Market survey businesses not only collect identifying information such as name, age, occupation, but also collect data on consumer behavior, interests, personal opinions, product reviews, even sensitive information such as health status, etc. financial behavior or social issues. The scope of data collection and use is wide, so businesses in this segment are forced to make many adjustments to adapt to the new legal system on personal data protection ("PDP").
Change how data is collected
Survey participants are fully informed of the purpose; Consent expressly, voluntarily and separately; and Being given the right to withdraw consent at any time are three factors that the survey participant must know and agree to in order for "consent to participate" to be considered a legal consent.
That is, market survey businesses must remove "inclusive" consent forms or let users click through the speaker. Each purpose of collection must be clearly stated, and consent must correspond to each of those purposes. Next, businesses are forced to apply the principle of minimizing data collected, when only collecting personal data that is really necessary and has a clear legal basis.
Survey participants are no longer "data providers" but become "data subjects". That means businesses must build a mechanism that allows them to review data, request correction or deletion, and ask businesses to stop processing data. Without a process that meets these rights, any collection is at risk of being considered a violation.
Third-party controls
A market survey is rarely conducted by a single entity. Businesses in the industry often outsource many stages, from collecting data through direct surveys, using third-party survey platforms, hiring data analytics units, or transferring raw data to customers for them to process themselves. Each phase of personal data sharing contains certain risks in terms of PDP, so how is this processing chain restructured with the new law?
The new law stipulates that the personal data controller must be responsible to the personal data subject for the damages caused by[1] the process of processing personal data. This means that the market survey enterprise is ultimately responsible for the data subject regardless of which partner in the chain transfers the data to. Even a small mistake by a third party can still cause market survey businesses to face legal risks, reputational damage and compensation liability.
Therefore, market survey enterprises must add PDP clauses to the entire contract with partners and develop an internal control process for related obligors. In addition, it is also necessary to establish an ongoing monitoring process for third parties, including assessing the level of security, reviewing their internal policies, and requiring periodic reports on data processing. These measures used to be considered "complicated" or "unnecessary", but in the context of increasingly tightly protected personal data, this is a mandatory governance standard.
Building new data usage models
It can be said that the biggest challenge today of market survey businesses after collecting data lies in the use and storage stage, not the analysis technology.
In the past, survey data was often stored for long-term use for future analysis, reused for multiple projects, or resold in the form of aggregated data. This is now not allowed. For example, a group of personal data collected for product A survey cannot be used to analyze general consumption trends, assess demographic groups, or serve project B without the explicit consent of the survey participants. That forces market survey enterprises to redesign their operating models in the direction that each project must have a separate processing purpose, data records must be separated, and the storage mechanism must be in accordance with the deadline committed in the collection notice. The data lifecycle must therefore follow a cycle, including collection for the right purpose, proper processing, storage for a limited time, and deletion when the purpose has been accomplished or when required.
In other words, the technical system and internal processes of the enterprise must be adjusted, such as allowing data deletion upon request, terminating processing when the data subject withdraws consent, and providing a copy of the personal data when the data subject requests. These are all legal obligations that can put businesses at risk if they do not have proper preparation.
After all, when businesses build transparent collection processes, effective third-party controls, and responsible lifecycle data operations, they not only avoid legal risks but also improve the value of personal data, strengthening their position in an industry with fierce competition such as the survey industry, market statistics.
Lawyer Nguyen Nhat Duong
HM&P Law Firm
Read more: Bảo vệ dữ liệu cá nhân – ngành khảo sát thị trường ứng phó ra sao?
[1] Point g, Clause 1, Article 37 of the Law on PDP.
