4 of the Law on Promulgation of Legal Normative Documents, a “decree” is promulgated by the Government to regulate specialised areas of society and economy. Vietnamese legal documents are categorised based on the combination of “scope of regulation” (phạm vi điều chỉnh), “object of regulation” (đối tượng điều chỉnh), and “method of regulation” (phương pháp điều chỉnh). For decrees and other sub-law level instruments, the scope, object, and regulatory approach are usually determined based on responsive state agencies assigned with the primary drafting task whose authorities correspond to the “scope of regulation.” The responsive agencies are referred to as the “principal governing agencies” (cơ quan chủ quản or cơ quan đầu ngành). As indicated explicitly in the Preamble of the PDPD, its promulgation was in pursuance of the Civil Code, the Law on National Security, the Cybersecurity Law, and at the request of the Minister of Public Security in Vietnam. It can be inferred that the PDPD’s “object of regulation” aligns with the authorities of the MOPS, which is to ensure national security through the authorised use of force and other authoritative measures.
While the right to privacy in Article 38 of the Civil Code was constructed on the equal-agreement approach (phương pháp bình đẳng-thỏa thuận), the primary approach seen in the PDPD is the imperative-authority approach (phương pháp mệnh lệnh-quyền uy). According to the Vietnamese state’s formally recognised legal theories, the equal-agreement approach is the characteristic regulatory technology in private law relations. It enables legal subjects to freely negotiate their obligations based on “equality, free will, asset independence and self-responsibility” (Article 1, Civil Code). By contrast, the imperative-authority method typically applies to relations between state entities and civilians and intra-governmental relations. The “imperative-authority method” represents the limitation of state power but also provides parameters for the state’s governance. The divergence between these regulatory logics reflects an epistemic separation between private and public law domains, diffusing thoroughly in Vietnamese political and legal thinking.
The promulgation of the PDPD extends the general cyber regulation regime in Vietnam, characterised by its strengthening state control over cyberspace business activities using the imperative-authority approach of regulation (Nguyen, Reference Nguyen2022, pp. 164–166). By stipulating A05’s authority to supervise, examine and veto data management activities, the room remaining for data subjects–controllers negotiation regarding the processing of personal data is insignificant. In this way, data subjects are expected to refer to state authorities to ensure the data processing activity is lawful. The PDPD adopts the imperative-authority logic and constructed data controllers and processors’ obligation towards the A05, but this approach has nevertheless minimised the responsibility of data controllers towards data subjects in direct negotiable relations. This is the fundamental difference between the current Vietnamese private rights framework in which a “right to privacy” is situated and the PDPD authoritative data privacy framework.
5.4.2. Shifting authorities
Before 2023, the authority to make privacy-related regulations was shared between various government agencies. Each agency is specialised in a particular field of governance, so the laws reflected the ideas held by different communities of regulators. Depending on how close these agencies are to the authority to implement the party’s policies, two major regulatory agencies are considered: the MOPS and the MoIC.
Before the introduction of the PDPD, personal information management in cyber activities was put under overlapping regulatory authorities. Generally, the National Assembly is authorised to legislate and supervise the enforcement of laws that contain human rights provisions. However, as the epistemic connection between privacy as a legal right and data protection regulations remains ambiguous, there have been laws constructed for personal data protection, such as the Law on Cyber Information Safety and the Decree 52/2013/ NĐ-CP on Electronic Commerce, which assign the direct enforcement authorities into different governmental agencies. These regulations generated the expectation that multiple state agencies, for instance, the MoIC and the Ministry of Trade and Commerce (MoTC), have the authority to oversee personal information management activities in their respective governmental domains (Greenleaf, Reference Greenleaf2013, pp. 5–7).
In addition to the overlaying authorities, it has been found that the authorities have been in constant shifts from one to another. Research shows that while initial personal information protection rules promulgated in Decree 52/2013/NĐ-CP on Electronic Commerce were prepared and enforced primarily by the MoTC and had effect only on the e-commerce and consumer sectors (Greenleaf and Park, Reference Greenleaf and Park2014, p. 495), the regulatory oversight has been gradually shifting to a freshly constructed cyber regulation and security sectors (Greenleaf, Reference Greenleaf2021, p. 1). This shift aligns well with the constantly expanding authorities of the MoIC, especially with the establishment of specialised state agencies under these ministries to oversee data management issues. According to Article 2(1)(a), Decision 1499/QĐ-BTTTT Regulations on The Functions, Tasks, Powers and Organizational Structure of The Information Security Department, dated 14 August 2023, the Authority of Information Safety (AIS) under the MoIC was authorised to “Preside and coordinate research, propose, develop and submit to the Minister for promulgation or let the Minister submit to competent authorities for the promulgation of legal documents on information security.” The Minister of Information and Communication, the head of the MoIC, is concurrently a member of the Central Propaganda Committee. This might imply that the MoIC’s enforcement of information security rules would follow the party’s policies on data and information control in cyberspace. This insight corresponds to MoIC’s view that guarding information safety is guarding the comprehension of party ideology. This view is publicly announced in articles published in the Communism Review (Tạp chí Cộng Sản), the efficient propaganda organs under the direct command of the CPV (Nguyễn and Nghiêm, Reference Nguyễn and Nghiêm2023).
