Vietnam Cybersecurity Bill Calls for In-Country Data Storage

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Lien Hoang

Vietnam’s parliament has begun debate on a cybersecurity bill that would echo the law in neighboring China by requiring technology companies, such as Alphabet Inc.'s Google and Facebook Inc., to store certain data on servers within the country.

The bill would also force companies to hand over data to law enforcement and provide technical assistance to unlock data, maintain records on data breaches and anti-government content, and gain government approval to transfer data abroad.

The National Assembly, Vietnam’s legislative body, took up debate on the proposal Nov. 23, agreeing on the general need for internet oversight rules but splitting on whether the proposed bill meets Vietnam’s global trade commitments and fairly balance business and national security interests. The one-party state has considered mandatory data localization before, but the issue is attracting more scrutiny now that the Ministry of Public Security has submitted a full draft law to legislators.

“We are only requiring the installation of servers that manage Vietnamese users,” Nguyen Huu Cau, a member of parliament, said during the debate, citing other countries with data localization restrictions, including China, Russia, and Canada. “Why can all those countries make this requirement, yet Vietnam can’t do it?”

The data localization requirements law may pose compliance challenges for companies.

It is difficult for multinational companies to move their infrastructure, Amanuel Flobbe, technology committee chair at the European Chamber of Commerce in Vietnam, told Bloomberg Law. Identifying whether a user is in Vietnam also poses potential problems—for example, in the case of a customer who lists his or her location as Vietnam but actually lives in the U.S., he said.

“A lot of companies are so complex, it would be almost impossible to comply with this,” Flobbe said.

Facebook and Google were named several times during the parliamentary debate. Facebook declined to comment, and Google didn’t respond to Bloomberg Law’s request for comment.

Law Enforcement Demands

Another article in the legislation mandates that technology companies “cooperate with and provide technical measures and support to the public security bodies during their criminal investigations and protection of national security.”

That means companies probably won’t be squaring off with law enforcement over encryption issues as they have in the U.S., Kevin Nguyen, a business information systems lecturer at the Royal Melbourne Institute of Technology in Ho Chi Minh City, told Bloomberg Law. He referenced the standoff between the FBI and Apple Inc., which refused to unlock a San Bernardino, Calif., terror suspect’s iPhone. In Vietnam, they would be obligated under the law to help unlock devices, he said.

The bill would also require that companies retain records of cyberattacks and anti-government material. The proposal lists types of content authorities can demand be taken offline, including information that distorts history or facts, defames the government, or causes offense, slander, or embarrassment.

Trade Commitments

The bill would limit the transfer of critical information outside of the country by requiring a security assessment in advance of a transfer. What is considered “critical” isn’t defined in the bill.

If the proposed law limits telecommunications companies’ ability to offer cross-border services, that could defy Vietnam’s market access under World Trade Organization pledges, Nguyen Thi Kim Thuy, a member of parliament, said during debate on the bill.

The requirement that data be stored in Vietnam may also contradict trade commitments, she said.

To contact the reporter on this story: Lien Hoang in Ho Chi Minh City at correspondents@bloomberglaw.com

To contact the editor responsible for this story: Donald Aplin at daplin@bloomberglaw.com

For More Information

Vietnam's draft cybersecurity law is available, in Vietnamese, at http://src.bna.com/usA.

Notes from the parliamentary debate on the bill are available, in Vietnamese, at http://src.bna.com/usC.

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law: Privacy & Data Security