Following the release of the 15th draft on the Law on Cybersecurity in January, the National Assembly recently published the 16th draft (“Draft Law“) on its website for public consultation (please follow this link to see our past client alerts on the previous drafts).
The Draft Law, in comparison with the 15th draft, has further updated the local offices and data localization requirements for offshore telecommunications and Internet service providers. The Draft Law remains largely the same in other respects. The following is a summary of noteworthy updates:
1. Stricter local office and data localization requirements (Article 28)
Previously, Article 27.4 of the 15th draft had provided that offshore telecommunications and Internet service providers must:
- Have headquarters or representative offices in Vietnam; and
- Store within the territory of Vietnam data of Vietnamese users and other important data collected and/or generated from the use of Vietnam’s national cyber infrastructure,
but only if (i) 10,000 or more Vietnamese users use such service or (ii) the Government so requests.
In the latest version, the 10,000 or more Vietnamese user threshold and Government request that triggered the local office and data localization requirement have been removed from what is now Article 28.
The Draft Law now requires offshore entities, when providing telecommunications and Internet services in Vietnam, to have headquarters or representative offices in Vietnam and store within the territory of Vietnam (i) personal data of users in Vietnam, and (ii) other important data collected and/or generated from the use of Vietnam’s national cyber infrastructure as stipulated by the Government.
The Draft Law narrows the type of users’ data that are subject to data localization requirements from “data” in general to “personal data.” However, a precise definition of the term “personal data” is absent from the Draft Law.
The Draft Law changes the scope of data subjects from “Vietnamese users,” which includes users with Vietnamese nationality only, to “users in Vietnam,” which includes all users of any nationality who use services within Vietnam.
In sum, a plain reading of the law suggests that the scope of this requirement has been broadened, which in effect would mean that it is easier for overseas telecommunications and Internet service providers to fall within the purview of this provision.
2. Cross-border data transfer restriction (Article 42)
The Draft Law has a new subsection under Article 42.2 (formerly Article 41.2 of the 15th draft) – Article 42.2(c), which provides that offshore telecommunications and Internet services provider are required to, among others, only store within the territory of Vietnam personal data of users in Vietnam and other important data collected and/or generated from the use of Vietnam’s national cyber infrastructure as stipulated by the Government.
The language of the aforementioned provision is vaguely worded. It could be considered a new restriction on transferring and storing data outside of Vietnam. On the other hand, it could be interpreted to mean that only the personal data of users in Vietnam and other important data collected and/or generated from the use of Vietnam’s national cyber infrastructure as stipulated by the Government are allowed to be stored within Vietnam (other information such as information of users using services outside Vietnam would not be allowed to be stored within Vietnam). Further guidance may be needed to clarify the language of Article 42.2(c).
3. Public consultation
The full text of the Draft Law is available at the below link: http://duthaoonline.quochoi.vn/DuThao/Lists/DT_DUTHAO_LUAT/View_Deta il.aspx?ItemID=1382&LanID=1497&TabIndex=1.
The Draft Law is still open for public consultation. Relevant parties can submit feedback via the following link:
http://duthaoonline.quochoi.vn/DuThao/Lists/DT_DUTHAO_LUAT/View_Deta il.aspx?ItemID=1382&TabIndex=6.
No specific deadline has been set for submitting feedback in relation to this draft.
* * *
For more details on the Draft Law, please do not hesitate to contact us.
