Technology has made it easier than ever to monitor employees. Employers may use software programs installed on employees' work computers; they may establish network firewalls, control employees' use of computers, limit their access to the internet, and more. This article discusses how Vietnamese law regulates these activities.

General protection of privacy and personal information

The protection of personal information is guaranteed in Vietnam's Constitution for both Vietnamese and foreigners. It protects privacy (ie, information on personal life, personal secrets, family secrets) and their mail, telephone, electronic, and other forms of communications. Only certain state authorities have the right to open, check, withhold or censor correspondence. The authorities must act in accordance with the law.

More specifically, article 38 of the Civil Code 2015 ("Civil Code") provides that the private life and personal secrets of a person are protected. The collection, preservation, use and publication of information involving the private life and personal secrets of an individual are subject to that person's consent, except when the law provides otherwise. The confidentiality and safety of an individual's mail, telephone, electronic data, and other forms of private communications are protected. Monitoring private communications is allowed only upon decision of a competent state authority.

Under Article 159 of the Criminal Code 2015, if a person infringes the confidentiality and safety of an individual's mail, telephone, electronic and other forms of communications, there are criminal consequences. For example, she may be subject to warning, a fine of from VND 5 million to 50 million1, prohibition from holding certain positions for between one and five years, non-custodial reform for up to three years or a prison term of between one and three years.2

Monitoring by the employer

Employers also have rights. Article 6 of the Labor Code ("Labor Code") grants an employer the right to assign, arrange or manage its employees in accordance with requirements of the business. It allows an employer to deal with an employee's breach of labor discipline.

The essential tool to manage employees is the employer's internal labor rules ("ILRs"). ILRs establish the policy which regulates the workplace. ILRs are issued pursuant to Article 119 of the Labor Code and Article 27 of Decree 05/2015/ND-CP dated January 12, 2015 ("Decree 05"). The ILRs include stipulations on, say, (i) corporate order (for example, rules governing the workplace and communications); and (ii) the responsibilities of employees to protect a company's assets, technology, and business secrets.

The Labor Code and ILRs empower an employer to monitor employees in the workplace to ensure that its ILRs are being observed. There are some common ways in which an employer may monitor its employees.

(a) Monitoring employees' Internet use

An employer may monitor its employees use of the Internet (even via the employee's private computer or smart phone) by blocking access to specific websites. If, however, the employer wants to collect, process, and/or use personal information which an employee transmits on the Internet, it must satisfy conditions that appear in the Law on Information Technology:

  • The employer has received the employee's consent;
  • The employee has been informed of the form, scope, place and purpose of collecting, processing and using his/her personal information;
  • The collected personal information is only used for the purposes to which the employee agrees, and may be preserved only for a given, agreed period of time;
  • The employer has measures in place to ensure that personal information will not be lost, stolen, disclosed, modified or destroyed;
  • The employer must take action in response to an employee's request to review, correct or destroy her personal information and must suspend the use or disclosure of incorrect personal information; and
  • The employer may not disclose an employee's personal information to a third party without the employee's consent unless there is an exception in the law.

In the following section we discuss bases on which an employer may collect, process or use data without the need to satisfy these conditions.

(b) Monitoring business emails

Under one view, an employer should not have to seek an employee's consent in order to access business emails which she sends or receives. This follows the view that an employee's business email address and the information technology system are the property of the company. As such, in this view, an employer may monitor the use of its "property". Such monitoring is not prohibited under either the Constitution or the Civil Code.

One view goes further. It says that an employer may--without its employees' consent--collect, process and use personal information contained in business emails. This view follows from the view that an employee should be aware that both its business emails and the information technology system through which business emails are transmitted are the property of the employer and therefore, that the employer can access business emails in the system. This view further assumes that the employee acknowledges that any personal information contained in those business emails is not confidential.

This view, however, is not really legally supported. As a general rule, the collection, processing, and/or use of an employee's personal information requires her consent. Awareness, however, is not consent. An employer may access an employee's personal information through its act of monitoring business emails. But in order to collect, process, and/or use such information, we believe, requires employee consent. This appears to be the case even when the employer wants to use employee's personal data for disciplinary purposes such as to document that the employee spends time inappropriately, handles personal matters on company time, or breaks company rules, or worse.

In order to ensure that monitoring employees' business emails does not violate employees' privacy rights and personal information protection, the employment contract (or even a separate statement) of a prudent employer will state both the employer's right to monitor employees' business emails, and the extent to which the employer may collect, use, process and/or disclose personal information which it discovers.

(c) Monitoring of personal emails

The network connection in the workplace is generally considered to be owned by the employer. The employer may block its employees access to personal email websites. However, again we believe that the employer must obtain employees' consent in order to collect, use, process, and/or disclose personal information contained in the employees' personal emails.

(d) Monitoring employees' computer use

A computer provided by an employer to an employee is the employer's asset. As such, it may be argued that employer can monitor use of the computer without employee's consent. We do not recommend relying on tight legal arguments. To avoid disputes, it is advisable for an employer to impose rules on the use of work computers. The rules should include the extent to which an employee may store her personal files in a work computer or to create back-up files, as well as the employer's right, at its own discretion, to, say, access and delete an employee's own personal file stored on a computer which it provides to an employee. We believe that monitoring an employee's use of her own computer in this way requires consent.

(e) Monitoring of employees' telephone use

A telephone which the employer provides to an employee is the employer's asset. The employer can monitor the employee's use of its telephone by recording the employee's telephone conversations without the employee's consent. However, again, to avoid disputes, the employer's internal rules should cover use of telephones provided by the employer and should state that telephone conversations may be recorded. Recording a telephone conversation may involve a second party. As such, the employer may choose to use a notice that begins with a statement that the call may be recorded. If the other party continues the conversation, she is deemed to have agreed to having the call recorded.

* * *

In practice, it seems that relatively few local companies attempt to monitor their employees. However, for those companies that do, neither the extent nor the methods which they may legally employ have been fully developed. Vietnam does not yet have a specific set of rules or even practices to regulate how employers may legally monitor their employees. Employers should develop their own rules for monitoring employees based on the general regulations we have discussed. We believe the rules are easier to enforce if they are based on prior notification and prior consent. Even so, the rules should strive to balance the protection of employees' privacy rights and personal information with an employer's need to manage work, manage time, and protect equipment, business secrets, and other assets in the workplace as to prevent improper and illegal conduct.

Footnotes

1. With an approximate exchange rate of US$ 1.00 = VND25,000, the fine is from US$190 to US$1900.

2. Personal information is generally protected in the Law on Electronic Transactions, Law on Information Technology, Law on Post, Law on Publication, Law on Cinematographic, Law on Criminal Records, Law on Credit Institutions, Law on Protection of Consumers' Rights and Law on Cybersecurity.

This article appeared in Lexology on 21 December 2020.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.