Vietnam data storage law rankles Big Tech and CPTPP trade bloc

China-like restrictions set companies scrambling in key test of Pacific trade deal

Technology companies are scrambling to comply with an abrupt regulation to store data in Vietnam, a requirement they say will impair business and put Hanoi on a collision course with a mega trade deal that forbids the forced use of domestic servers.

Internet platforms from YouTube to Facebook had been following drafts of the rule, now called Decree 53, for three years before it was signed into law last month with little notice. It is set to take effect on Oct. 1.

It is unclear how Vietnam will enact the decree without reneging on its pledge against forced data localization, one it has made as a party to the Comprehensive and Progressive Agreement for Trans-Pacific Partnership.

But another CPTPP member would have to litigate the issue to force Hanoi to keep its pledge. Nikkei Asia contacted all six other countries that ratified the trade pact, and none would say if it planned to use the pact’s enforcement tool.

Beijing further complicates the internet debate, having passed a similar cyberlaw. Vietnam would have another country in its corner if the trade bloc approves China’s application to join.

Japan and Canada, which were key to finalizing the CPTPP, are monitoring next steps in the Southeast Asian country.

« Canada continues to urge Vietnam to implement its laws and regulations applicable to the transfer and storage/processing of data in a manner that is consistent with its commitments in Chapter 14: Electronic Commerce of the » CPTPP, Global Affairs Canada Spokesperson Lama Khodr said by email.

She said Ottawa is « following the issue, » citing the rule specifically, Decree No. 53/2022/ND-CP, which falls under the Cybersecurity Law overseen by Vietnam’s powerful security ministry.

Tokyo noted the trade deal prohibits data localization and already « expressed concerns » about the original cyberlaw.

« The Japanese government will keep our close watch on the consistency between the Law on Cybersecurity and Vietnam’s obligations under relevant international agreements, including CPTPP and RCEP, » the Ministry of Economy, Trade and Industry told Nikkei. RCEP is the Regional Comprehensive Economic Partnership.

BSA, a global software trade body funded by Amazon Web Services, Siemens and others, said the decree would put companies at a competitive disadvantage, impairing their ability to choose vendors and find clients.

« Data localization does not improve the security or availability of data to customers or law enforcement, » Jared Ragland, BSA Asia-Pacific policy senior director, told Nikkei. When asked about foreign investment, he said: « The risk is that companies will shift to other regional markets with more welcoming policies. »

Singapore and South Korea offer an example for Vietnam and promote the free flow of data, said the Asia Internet Coalition, a lobby group funded by Google, SAP, Grab and Meta, which owns Facebook, Instagram and WhatsApp.

Decree 53 will require foreign companies to store information on computer servers in Vietnam if users violate the law on their platforms and if the companies do not handle the violations as ordered by the one-party state, such as by blocking an offensive post. Offenses include « content that infringes national security, propagandizes against the state; incites violence; disrupts security or public order; is humiliating or slanderous » or damages the economy, law firm Tilleke & Gibbins said in a summary.

Among social media platforms, TikTok did not respond to a request for comment and Meta declined to comment on the law. YouTube owner Google said the AIC « represents the industry’s view on it. » In the past Facebook has said its servers were slowed after it resisted internet takedown orders.

Websites may be blocked if companies don’t store details about a user’s phone, email, credit card and « friends or groups with which the user connects or interacts, » the decree says.

Both Hanoi and Beijing have tightened the screws on online critics, brooking almost no dissent against the government.

« If China joins the CPTPP, this is likely to benefit Vietnam as the two countries seem to share the same views, » a source in the private sector told Nikkei. When asked how Vietnam could square the circle, retaining data localization without running afoul of the trade pact, the source said the CPTPP makes exceptions for « a legitimate public policy objective. »

So does RCEP, a trade zone that already includes China and Vietnam. « China was the driving force behind the rather restrictive digital trade rules in the RCEP, » Korea University Law School dean Nohyoung Park wrote in an analysis.

But Vietnamese generally have more internet freedom than their neighbors, and there are signs that Hanoi took pushback seriously. Several observers said Vietnam may have delayed the decree while responding to pressure from the U.S. and watered down some limitations, such as requiring localization only under certain criteria. Besides pressure from U.S. officials, Vietnam’s prime minister received a letter on Friday calling the decree « a significant burden » stoking business uncertainty, signed by the AIC and U.S. chambers of commerce in the two countries.

Hanoi also bought itself some time. Other CPTPP parties agreed not to sue it before 2024, one of multiple deals that various countries struck to finish negotiations.

By Lien Hoang – Nikkei Asia – September 15, 2022