Technology has made it easier than ever to monitor employees. Employers may use software programs installed on employees' work computers; they may establish network firewalls, control employees' use of computers, limit their access to the internet, and more. This article discusses how Vietnamese law regulates such activity.
General protection of privacy and personal information
The protection of personal information is guaranteed in Vietnam's Constitution promulgated in 1992 ("Constitution"). The Constitution protects citizens' privacy and their correspondence, telephone, and telegraph communications. Only competent state authorities have the right to open, check, withhold or censor citizens' correspondence. The authorities must act in accordance with the law. The protections in the Constitution appear to apply only to Vietnamese citizens.
Article 38 of the Civil Code 2005 ("Civil Code") provides that: "The right to privacy of an individual shall be respected and protected by law. The collection or publication of information and materials that relate to an individual's privacy are subject to that individual's consent ... except for the collection or publication of information and materials [which are specifically not subject to such consent] pursuant to decisions of competent state authorities. The confidentiality and safety of an individual's mail, telephone ... and other forms of communications are protected. Monitoring an individual's mail, telephone ... and other forms of communications must comply with the law and [are allowed] only upon a competent state authority's decision." The protections set forth in the Civil Code extend to all persons, irrespective of citizenship.
Personal information is generally protected in other laws as well: Law on Electronic Transactions, Law on Information Technology, Law on Credit Institutions, Law on Protection of Consumers' Rights, Criminal Code 1999 (as amended in 2009), and all implementing regulations.
Monitoring by the employer
Employers also have rights. Article 6 of the Labor Code of 2012, with effect from May 1, 2013, ("Labor Code") grants an employer the right to assign, arrange or manage its employees in accordance with business requirements. It allows an employer to deal with an employee's breach of labor discipline.
The essential tool to manage employees is the employer's internal labor rules ("ILRs"). ILRs establish the policy which regulates the workplace. ILRs are issued pursuant to Articles 119 of the Labor Code and Article 4 of Decree 41 (July 6, 1995) on labor discipline and material responsibility. The ILRs include stipulations, among other things, on: (i) corporate order (for example, rules governing the working area or communications); and (ii) employees' responsibilities to protect a company's assets, technology, and business secrets.
Provisions on labor discipline and ILRs contained in the Labor Code support the view that an employer may monitor employees in the workplace to ensure that its ILRs are observed. We discuss common ways in which an employer may monitor its employees.
(a) Monitoring employee's Internet use
For computers with access to the Internet, the employer may monitor its employees' use of the Internet (even via the employee's private computer or smart phone) by blocking access to specific websites. If, however, the employer wants to collect, process, and/or use an personal information which an employee transmits on the Internet, it must satisfy the following conditions under the Law on Information Technology:
- The employer has received the employee's consent;
- The employee has been informed of the form, scope, place and purpose of collecting, processing and using his/her personal information;
- The collected personal information is only used for the purposes to which the employee agrees, and may be preserved only for a given period of time as agreed between the employer and the employee;
- The employer has the necessary administrative and technical measures in place to ensure that personal information will not be lost, stolen, disclosed, modified or destroyed;
- The employer takes prompt and appropriate action in response to an employee's request to review, correct or destroy his/her personal information; and the employer must suspend the use or disclosure of incorrect personal information; and
- The employer may not disclose an employee's personal information to a third party without the employee's consent, or unless otherwise provided by the law.
In the following section we discuss bases on which an employer may collect, process or use data without the need to satisfy these conditions.
(b) Monitoring of business emails
Under one view, an employer should not have to seek an employee's consent in order to access business emails which s/he sends or receives. This follows the view that an employee's business email address and the information technology system through which business emails are transmitted are the property of the company. As such, an employer may monitor such "property" to determine whether it is being used appropriately. Such monitoring is not prohibited under either the Constitution or the Civil Code.
One view goes further. It says that an employer may--without its employees' consent--collect, process and/or use personal information contained in business emails. Such conclusion follows from the view that an employee should be aware that both its business emails and the information technology system through which business emails are transmitted are the property of the employer; therefore, the employer can access those business emails and any personal information which appears in those business emails is not confidential. This view, however, does not seem to be legally supported. As a general rule, the collection, processing, and/or use of an employee's personal information requires his/her consent. However, awareness does not constitute consent. An employer may access an employee's personal information through its act of monitoring business emails. In order for the employer to collect, process, and/or use such information, however, we believe, requires employee's consent. This appears to be the case even when the employer wants to use employee's personal data for disciplinary purposes such as to document that the employee has wasted company time, was absent from office for personal matters, etc.
In order to ensure that the act of monitoring employees' business emails does not violate employees' privacy rights and personal information protections, the employment contract of a prudent employer should state both the employer's right to monitor employees' business emails, and the extent to which the employer may collect, use, process and/or disclose personal information that it may access through its monitoring process.
(c) Monitoring of personal emails
The network connection at the workplace is generally considered to be owned by the employer. The employer may block employee's access to personal email websites. However, we believe that the employer must obtain employees' consent in order to collect, use, process, and/or disclose personal information contained in the employees' personal emails.
(d) Monitoring of employees' computer use
A computer provided by an employer to its employee is the employer's asset. As such, it may be argued that use of such computer can be monitored by the employer at any time without the employee's consent. To avoid disputes, however, it is advisable for an employer to impose express rules on the use of work computers. The rules should include the extent to which an employee may store his/her personal files in a work computer or to create back-up files, as well as the employer's right, at it own discretion, to access and delete a personal file stored on a computer which it provides to an employee. However, we believe that monitoring an employee's use of his/her own computer requires consent.
In practice, it seems that relatively few local companies attempt to monitor their employees. However, for those companies that do, neither the extent nor the methods which they may legally employ have been fully developed. Vietnam does not have a specific set of rules to regulate how employers may legally monitor their employees. Employers should develop their own rules for monitoring employees based on the general regulations discussed above. In our view, such rules are easier to enforce if based on prior consent. Even so, the rules should strive to balance the protection of employees' privacy rights and personal information with an employer's need to manage work, manage time, and protect equipment, business secrets, and other assets in the work place.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.