From Human Right Watch

(New York) – Vietnam should postpone the application of the Law on Cyber Security and revise it to bring it to conformity with international law, Human Rights Watch said today. The National Assembly passed this highly problematic law in June 2018. In November, the Public Security Ministry published a draft decree with detailed instruction for carrying out the law and invited public comments until January 2, 2019.
Under the Law on Cyber Security, service providers must store data locally, “verify” user information, and disclose user data to authorities without the authorities having to produce a court order. The draft decree has a sweeping definition of user data.

“This cyber security law is designed to further enable the Ministry of Public Security’s pervasive surveillance to spot critics, and to deepen the Communist Party’s monopoly on power,” said Phil Robertson, deputy Asia director. “If this law is enacted, anyone who uses the internet in Vietnam will have zero privacy.”

The cyber security law and draft decree’s data retention, localization, and surveillance provisions would facilitate greater access to user data by abusive security bureaus and law enforcement authorities, without adequate safeguards for privacy, fair trial rights, and other rights.

Data to be stored is far more than basic subscriber data. It includes, under article 24 in the draft decree, a person’s “full name, date of birth, place of birth, nationality, profession, position, place of residence, contact address, email address, phone number, identity card number, individual identification code, citizen identification number, passport number, social insurance card number, credit card number, health status, medical file, and biometrics file.” The decree, in the same article, also requires companies to store the content of user’s posts, emails, and other “information chosen for upload, sync or import from device,” and information about contacts and relationships like “friends [and] groups that users connect with or interact with.”

The draft decree also requires a broad range of companies that provide online or telecommunications services in Vietnam to open branches or offices in Vietnam “within 12 months upon receiving requests from minister of public security,” under article 29. This requirement will sweep in not only major social media and email providers, but also e-commerce websites, online payment services, domain name providers, video game companies, and data storage companies. Under article 26, companies must store user data for as long as they operate or until they no longer provide the service, and user content and contact lists for 36 months.

The new law has been widely criticized both in Vietnam and internationally. Within four months after the law was passed, almost 70,000 people had signed an online petition to urge the government to postpone and revise it.

In September, 32 members of the European Parliament sent a joint letter to Federica Mogherini, the European high representative for foreign affairs and security policy, and Cecilia Malmström, the European Union commissioner for trade, “to ask for more human rights progress in Vietnam.” The letter said that Vietnam should “revise the Law on Cyber Security and bring it into compliance with international human rights standards, including the International Covenant on Civil and Political Rights (ICCPR), to which Vietnam is a state party since 1982.”

The human rights situation in Vietnam has deteriorated in 2018. The authorities convicted at least 41 rights activists and bloggers and sentenced them to many years in prison, including Le Dinh Luong, Nguyen Van Tuc, Nguyen Trung Truc, Nguyen Trung Ton, Truong Minh Duc, Nguyen Bac Truyen, Pham Van Troi, Tran Hoang Phuc, Ho Van Hai (Dr. Ho Hai), Luu Van Vinh, Nguyen Van Duc Do, Hoang Duc Binh, and many others. The police are holding at least 19 other people in pre-trial detention for exercising their civil and political rights.

In June, thousands of people took to the streets in several cities to protest a draft law on special economic zones and the draft Law on Cyber Security. There were reports that the police assaulted many people and made dozens of arrests. By November, at least 127 people had been convicted for participating in the protest. Sentences ranged from several months, suspended, to five years in prison.

“Vietnam’s Law on Cyber Security and the accompanying decree trample on individual privacy in direct defiance of Hanoi’s promises to the European Union to respect rights,” Robertson said. “EU member states should postpone any vote on the free trade agreement with Vietnam until it revises this law and shows concrete and measurable improvements to its abysmal rights record.”