Cybersecurity in Vietnam has anything changed ?
Since adoption of the Law on Cybersecurity in 2018, there has been an ongoing conversation opposing the strict regulatory environment that the Law creates. Strict enforcement, it is said, would disrupt the continuous flow of data so important to commercial development.
While this conversation has gone on, the Vietnamese Government has not taken any real steps to provide clarification or to enforce the Law. Businesses continue to operate in the shadow of the Law, while awaiting further guidance. But lack of clarity is not new in Vietnam and often serves the Government’s purpose of hands-off control.
The Cybersecurity Landscape
On 12 June 2018, the National Assembly of Vietnam adopted the Law on Cybersecurity (“LCS”). It aims to protect national security and ensure social order and safety in cyberspace. It fixes the responsibilities of agencies, organizations, and individuals. The LCS further regulates the security of cyberspace, which was already regulated to some extent by the Law on Network Information Security (LNIS).
The LCS has received a steady stream of criticism from the European and American business communities. The Asia Internet Coalition (AIC), representing several international businesses, has stated that “the provisions [that relate to] data localization, controls on content that affects free speech, and local office requirements will undoubtedly hinder the nation’s 4th Industrial Revolution ambitions to achieve GDP and job growth” and “will cause severe limitations on [the development of] Vietnam’s digital economy, dampening the foreign investment climate and hurting opportunities for local businesses and SMEs to flourish inside and beyond Vietnam”.
Going beyond the restrictive language of the LSC, there are also broad issues that lack clarity and there is no guidance from the Government. These issues must be resolved before the LCS can be fully understood, implemented and enforced.
The LCS gathered public attention when a draft was published for public comment in early 2018. Concerns over the LCS have only grown and are raised mainly by two groups: offshore service providers and human rights activists. They correctly observe that the language is very broad and that there are vague provisions on mandatory data localization and the need for physical establishment in Vietnam. Most concerning to these two groups is the Government’s power to control and remove ‘illegal’ content.
The LCS covers all connected networks of information technology (“IT”) infrastructure, telecommunications, Internet, computer networks, information systems, information processing and control systems, and databases, where people perform social acts without being limited by space and time. This characterization of cyberspace includes most services on the Internet, including e-commerce, websites, forums, social networks, blogs and so on. There are no real exceptions. Particularly, the LCS’s requirement for data localization concerns both domestic and offshore enterprises which provide services on the Internet or on a telecommunications network or which provide other value-added services on the Internet to customers in Vietnam, and collect, exploit, analyze and process personal data, customer’s information or any information created by customers in Vietnam. If a company acts within this scope, and most companies providing any service to clients in Vietnam do act within this scope, that company will be required to store the personal data of its customers, and any other data created by customers within Vietnam, in Vietnam, for a period to be specified by the Government. Offshore companies affected by this requirement will be required to establish a branch or representative office in Vietnam. Even ‘cloud’ space must reside on a device or system that is both physical and tangible (eg, data centres or server farms). Requiring localization of data, essentially means that the cloud provider must lease space in data centres or server farms in Vietnam.
The control of “illegal” content
In addition to data localization and local office requirements, the Government intends to control data found on the internet by verifying personal data and through mechanisms to authenticate information when users register digital accounts. It intends to control the sharing and deletion of information which contains illegal content. Its purpose is to control propaganda aimed against the Socialist Republic of Vietnam or activities which would instigate violent disturbances, disrupt security or disturb public order if the content is slanderous or is in violation of economic management (« Information Against the State »). The Government has, in fact, established a new national unit to monitor social media and other web content.
This scope of the Government’s intended action is said, by Human Rights Watch, to “subordinate freedom of expression, access to information, freedom of opinion, and other rights to the political interests of the Vietnamese Communist Party”.
However, apart from the legitimate concerns raised by human rights activists, companies, including Facebook, Google, and others which would be most affected by the LCS, do not seem to share the same deep concerns. Then Minister Nguyễn Mạnh Hùng of the Ministry of Information and Communications (“MIC”) praised Google, for being “collaborative”. Indeed, the company complied with a request by the MIC issued in January 2019 to remove “toxic” content, taking down over 5,000 YouTube videos that authorities claimed “slandered and defamed” the country’s leaders. In August 2019, Minister Hùng announced that Google complies with « 80 to 85% » of its requests on YouTube and other Google services–up from « 60% » previously. In 2019, the MIC also said that Facebook had complied with « 70 to 75 percent » of Government requests to restrict content, compared to « about 30 percent » previously. However, both Facebook and Google say that their standards to remove undesirable content and block accounts of individuals who act or make inappropriate comments are global and are the same in Vietnam as they are worldwide. These firms may have decided to accept Government guidance as the best alternative to avoid conflict or their practices in Vietnam do indeed follow their worldwide practices.
Draft Regulations as Strategy
Despite the public concern, no implementing regulations nor guidelines have been promulgated. As there is no detail, the broad provisions of the law have not been enforced. As of this writing, there are several draft guidelines under consideration, including a decree on Article 26 of the LCS on data localization and local establishment. There is no indication when a decree will be issued, but by circulating its decree guiding Article 26 of the LCS for comment, in draft form, the Ministry of Public Security (“MPS”)’s indicates a willingness to listen to the industry and to public opinion. Through September 2019, the MPS had sent over 200 letters to ministries and agencies and to organizations and experts requesting comment. It is worth noting that even though the MPS is asking for comments from the business community, MPS’s primary mandate is to protect national security, to maintain public order, and to fight against crime and illegal activities. As such, they may not be as business-friendly as the Ministry of Information and Communications (“MIC”)’s or the Ministry of Industry and Trade.
