Hanoi  (VLLF/VNA)- The draft Law on Cyber Security, which is scheduled to be passed by the 14th NationalAssembly at its ongoing session, contains some new provisions which raise publicconcerns. The Vietnam Law and LegalForum, under theVietnam News Agency, talks with Lieutenant General Hoang Phuoc Thuan, Directorof the Cyber Security Department of the Ministry of Public Security, about somecontroversial issues governed by the draft law.   

Overthe past few years, the cyber security situation has developed complicatedly.Series of cyber-attacks and security incidents have been reported by localmedia. Could you elaborate on the necessity to make the Law on Cyber Securityin Vietnamtoday?

The cyber security situation in the world and Vietnam is undergoing complicateddevelopments. There are tens of thousands of cyber-attacks that target Vietnam’sinformation system happening every year. Fake news, fabrication, calumniation,aspersion, outrage, and incitation of violence have become rampant in thecyberspace, particularly in social networks. Cyberspace has somehow turned intoan “asylum” for crimes and violations. Cybercrime, particularly such organizedones as gambling, organization of gambling, swindling to appropriate property,and trading in fake or banned goods, has developed complicatedly. Thissituation is attributable to the lack of a legal framework in the field ofcyber security.

The formulation and promulgation of the Law on Cyber Security aims to meet theurgent requirements arising from the country’s cyber security situation and theneed to protect the national security, the State’s secrets, social order, andlawful rights and interests of organizations and individuals. The Law will alsohelp address existing shortcomings and limitations in the state management ofcyber and information security and further promote the role of line ministriesand functional agencies in assurance of cyber and information security.Additionally, the enactment of the Law can also be regarded as a complete andtimely institutionalization of the Party’s policies on cyber security, whileensuring compliance with the 2013 Constitution’s provisions on human rights,fundamental rights of citizens and safeguard of the Fatherland. The Law’sprovisions conform to international practice as a matter of fact that manycountries in the world have issued their own cyber security laws.

It can be said thatcyberspace exists in all aspects of social life, including e-commerce. Thedraft law contains specific provisions requiring user data and important datato be stored in the country. So what subjects will be governed by theseprovisions and which data will be stored within Vietnam’s territory?

As we all know, many countries have set forth requirements for domestic storageof important data, for example, the United States, Canada, Russia, Germany,China, Indonesia, Greek, Bulgaria, Denmark, Finland, Sweden, Turkey, Venezuela, Columbia, Argentina, and Brazil. On May 25, the European Union’sGeneral Data Protection Regulation officially came into force, empowering EUcitizens to look up, change or delete their personal information, thus they cancontrol their personal data when joining forums and social networks. The EUalso requires service providers to inform service users of how their personalinformation will be used and commit to not providing such information to thirdparties. Violating companies may be fined up to EUR 20 million or 40 percent oftheir worldwide turnover. Looking at these examples, we can see that the draftLaw’s provisions are appropriate and progressive.

It can be confirmed that the draft Law on Cyber Security neither forces allorganizations and individuals to comply with these provisions nor requiresstorage of all data. Based on the requirements for ensuring and safeguardingnational security, social order and fine cultural and ethical values andtraditions of Vietnam,the Government will specify which types of organizations and agencies and whichkinds of data will be governed by these regulations.

There have beenopinions that these aforesaid data storage requirements do not conform to Vietnam’sinternational commitments and will block cross-border data flows and reduce thecountry’s GDP. What is your opinion?

When elaborating these regulations, the Drafting Board carefully reviewed Vietnam’scommitments as well as treaties which the country has acceded to, including theWTO’s commitments and the Comprehensive and Progressive Agreement forTrans-Pacific Partnership (CPTPP). Hence, I can affirm that the draft Law’sprovisions on data storage are not contrary to or violate the country’scommitments. They also do not prevent Vietnam from fulfilling itsinternational commitments.

As we know, all bilateral and multilateral commitments have exceptions servingsecurity, public order, culture, and community well-being. This means thatinterests of member states to international commitments are always upheld andrespected for. There is no commitment that forces us to give up theseinterests. In fact, some member states of the WTO have enacted similarregulations and, therefore, set precedents for Vietnam without violating WTOcommitments.