However, interviews with key business representatives and other scholars with close relation to the drafting personnel of the PDPD reveal that MOPS usurps the authority to regulate data privacy matters. The fellow travellers confirm that the primary contents of the PDPD were drafted and prepared by the Department of Cybersecurity and High-Tech Crime Prevention and Control (A05) under the MOPS. The A05 was founded on 10 August 2018, by merging the Department of Cyber Security and the Public Security Department for Crime Prevention Using High Technology under the General Department of Public Security, MOPS. The A05 has been identified as the principle governing agency (cơ quan đầu ngành) of protecting cybersecurity and safety (bảo đảm an ninh và an toàn mạng). Its central function is to safeguard national sovereignty and public security in cyberspace. Cybersecurity has been one of A05’s foundational aims from the very beginning.
Furthermore, the MOPS maintained its exclusive authority to modify and finalise the PDPD drafts. According to a business representative who participated in the closed consultation meetings but wished to remain anonymous, the MOPS holds “real power” (thực quyền) over other authorised agencies such as the MoTC or the MoIC because it has concurrent authority to investigate and enforce sanctions to other state agencies under the direction of the CPV. Despite various objections to the registration requirements for data processing activities and the authoritarian supervising authority of the A05 over data controllers’ activities, the MOPS preserve the core principles of the PDPD through three draft versions with little room for negotiation from other actors.
The fact that the MOPS is authorised to prepare and implement the PDPD rules shows clear signals that personal data protection law is categorised as a cybersecurity policy. The legitimacy of the MOPS is not only justified by the collective safety discourse during the pandemic period but also through the normative belief that it is the sole “force” (lực lượng) to effectively “protect the Party’s ideological tenet” (bảo vệ nền tảng tư tưởng của Đảng). The motto of MOPS is that as a collective it “exists as long as the Party exists” (còn Đảng, còn mình). In Vietnamese, the first-person pronoun “mình” generates a homey feeling as it is used between close-knit relationships when referring to the shared values or mores in common. On the other hand, another motto upheld by the MOPS is “forget oneself for the country and serve the people” (vì nước quên thân, vì dân phục vụ). The MOPS, being identified as the legitimate agency of the Party, which acts for “the entire nation” and “for the interest of the people,” generated a robust ideological tenet that consolidated the MOPS’ authority for personal data protection regulatory power.
Most importantly, the MOPS’s authority over data protection regulation reflects a solid regulatory signal, as already spurred by media efforts and Party-sponsored agencies such as Nhân Dân, that data privacy is a matter of national security and that it is predetermined that personal data protection falls under the authority of the public security force. The rules authorising A05 to oversee personal data management activities in the PDPD confirm these findings.
The consolidation of the MOPS’ authority can also be seen in the court’s inaction. The Supreme People’s Court of Vietnam (SPC) remained silent throughout the drafting period of the PDPD. In Vietnam, the judicial branch is yet to be independent from the party-state system. It is not authorised to make laws nor to establish precedents like the way courts in Anglo-European and US legal systems do (Nicholson, Reference Nicholson, Gillespie and Nicholson2005, pp. 159–190). Although there has been an increase in the court’s authority to make case law and to deliver harmonised understandings of legal terms, in effect, the court’s authority upon these issues only extended to guidance of lower-level courts in delivering judgements upon certain legal matters. The court rarely takes part in the formation of regulatory and statutory documents. This not only limited the court from expressing an opinion and consulting the regulators during the PDPD drafting process, but it may also hinder the court’s ability to interpret privacy in ways diverging from the PDPD rules.