In the last half of 2020, the MPS has raised the idea of requiring all businesses operating in Vietnam to comply with requirements on data localization and local establishment, which, of course, raised serious concerns from the business community. However, even if such a requirement is drafted, implementation and enforcement will need to be considered. Questions such as which types of services are regulated and which types of data are required to be stored in Vietnam will need to be addressed in the decree.
Besides the draft decree related to the LCS, there are other legislative developments that could affect business in cyberspace. In early 2020, MIC proposed to amend the Government’s Decree No. 72/2013/NDCP dated July 17, 2013 on management, provision and usage of Internet services and information on the Internet (proposed Amended Decree 72). In proposed Amended Decree 72, the Government would introduce new, compulsory licenses and establish new requirements for social networks, for instance, having a person of Vietnamese nationality with experience in journalism management or with a university degree in journalism, to be in charge of content management; or putting measures in place to ensure that only members of social networks (accounts which have been verified with a two-step verification process with real name and phone numbers) will be allowed to interact on platforms, etc. Additionally, application distribution stores such as the Google Playstore or the Apple Appstore would also be regulated, and the proposed Amended Decree 72 provides that they must not distribute or provide, via their platform, any product or service that violates Vietnamese law or that does not have the required license/certificate.
The proposed amended Decree 72 has also received criticism from the business community, which states that the “proposed content controls raise serious data privacy and governance concerns, while proposals to license online platforms create new barriers to entry that could harm SMEs and startups that are leveraging these [platforms] to power Vietnam’s digital economy”. It is a concern to business that the requirements for additional licenses, certificates and personnel which are stated in the Amended Decree 72 would likely increase cost and complexity for businesses and the fear is that that will reduce Vietnam’s attractiveness as an investment destination. The MIC is still collecting public comments on proposed Amended Decree 72.
“Abuse” of social networks, control of personal data
In a related development, on February 3, 2020, then Prime Minister Nguyen Xuan Phuc signed into law Decree 15/2020/ND-CP on administrative sanctions for violations of postal services, telecommunications, electronic telecommunications frequencies, IT and electronic transactions (Decree 15). Decree 15 also covers violations in network information security and spam, among other important areas. Decree 15 focuses heavily on abuse by members of social networks who share what the Government terms false, distorted or slanderous information.
In the past few months, during the COVID-19 pandemic, the Government has imposed sanctions in several cases in which the Government believed that violators abused social networks to share fabricated information that aroused public concern or that induced violence and crime. Additionally, the Government strongly encourages the development of cloud platforms and applications, while setting up technical standards and requirements in order to supervise this new database technique (ie, cloud computing). On May 21, 2020, then Minister of Information and Communications Nguyễn Mạnh Hùng said cloud computing must be a top investment priority in Vietnam’s digitalization strategy and socio-economic development, and that it will play a key role in future digital infrastructure in February 2021. But in an apparently contrary indication, the MPS published a draft decree on protection of personal data. This draft proposes, among other things, a registration requirement for cross-border transfer of personal data, which would seriously impede the currently unrestricted flow of data and again, underlines that the MPS supports the notion of data localization in Vietnam.
The Path Between
Of course, the Vietnamese Government faces a dilemma. On one hand, the Government clearly wants to modernize its internet by pushing for the adoption and implementation of cloud computing. If Vietnam wants to speed up the development of the internet–and every indication is that it does–then modernization must proceed without stifling control. On one thread, what is occurring is literally a modernization of the system enabled by the cloud, and this is a big step for the electronic universe. It is touching every facet of life in Vietnam, and the Government is highly supportive. On the other hand, Vietnam is trying to balance this objective with its perceived need to scrupulously watch and shape developments. Given the adoption of the LCS and the direction which the draft decrees have taken, the questions are whether the Government can find a path between modernization and control and moderate the negative way regulations may affect many companies with Vietnamese customers, especially multinational companies. Last but not least, ever since the adoption of the LCS in 2018, there has been little development in other provisions of the LCS, save for the requirements discussed in this article.
The situation has created a profound muddle. A lack of guidelines denies clarity and creates uncertainty. But lack of clarity and certainty is not new in Vietnam. Often it is a conscious strategy. It means that the debate remains open. For business, it means that past practice enabled by light regulation should be modified voluntarily to avoid provocation. Lack of certainty also enables companies to continue to make and develop their case in the face of light regulation while at the same time aligning at least in part, with the government.
While the right of the government to require localization is clear, it has not yet been enforced, and the threat of localization is an informal but effective way to control conduct. As this is a route well known in Vietnam, the business community and especially those which will be primarily affected by a stricter framework can continue to present its solid arguments against control while, at the same time, being sure that its conduct is not provocative. The current situation is not ideal, but it allows the Government to continue to listen to business while partially achieving its objective of control.
In the end, it is likely that the drafts will become law and some version of existing language will be implemented. However, we expect that the language will leave much room for Government interpretation. This may suit the circumstances where objectives are not aligned and where the Government believes in the virtue of ambiguity.
By Le Ton Viet (Russin & Vecchi -Vietnam) – Lexology – May 28, 2021