According to the resolution, personal data are processed without the consent of the data subject in several cases, such as protecting the life and health of the data subject or others in an emergency situations; the personal data controller; the personal data processor; the personal data controller and processor; the third party holding responsibility for proving these cases; the disclosure of personal data in accordance with the law; data processing by competent state agencies in the event of an emergency on national defence, national security, social order and safety, major disasters, and dangerous epidemics; and in case when there is a risk of threatening security and national defense but not to the extent of declaring a state of emergency.
Personal data can also be processed without the consent of the data subject to prevent and combat riots and terrorism, and to prevent and combat crimes and law violations in accordance with the provisions of law; to fulfill the contractual obligations of the data subject with relevant agencies, organisations, and individuals as prescribed by law; and to serve activities of state agencies prescribed by specialised laws.
The Government has also approved the content of the draft Decree on Personal Data Protection, and assigned the Minister of Public Security to prepare a report about this draft Decree to submit to the Standing Committee of the National Assembly for approval, as prescribed in Section 3 of Article 19 in the Law on Promulgation of Legal Documents in 2015 (amended and supplemented in 2020).