6. Discussion
The dialogues between state and non-state actors illustrate that epistemic exchanges of ideas about law and regulation play a crucial role in shaping the regulators’ and regulated communities’ reactions to regulatory ideas. It also depicts that regulatory meaning results from a recursive process of deliberation, contestation, manipulation, and confusion. In Lessig’s pathetic dot theory, the coercive nature of regulation constructs repressive compliance. Murray contributed the insight that inscribing regulatory meaning requires the dynamic interaction between actors embedded in different epistemic thinkings, mores, values, and norms; the shared epistemic assumptions between actors provide the insights that regulators can rely on to productively trigger sympathetic reactions to regulatory signals and generate consensus between the regulators and regulated. Murray also offered a way to study how the selective mores and values shared by both regulatory communities reacted to the signals and technologies of personal data protection regulation in Vietnam.
Schrepel’s complex analytical perspectives add to the framework the dynamism of regulatory ideas as traversing between communities through constant “feedback loops” that irritate changes in internal ideas. In this way, although communities may still dispute the essential regulatory issues, a consensus could be reached if the regulated community draws on sympathetic messages and proactively participates in dialogue with the regulators. Through traversing and allied actors who are members of both communities, sympathy is created among other nodes and disputing ideas are softened. Over time, changes occur if the communities mutually agree upon an epistemic construct while still maintaining their beliefs, goals, and other regulatory assumptions.
The study shows that the safety/security discourse diffused across the regulators’ community members through the networked commanding and authoritative power; through the proactivity of intermediate actors, the discourse spread across the regulated community and generated strong justification for the PDPD. It is also through these complex networking interactions that the authority to draft the PDPD was shifted onto the MOPS. This shift of regulatory and enforcing powers alternates the right-based approach of privacy with an authoritative approach, allowing for the legitimation of force, fines, and strict supervision in data privacy activities.
The study offers an important insight that by actively promoting regulatory signals through public mediated channels, the Vietnamese state created a dynamic regulatory domain which induces different actors to enter and exchange their ideas about data privacy regulation. The identification of regulatory scope in the PDPD has brought together a network of those who are under obligations or entitled to rights due to the PDPD’s effect. By releasing the PDPD drafts for public consultation, the authorities gathered a community comprising mass consumers/civilians, data collectors, processors, and other relevant subjects; this filtration also excluded the regulators from this community. However, the reliance on close-knit groups and epistemic and practical alliances has also formed gravitational groups that link different actors by bridging and empathetic discourses.
The ambiguity in some actors’ epistemic positions resulted in different degrees of influence. The academics, for instance, were identified by the regulators as parts of them. The academics’ lack of theoretical assumption on the right to privacy in the private rights logic had motivated them to interpret data privacy in the language of public interests, but the public interest or developmental discourses had become scaffolding discourses for the state’s cyber regulation goals set out in its digital transformation agenda. The IPS can also be categorised as a cross-community message deliverer because it understood the underpinning assumptions of two communities and strategically uses the grammar of the command-authority regulatory approach to achieve its advocacy goals. But whereas academia provides useful epistemic tenet for regulators, the IPS’ isolation in the networked regulatory domain had reduced its influence upon both communities; in turn, it got entangled between different constructs and had to adopt a more gravitational discourse (developmental effects of data privacy law) to achieve its goals.
The limitation of communicative venues in Vietnam today results from strict governmental measures to control public discourse and private exchanges of ideas. Although state attitudes towards citizen-initiated social activities have fluctuated (Sidel, Reference Sidel2008, p. 141), in recent years, state control over places of deliberation, especially on the internet, has been stricter (Sidel, Reference Sidel2023, p. 3; Lê et al., Reference Lê, Nguyễn, Phạm and Phạm2016, p. 123). Accordingly, the governmental control over the public sphere limited legal discussions to narrow venues. Thus, actors can only champion data privacy regulations within the limited scope established by the state through the intricate networks of actors and interpretations that public security discourse traversed, which provoke varied responses from communities.
The inclination towards public security ideas finds support in Vietnamese social practices and norms. For centuries, Vietnamese rulers had borrowed heavily from Confucian models of morals and law. Despite variances regarding the interpretation and application of core doctrines, in Vietnam, the Confucian morality system was widely adopted and applied as the official mechanism of social education, while the penal laws prohibited acts against collective interests (Whitman, Reference Whitman, Munro and Arbor1985, p. 89; Pham, Reference Pham, Gillespie and Nicholson2005, p. 80). Confucian morals depicted the state as an extended community which is organised based on familial-like relations; in addition, the sovereign was ideally demonstrated as a responsible head of the state who uses authoritarian measures to ensure the subjects’ safety and social harmonisation. The moral position of the paternalist state, the spirit of collectivism, and the condemnation of self-inclined interests featured in Confucian morals have found their reincarnation under different forms in modern public discourse (Nguyen, 1974, pp. 45–50; McHale, Reference McHale2004, p. 177). These embedded thinkings are preserved in writing and thoughts of a large part of the public; they are occasionally, if not constantly, circulated and revived in deliberative arenas during critical times (Phạm, Reference Phạm2004, pp. 15–16; McHale, Reference McHale2004, p. 177). The COVID-19 outburst, the government’s measures, and the widespread calling to forget oneself and sacrifice for the community seen during COVID-19 have reflected in the social sympathy towards the signals of safety/security of cyberspace. It is in this complex interaction that the security/safety approach of data privacy regulation was constructed.
