Vietnam’s New Cybersecurity Law 2018

A new Law on Cybersecurity (Luật an ninh mạng) (the CSL 2018) will come into effect from 1 January 2019 in Vietnam. Not only providing measures to secure the cyber-environment which to some extent has been regulated by the Law on Cyber-information Safety dated 19 November 2015, the CSL 2018 also includes various provisions to control the contents posted or published on the cyber-network. Below are some salient issues of the CSL 2018.

Scope of the CSL 2018

The CSL 2018 applies to all agencies, organizations and individuals involving in the protection of cybersecurity, which is broadly defined as the assurance that activities in cyberspace not causing harm to the national security, social order and safety, lawful rights and interests of agencies, organizations and individuals. In particular, the CSL 2018 will apply to overseas organisations, which have users residing in Vietnam such as Google or Facebook.

The CSL 2018 covers all networks of IT infrastructure, telecommunication, Internet, computer systems, databases, information processing, storage and controlling systems, and regulates activities of every enterprise providing services in cyberspace and Internet users including e-commerce, websites, online forums, social networking and blogs.

Operators of information system (Chủ quản hệ thống thông tin)

The CSL 2018 imposes various obligations on an operator of an information system. Under the  Law on Cyber-information Safety according to which, an operators of information systems means any agencies, organizations or individuals having directly managing authority to an information system.

New Law on Technology Transfer in Vietnam

A new Law on Technology Transfer will take effect from 1 July 2018. The new Law on Technology Transfer reintroduces the requirement for registration of cross border transfer of technology which was abolished under the existing Law on Technology Transfer in 2006. The registration is the condition for a technology transfer contract to be valid. However, the new law does not impose any specific restriction on a technology contract like maximum contract period or cap on technology transfer royalty. Without these limitations, it is not clear on what basis the licensing authority would register or refuse to register a technology transfer contract.

This post in part is contributed by Nguyen Linh Chi, an intern at Venture North Law Limited.

Is information property under Vietnamese law?

In many circumstance, information (e.g. user data) is more important to a business than its physical assets. This leads to an important question about the legal nature of information under Vietnamese law. Under the Civil Code 2015, a property (tài sản) is object, money, valuable papers and property rights. Except for intellectual property rights (including trade secret and data compilation) which are clearly recognised as a property right, the law is not clear whether other types of confidential information can be regarded as property.

The Civil Code 2015 also recognises and protects “civil rights” (quyền dân sự). Civil rights can be established as the result of the business operation or production operation. Accordingly, in theory, information, which is created (or generated) from business operation or production operation, could arguably be subject to civil right of the relevant entity which creates such information. However, the problem is there may be more than entities which create the information.

New control on cross-border supplies of news in Vietnam

From May 2017, under Circular 38/2016, websites, mobile apps, search engines and social networks (offshore websites), which are located outside of Vietnam but have more than one million visits from Vietnamese users a month or have servers located in Vietnam must:

  • provide necessary contact details to the Ministry Communication and Information (MCI); and
  • at the MCI’s request, remove from the offshore websites information and news which are considered illegal under Vietnamese law by the MCI. If the offshore websites do not cooperate with the MCI, the MCI may apply technical measures to block the illegal information and news from being accessed by Vietnamese users.

Vietnamese telecommunication service providers are required to have the necessary technical equipment to implement MCI’s blocking order within three hours of receipt of the relevant order. Circular 38/2016 will apply to the most popular social networks in Vietnam such as Facebook, Google, and Youtube.