Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...
By Lien Hoang
Vietnam’s parliament has begun debate on a cybersecurity bill that would echo the law in neighboring China by requiring technology companies, such as Alphabet Inc.'s Google and Facebook Inc., to store certain data on servers within the country.
The bill would also force companies to hand over data to law enforcement and provide technical assistance to unlock data, maintain records on data breaches and anti-government content, and gain government approval to transfer data abroad.
The National Assembly, Vietnam’s legislative body, took up debate on the proposal Nov. 23, agreeing on the general need for internet oversight rules but splitting on whether the proposed bill meets Vietnam’s global trade commitments and fairly balance business and national security interests. The one-party state has considered mandatory data localization before, but the issue is attracting more scrutiny now that the Ministry of Public Security has submitted a full draft law to legislators.
“We are only requiring the installation of servers that manage Vietnamese users,” Nguyen Huu Cau, a member of parliament, said during the debate, citing other countries with data localization restrictions, including China, Russia, and Canada. “Why can all those countries make this requirement, yet Vietnam can’t do it?”
The data localization requirements law may pose compliance challenges for companies.
It is difficult for multinational companies to move their infrastructure, Amanuel Flobbe, technology committee chair at the European Chamber of Commerce in Vietnam, told Bloomberg Law. Identifying whether a user is in Vietnam also poses potential problems—for example, in the case of a customer who lists his or her location as Vietnam but actually lives in the U.S., he said.
“A lot of companies are so complex, it would be almost impossible to comply with this,” Flobbe said.
Facebook and Google were named several times during the parliamentary debate. Facebook declined to comment, and Google didn’t respond to Bloomberg Law’s request for comment.
Another article in the legislation mandates that technology companies “cooperate with and provide technical measures and support to the public security bodies during their criminal investigations and protection of national security.”
That means companies probably won’t be squaring off with law enforcement over encryption issues as they have in the U.S., Kevin Nguyen, a business information systems lecturer at the Royal Melbourne Institute of Technology in Ho Chi Minh City, told Bloomberg Law. He referenced the standoff between the FBI and Apple Inc., which refused to unlock a San Bernardino, Calif., terror suspect’s iPhone. In Vietnam, they would be obligated under the law to help unlock devices, he said.
The bill would also require that companies retain records of cyberattacks and anti-government material. The proposal lists types of content authorities can demand be taken offline, including information that distorts history or facts, defames the government, or causes offense, slander, or embarrassment.
The bill would limit the transfer of critical information outside of the country by requiring a security assessment in advance of a transfer. What is considered “critical” isn’t defined in the bill.
If the proposed law limits telecommunications companies’ ability to offer cross-border services, that could defy Vietnam’s market access under World Trade Organization pledges, Nguyen Thi Kim Thuy, a member of parliament, said during debate on the bill.
The requirement that data be stored in Vietnam may also contradict trade commitments, she said.
To contact the reporter on this story: Lien Hoang in Ho Chi Minh City at email@example.com
To contact the editor responsible for this story: Donald Aplin at firstname.lastname@example.org
Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.
All Bloomberg BNA treatises are available on standing order, which ensures you will always receive the most current edition of the book or supplement of the title you have ordered from Bloomberg BNA’s book division. As soon as a new supplement or edition is published (usually annually) for a title you’ve previously purchased and requested to be placed on standing order, we’ll ship it to you to review for 30 days without any obligation. During this period, you can either (a) honor the invoice and receive a 5% discount (in addition to any other discounts you may qualify for) off the then-current price of the update, plus shipping and handling or (b) return the book(s), in which case, your invoice will be cancelled upon receipt of the book(s). Call us for a prepaid UPS label for your return. It’s as simple and easy as that. Most importantly, standing orders mean you will never have to worry about the timeliness of the information you’re relying on. And, you may discontinue standing orders at any time by contacting us at 1.800.960.1220 or by sending an email to email@example.com.
Put me on standing order at a 5% discount off list price of all future updates, in addition to any other discounts I may quality for. (Returnable within 30 days.)
Notify me when updates are available (No standing order will be created).
This Bloomberg BNA report is available on standing order, which ensures you will all receive the latest edition. This report is updated annually and we will send you the latest edition once it has been published. By signing up for standing order you will never have to worry about the timeliness of the information you need. And, you may discontinue standing orders at any time by contacting us at 1.800.372.1033, option 5, or by sending us an email to firstname.lastname@example.org.
Put me on standing order
Notify me when new releases are available (no standing order will be created)