The emergence of cyberattacks and other security issues challenged pre-existing cyber regulatory measures in Vietnam. From a comparative perspective, Bui and Lee found that, like China, Vietnam adopted a mixed socialist regulatory approach to govern cyberspace activities. Underlying such an approach are regulators’ efforts to maintain state sovereignty and defend the core socialist doctrines (Bui and Lee, Reference Bui and Lee2022). In practice, this created unprecedented challenges for regulators when they needed to effectively control discourses circulated in cyberspace while maintaining a degree of freedom to attract internet service providers and other digital businesses.
Vietnam’s inclination to participate in a broader international forum and promote investment in strategic sectors, such as digital service, has pressured policymakers to open up to regional and transnational commitments of data protection standards, transparency, and freedom of expression in cyberspace. However, studies showed that Vietnamese authorities had cleverly set human rights issues aside from regulatory dialogues and instead shifted focus onto developmental discourses (Gillespie, Reference Gillespie2023, p. 220; Kvanvig, Reference Kvanvig and London2022, p. 104; Nguyen, Reference Nguyen2022, pp. 174–178). The lack of technological infrastructure hindered regulators from effectively exercising mass-scale content moderation and blocks, but regulators succeeded in putting legal restraints to limit and direct regulatory deliberation. These successes complement the CPV command that regulation of cyberspace should be a harmonious act between market forces, civil rights, and sovereignty.
Regulators sailed through the challenges of balancing between promoting control measures and retaining private rights in cyberspace by drawing on the developmental goals scaffolded by the communitarian safety/security needs. This tactic has been systematically developed by the highest state authorities and diffused through different levels of government. For instance, in 2019, the CPV Politburo issued Resolution 52-NQ/TW “Certain guidelines and policies to actively participate in the fourth industrial revolution,” stipulated that “completing laws and policies of data, data governance, creating chances to construct, connect, share and exploit data while ensuring domestic cybersecurity and safety, towards connecting with ASEAN regions and internationally.” This dual mission provided regulators with a compass for data privacy policy implementation; by resorting to the “Great Unity” and other consensus-making strategies, regulators constructed a closed architecture for dialogue between selective actors and discourses, which ended up promoting security measures while exalting party lines and promoting state interests over cyberspace. On the other hand, market dynamics generated business expectations of the PDPD obligations to favour digital business models. Nevertheless, these were soon compromised with the shift of authority over a “real power” state agency that prioritises security and safety in cyberspace.
This study shows that rights-based approaches to privacy regulation may not adapt well to an East Asian socialist country like Vietnam. Whereas the Western ideals of liberty and transparency find roots in socially embedded mores and values, the ideas of collective security and information safety in critical times generated a vital tenet on which regulators constructed the meaning of data privacy. On this ground, the PDPD rules were developed to include control and sanction measures to ensure compliance from data controllers and processors. The court’s silence during the PDPD preparation also results in the monopoly of the executive branch to introduce the rights of data subjects and stipulate fresh obligations for data controllers and processors with little consideration of their adaptability to the rights-based privacy recognition in statutory legislation. Furthermore, the PDPD establishes the authority of the MOPS and its subordinate agency to oversee data processing activities, ousting existing authorities of the MoIC and the MoTC. These insights suggest that the epistemic divergence between a private right-based approach and the administrative control approach to privacy regulation could not be understood easily by drawing merely from cultural and institutional differences.
Finally, it is crucial to note that the safety/security interpretation does not eliminate the pre-existing rights-based approach to privacy in Vietnamese legislation. The overlapping understandings of data privacy raise further questions about the enforcement and implementation of privacy laws in Vietnam. So far, no epistemic relation has been established between the right to privacy in the Constitution and the Civil Code and the data subject’s rights as recognised in Article 9 of the PDPD. Further studies are needed to understand the trajectory of privacy law reform in Vietnam.
