Vietnam cybersecurity law: what firms must know

Vietnam cybersecurity law is about to become a fact of life for any firm that runs an online service in the country. The National Assembly is set to pass the bill during its summer session, and VnExpress reports the vote is planned for 12 June 2018. This note explains what the draft says about data and local offices, and what is still unclear.

Source: VnExpress International, "Cyber security law restrictions worry Vietnamese legislators," 29 May 2018 (e.vnexpress.net).

What is this law?

The bill is a national law proposed by the Ministry of Public Security. It aims to give the government more control over big foreign tech firms such as Google and Facebook. It also aims to curb posts that the government calls anti-state, defamatory or a threat to public order.

Today, online rules sit mostly in government decrees. The best known is Decree 72 of 2013, which covers internet services and online information. A law passed by the National Assembly would carry more weight than a decree. The government would then write guidance on how each part works. For firms, the law is only the first step.

Source: VnExpress International, 29 May 2018; Decree 72/2013/ND-CP of the Government of Vietnam, 15 July 2013 (english.luatvietnam.vn).

Who would it cover?

The draft debated in May covers both local and foreign companies. Asia News Network reports that it applies to organisations that provide internet services or own an information network in Vietnam. That is a broad group. It can include a local software firm, an online shop and an overseas platform that serves users here.

The article numbers have moved from draft to draft. In the draft that lawmakers discussed on 29 May, the data and office duties sat in Article 26. In the 16th draft, which the National Assembly posted for public comment in May, they sat in Article 28. Always check the number against the draft you are reading.

Source: Asia News Network, report on the National Assembly debate, 30 May 2018 (asianews.network); Baker McKenzie via Conventus Law, "Vietnam: 16th draft of the Law on Cybersecurity," 11 May 2018 (conventuslaw.com).

What would firms have to do with data?

Two duties matter most for operations.

• Store data in Vietnam. This covers personal data of users in Vietnam and other "important data" that the government will define.
• Have a headquarters or a representative office in Vietnam. The 16th draft applies this to offshore telecom and internet providers.

Storing data at home is often called data localisation. It can change costs. A firm that keeps all its data on servers abroad may need local hosting or a local partner. A firm that already uses a Vietnamese data centre may need to do very little.

Note one change. VnExpress says the first version of the bill required foreign firms to install servers in Vietnam, but the ministry dropped that in January. The office and data storage duties stayed in.

The bill also lets police units under the Ministry of Public Security ask internet firms for users' information. Some lawmakers said this was too loose. They want clear rules on when a firm must hand over data.

Source: Baker McKenzie via Conventus Law, 11 May 2018; VnExpress International, 29 May 2018; Asia News Network, 30 May 2018.

What is still unclear?

A lot. The draft leaves several terms open, and the final law may change them. Firms should watch these points.

• What counts as "personal data"? Baker McKenzie notes the draft does not define it.
• What counts as "important data"? The government has yet to say.
• Which agency decides whether a post breaks the law? One lawmaker said it should be named, and pointed to courts in Indonesia.
• When must a user's information be handed over?
• What counts as a breach of national security? One deputy said the draft never defines it.
• How much time will firms get to change their systems?

Some lawmakers called the office and data rules "impractical." Others, including a provincial police chief, defended them as reasonable. We cannot say how the vote will go, and the text may change before it. Treat every detail here as a description of the draft, not of final law.

Source: Baker McKenzie via Conventus Law, 11 May 2018; VnExpress International, 29 May 2018; Asia News Network, 30 May 2018.

What can firms do now?

You do not need to rebuild anything today. A few cheap steps will help whatever the outcome.

1. List the data you hold on users in Vietnam, and where it is stored.
2. Ask your hosting and cloud providers what local options they offer.
3. Write down who would answer a government request for user data, and how fast.
4. Check how long you keep user logs.
5. Ask your lawyer to read the final text and the guidance that follows it.

Set a reminder for 12 June. After the vote, read the final text, not a summary of the draft. Then look for the government guidance that explains how the rules will work in practice.

Source: Editorial checklist based on the duties described in the sources above.

Sources

• VnExpress International, "Cyber security law restrictions worry Vietnamese legislators," 29 May 2018, e.vnexpress.net.
• Asia News Network, report on the National Assembly debate, 30 May 2018, asianews.network.
• Baker McKenzie via Conventus Law, "Vietnam: 16th draft of the Law on Cybersecurity," 11 May 2018, conventuslaw.com.
• Government of Vietnam, Decree 72/2013/ND-CP on internet services and online information, 15 July 2013.