Vietnam approved its new internet security law despite local and international concern regarding some of its provisions. The key provisions and issues are as follows:

Data Localisation

The new internet security law requires local and foreign service providers, including overseas providers such as Google, YouTube and Facebook, to store Vietnamese users’ information on computer servers located in the country instead of overseas servers as its most often the case.

The government removed from earlier drafts of the law the threshold that this provision would not apply where the foreign service provider had fewer than 10,000 users in Vietnam. As a result, the law would seem to apply to all internet services worldwide with even one user in Vietnam. 

Further, the wording of the law, changed from earlier draft versions, suggests that the data of users in Vietnam must be exclusively stored in Vietnam.

The law raises potential compliance and informational issues among overseas companies, governments and non-governmental organisations as some overseas internet services will be unaware of the country’s new internet security law and the government likely lacks the resources to enforce the localisation provisions.

One of the objectives of this provision is to stimulate the development of technology data centres in the country and the high-skilled jobs that come with these centres, although it has been pointed out that data centres are increasingly automated and employ very small numbers of workers.

Local Office Requirements

Article 26 of the new law requires that all local and foreign organisations which provide telecommunications or internet services or own an information network in Vietnam must establish either a headquarters or a representative office in the country.

The intention of the local office requirement is to increase technology and management jobs in the country. The provision raises questions for while additional employment is likely to be achieved, overseas internet services may be unaware of the law and not comply, or could deem their Vietnamese business to be insufficiently large to warrant the cost and administration in establishing a local office. The provision may thus result in overseas internet services becoming unavailable to users in Vietnam.

Privacy Concerns

The new law stipulates that an internet security specialised force will be permitted to examine the information networks of any organisations and agencies upon the authorities’ requests. Concerns have been raised regarding this provision and the threat to individual and enterprise privacy. Government critics have stressed that the concerns are about the leakage of personal information and trade secrets and the potential abuse of power.

National Security and Civil Liberties

The internet security law includes several provisions (Articles, 4, 8, 15 and 26) that prohibit the publication and dissemination of information that the government deems to be a violation of national sovereignty and security, or false information intended to seriously harm human dignity or cause damage, or information that is propaganda or urges, incites, threatens, causes division, or entices people to gather and cause disruption. Critics of the law consider the language broad and unnecessarily limiting civil liberties.

The new Internet Security law takes effect in 2019.