Vietnam’s New Cybersecurity Law 2018

A new Law on Cybersecurity (Luật an ninh mạng) (the CSL 2018) will come into effect from 1 January 2019 in Vietnam. Not only providing measures to secure the cyber-environment which to some extent has been regulated by the Law on Cyber-information Safety dated 19 November 2015, the CSL 2018 also includes various provisions to control the contents posted or published on the cyber-network. Below are some salient issues of the CSL 2018.

Scope of the CSL 2018

The CSL 2018 applies to all agencies, organizations and individuals involving in the protection of cybersecurity, which is broadly defined as the assurance that activities in cyberspace not causing harm to the national security, social order and safety, lawful rights and interests of agencies, organizations and individuals. In particular, the CSL 2018 will apply to overseas organisations, which have users residing in Vietnam such as Google or Facebook.

The CSL 2018 covers all networks of IT infrastructure, telecommunication, Internet, computer systems, databases, information processing, storage and controlling systems, and regulates activities of every enterprise providing services in cyberspace and Internet users including e-commerce, websites, online forums, social networking and blogs.

Operators of information system (Chủ quản hệ thống thông tin)

The CSL 2018 imposes various obligations on an operator of an information system. Under the  Law on Cyber-information Safety according to which, an operators of information systems means any agencies, organizations or individuals having directly managing authority to an information system.

LAWYER’S CRIMINAL LIABLITY FOR FAILURE TO REPORT CRIMES COMMITTED BY A CORPORATION IN VIETNAM

Under Article 19.3 of the Penal Code 2015 of Vietnam, if a defender (người bào chữa), in the course of defending for an accused person, has knowledge of a crime that was committed or has been committed or is under the process of preparation by such person, the defender will not bear criminal liability for failure to report such crimes to the authorities unless such crimes are extremely serious crimes or crimes relating to the national security. This appears to be a watered-down version of the attorney-client privilege in other jurisdictions. The previous Penal Code 1999 does not clearly exempt a defender from criminal liability for failure to report crimes. The exemption for a defender under Article 19.3 is first introduced in the Penal Code 2015. When applying Article 19.3 in the context of corporate criminal liability, one should take note of the followings:

  • A defender is defined as a person appointed by another person (an individual or a commercial legal person) who is alleged to commit a crime to defend him/her in accordance with Article 72 of the Criminal Proceedings Code 2015. A lawyer will become a defender when that lawyer is appointed in accordance with the proceedings (Appointed Time). Therefore, before the Appointed Time, a lawyer is not entitled to the privilege exemption of Article 19.3.
  • Whether before or after Appointed Time, a lawyer for a commercial legal person in a criminal case is not entitled to the privilege exemption of Article 19.3 in respect of the following crimes (1) smuggling, (2) manufacturing or trading counterfeit food or food additives, and (3) manufacturing or trading counterfeit medicines for treatment or prevention of diseases; and
  • Before the Appointed Time, lawyers may be subject to criminal liability for failure to report the following crimes if the lawyers have “clear knowledge” (biết rõ) of such crimes: (1) financing terrorism, (2) money laundering, (3) illegally trafficking goods or money across the border, (4) manufacturing or trading banned goods, (5) hoarding or, transporting banned goods, (6) manufacturing or trading counterfeit goods, (7) manufacturing or trading counterfeit food or food additives, (8) manufacturing or trading counterfeit medicines for treatment or prevention of disease, (9) manufacturing or trading counterfeit animal feeds, fertilizers, veterinary medicine, pesticides, plant varieties, animal breeds, (10) speculating, and (11) destructing forest.

This post is contributed by Tran Thi Ha Phuong, a legal intern at Venture North Law, and Ha Thi Dung, a partner at Venture North Law.

Confidentiality obligations of a lawyer in Vietnam

Lawyers in Vietnam are subject to the following confidentiality obligation with his/her clients including:

  • A lawyer is prohibited from disclosing information on cases, matters, clients that the lawyer has knowledge in the course of practicing except otherwise agreed by the clients or otherwise provided at law (e.g., the Penal Code 2015). Since this rule is carved out by “otherwise provided at law”, a lawyer cannot invoke this rule to avoid the request of providing information or testifying against his/her client in a criminal case;
  • A lawyer must not use information on cases, matters, clients that the lawyer has knowledge in the course of practicing for purpose of violating benefits of the State, public benefits, lawful rights and benefits of organization, individuals, and agencies;
  • A law firm must procure its lawyers and staffs not to disclose information on its cases, matters, clients; and
  • Under Article 73.2 of the Criminal Proceedings Code 2015, a defense lawyer must not disclose information on a case or an offender that the defense lawyer has knowledge in the course of defending for the offender except otherwise agreed in writing by the offender and must not use such information for purpose of violating benefits of the State, public benefits, lawful rights and benefits of organization, individuals, and agencies. A defense lawyer may invoke this privilege to deny providing information or testifying against his/her client but it is not clear whether this privilege can protect him/her from a criminal charge for failure to report extremely serious crimes or crimes which fall within Chapter XIII (crimes relating to the national security) if such case is established.

A lawyer in Vietnam is required to practice either in a law firm or in his/her own personal capacity. Therefore, technically, an in-house lawyer working for a corporation may not be regarded as a lawyer.

This post is contributed by Tran Thi Ha Phuong, a legal intern at Venture North Law, and Ha Thi Dung, a partner at Venture North Law.

Corporate criminal liability in the context of an M&A transaction in Vietnam

The Penal Code 2015 is silent as to whether corporate criminal liability incurred by one commercial legal person will be succeeded or extinguished if such legal person is liquidated, merged (sáp nhập), consolidated (hợp nhất) or split (chia) and ceases to exist. Under the Civil Code 2015, when a legal person is merged, consolidated or split, only “civil obligations” (nghĩa vụ dân sự) of such legal person are transferred to the relevant new (or succeeding) legal person. As such, criminal liability (trách nhiệm hình sự) of such legal person may not be transferred to the new (or succeeding) legal person. Similarly, under the Enterprise Law 2014, when an enterprise is merged, consolidated or split, only unpaid debts and property obligations (nghĩa vụ tài sản) are transferred to the relevant new (or succeeding) enterprises. It is not clear if criminal liability of the first enterprise could qualify as property obligations which can be transferred to or succeeded by the new (or succeeding) enterprise.

Under the Criminal Proceeding Code 2015, if a legal person, who has been convicted with a crime, undergoes a merger, de-merger, consolidation then the legal person succeeding the rights and obligations of the first mentioned legal person is responsible for performing penalties in form of monetary fine. This provision seems to suggest that not all criminal liabilities will be passed on the succeeding legal person. That said, in a recent seminar on corporate criminal liability, an official of the Ministry of Justice, being a member of the drafting team of the Penal Code 2015, has indicated that he is in favour of the requirement that in the context of the liquidation, merger, consolidation or split of a legal person, a new (or succeeding) legal person must inherit criminal liability of the disappearing entity.