7. Conclusion
The recent enactment of Decree 13/2023/NĐ-CP on Personal Data Protection marked a significant step in Vietnam’s continuing efforts to establish a comprehensive framework for regulating cyberspace, but not in the way information privacy laws have developed elsewhere—to limit the use of personal data from businesses and the state to protect data subjects’ rights to privacy. This decree, driven by governmental policy initiatives, was designed to bolster national security and enhance the safety of the digital environment in Vietnam. By introducing new rights for data subjects, imposing obligations on data collectors and processors, and consolidating the state security agencies’ authority to oversee data privacy matters, it mandates changes to the way digital service providers and data subjects understand and make decisions about personal data in cyberspace. The decree also authorises a Ministry of Public Security department to oversee personal data processing activities. The PDPD complicates the existing rights-based legislation of privacy and further challenges the already challenging enforcement possibility of privacy law in Vietnam.
Two primary findings emerge from the study. First, the study highlights the regulators’ role in epistemically identifying personal data protection with collective safety and national security goals through narrowly constructed dialogical space. It remains understudied whether and to what extent global models of privacy regulation have influenced the crafting of the PDPD. Still, it is evident that liberal ideas and individualism have minimal influence on the meaning and implementation of data protection rules. As regulators community is compelled to implement party policies and develop a specific data privacy regime to meet developmental and security demands, the idea of guarding national security diffused among regulatory communities and alliances and, through gravitational influences, won out from the cross-community dialogues.
This overlaid meaning of data privacy is underpinned by the state’s pursuit of national security goals in cyberspace and the need to monitor information flows across various platforms. It underscores the party-state’s continuing efforts to manage and direct public opinions in the project to expand its authority in cyberspace despite the extending participation of non-state actors in shaping cyber regulation (Nguyen, Reference Nguyen2022, pp. 193–198; Sidel, Reference Sidel2023, p. 6). Notably, a similar approach to data privacy regulation has also been observed in China (Pernot-Leplay, Reference Pernot-Leplay2020, pp. 107–111; Jia, Reference Jia2024, pp. 764–800). Some commentators have further suggested that this patterned approach reflects, to some extent, the typical reaction of the socialist legal systems towards cyberspace (Bui and Lee, Reference Bui and Lee2022, pp. 666–673). This study is only confined to the insight that there is an emerging alternative model to global data privacy regulation which focuses on the state’s authority to determine the integrity of personal data management and that these specific regulations constructed an amplified control over digital businesses by making them responsible to state agencies for the protection of cyberspace users’ data.
Second, the study illustrates how the shared perceptions among the regulated shaped the construction of the security meaning of data privacy in Vietnam. Because Vietnamese netizens are generally inattentive to individual privacy, the rules for data protection are taken to mean state control measures on private businesses’ risky data management activities and against unknown, dangerous individuals who seek to obtain it for malign purposes (Sharbaugh, Reference Sharbaugh and Maj2013, p. 77). As such, the PDPD appears to the public as a safeguarding measure to ensure the security of the people. Firms prioritising their interests based on cost-benefit considerations and scholars’ advocates for better protection of personality rights, data/information safety, and suggestion of property rights system to personal data for economic development have aligned under the development discourse, which, in turn, scaffolded regulators’ security discourse. The solitude of the IPS in advocating for data privacy regulation resulted in unsuccessful attempts to renavigate public perceptions and regulators’ goals, as the lack of gravitation hinders it from gaining influence in both communities. To the general public, changes brought by the PDPD hold significance because they generate a collective sense of safety and peacefulness regarding cyberspace activities.
The study contains some limitations. First, it predominantly engages with the views of the regulated community, but it relies on discursive materials to generate insights into regulators’ tactics and strategies since most state agency members refused to disclose insights due to the topic’s sensitivity. Second, the study pays limited attention to the specific rules outlined in the PDPD text because it primarily focuses on the contextual elements that constructed the meaning of these data privacy regulations. Third, the study confines its inquiry to Vietnam’s data privacy regulatory model; it leaves out potential influences of global data privacy regulatory models and international dynamics upon the regulators’ consideration when crafting the PDPD. However, the findings call for further attempts to understand Vietnam’s sliding into the security and developmental approach of privacy law. This would provide valuable comparative insights with the Chinese “authoritarian privacy” model (Jia, Reference Jia2024, pp. 802–809). In a global context, the resemblances in privacy regulation between China and Vietnam and the development of a data privacy control regime in Vietnam offer an intriguing subject matter for continued observation.
Funding
This research is funded by University of Economics Ho Chi Minh City, Vietnam (UEH).
Open access