As for the opinion that these regulations will block cross-border data flows, Ican confirm that nothing is hindered here by this draft Law. Cloud computingtechnology enables data access from everywhere, regardless of whether such datais stored in Vietnam or the US. The draftLaw only requires the storage of some kinds of data in Vietnam but notrestrict access to such data.

Recently, some persons cited statistics of the EuropeanCenter for International PoliticalEconomy (ECIPE), saying that data localization may reduce Vietnam’s GDPby 1.7 percent and foreign investment by 3.1 percent. However, they seemed to “forget”that such statistics came from a report titled “The costs of data localization:Friendly fire on economic recovery” released by the ECIPE four years ago (March2014). The report, which was prepared based on the most negative scenarios,also put forth similar forecasts for the EU, China,India, the Republic of Korea,Indonesia, and Brazil.However, reality has proven the opposite. In 2015, one year after the ECIPEgave its evaluations, Vietnamattained the highest GDP growth rate in the 2010-2015 period and has managed tomaintain an impressive growth until now. The EU and other countries mentionedin the report are now managing personal data in a more and more stringentmanner. So, we can see that these predictions are wrong and the quotation of suchstatistics without complete context is intended for unclear purposes.

Thus, when there is a scientific and thorough approach to thedraft Law’s provisions, one will find that the data storage requirement isconformable with domestic laws and international practice and not contrary totreaties which Vietnam has acceded to and does not obstruct activities ofbusinesses. However, some opine that this requirement is infeasible now whenall enterprises use cloud computing and server virtualization/virtual privateservers for data storage. What’s your opinion on this issue?

As I have said, cloud computing technology permits data to flow regardless ofwhere such data are stored. Therefore, the data storage requirement in thedraft Law is technologically feasible and will not create any obstruction.Similar rules have been adopted by many countries. In fact, according tostatistics we knew, Google and Facebook have installed or hired nearly 2,000servers in our territory in order to improve their service quality. This showsthat data storage is not only technologically feasible but also helpful toimprove connectivity and quality of services.

At present, it isassumed that all enterprises doing business in cyberspace related to Vietnamwill have to open representative offices in the country, which would causedifficulties to enterprises as they have to bear higher cost and carry out moreformalities. What’s your opinion on this matter?

We understand that this assumption stems from legitimate concerns of enterprises.We are clearly aware of the importance of foreign enterprises operating in Vietnam. Thedraft Law itself is aimed at protecting the lawful rights and interests oforganizations and individuals, including foreign enterprises. Therefore, thedraft Law’s provisions are not intended to cause difficulties to enterprises aswell as will not oblige all enterprises to set up their representative officesin Vietnam.

However, Vietnamese laws, including the 2005 Commercial Law and the 2017Foreign Trade Management Law and their implementing regulations, stipulate thatall foreign countries’ trade promotion organizations must open representativeoffices in Vietnam.We all see the fact that enterprises providing cross-border services likeGoogle and Facebook are doing profitable business in Vietnam. 

As far as I know, Google has set up some 70 representative offices and Facebook80 representative offices in countries around the world. In the Southeast Asia,Google and Facebook have opened representative offices in Singapore, Malaysiaand Indonesia.Why they have to do so if not because the establishment of representativeoffices facilitates their operation.

The reality is that our domestic organizations and businesses are subjected tomany legal regulations when operating electronic newspapers, websites, socialnetworks, etc. They are also responsible for our security, public order,culture, social morality, fine customs and habits. However, providers ofcross-border services into Vietnamare almost free of any constraints and such obligations. Therefore, theregistration of legal entities by foreign enterprises in Vietnam willhelp us create a fair and responsible business environment.

However, due to our international commitments, the draft Law does not mandateall enterprises to open representative offices but it will be based on nationalsecurity and social order and safety requirements, and the Government willissue detailed regulations.

By the way, we would like to thank the contributions of the public, businesscommunity and international friends who have helped us complete the draft Lawthrough nearly 30 times of revisions. We would like to continue to receivecomments and hope that people, organizations and businesses in the country andabroad to endeavor together with the authorities of Vietnam to protect cybersecurity, contributing to building a safe and healthy cyberspace, contributingsignificantly to the socio-economic development of every nation and the world.-VLLF/VNA