EU data transfer requirements for an adequacy decision and the Vietnamese legal realities

Sammanfattning: In an increasingly globalized world and after a decade of digital revolution, the protection of personal data has fallen in the limelight. Nowadays, data is exchanged over the internet daily for various purposes, including strictly private, commercial, as well as public, which has raised concerns on how these transfers of personal data may affect the right to data protection and the right to privacy. In the EU context, there has been a tradition to protect personal data which dates back to 1995, when Data Protection Directive was adopted. Since then, the data protection within the EU has also been gradually strengthened, most prominently by the advent of the Charter of Fundamental Rights of the European Union, giving the protection of personal data the formal status of a fundamental right. However, the same trend is not necessarily apparent in countries located outside the EU, or other international legal orders apart from the European Council. It can be asked how the EU should relate to countries that are believed to provide a lower level of protection of personal data than the level within the Union? Which countries are those, and is Vietnam among them? Should cooperation be excluded or initiated or perhaps maintained, depending on the merits of the case? Should the benefits of enhancing world trade outweigh the risk of potential data protection infringements? During the past 20 years, Vietnam’s and EU’s trade relationship have become increasingly important. Nowadays, Vietnam is the second biggest trading partner with EU among the countries in the Association of Southeast Asian Nations, a trend that does not seem to subside. In June 2019, EU and Vietnam signed a free trade agreement and an investment protection agreement and subject to the European Parliament’s approval, some hope they will enter into force within the immediate. While it can be expected that data transfers will increase between the parties, one can question, whether there are relevant mechanisms in place to facilitate data exchange and advance the cooperation. In the EU, the most important and comprehensive mechanism for data transfers a so-called adequacy decision. Yet, while Vietnam is ready to be a trade partner, it might not necessarily be ready for other things that come in parallel with it, as increased data flows. In this paper, the EU requirements for transferring data to a third country will be examined, focusing on the avenue of an adequacy decision. In parallel, the data protection regime in Vietnam will be scrutinized and tested against the EU standards for adequacy. It will be argued that Vietnam does not meet the EU requirements for adequacy and that the current gap is rather wide, and it is likely to take more than just some amendments in the law to close the gap. Likewise, it will be argued that the EU adequacy requirements are not clear and straightforward, leaving uncertainties to Vietnam and the states in comparable position.