Vietnam’s new Law on Cybersecurity has garnered much attention due to its sweeping attempt to regulate online content available to internet users in Vietnam. Among its more controversial provisions are the requirements that both foreign and domestic online service providers store personal data of Vietnamese end-users in Vietnam, surrender such data to Vietnamese government authorities upon request, and supervise user posts to remove “prohibited” content (defined to include content viewed as disparaging of the Vietnamese government and/or government officials or state agencies). The law also requires offshore service providers to open branches or representative offices in Vietnam, presumably to facilitate enforcement of the Cybersecurity Law against them.
While most foreign companies have elected to take a “wait and see” approach pending issuance of further implementing guidance by relevant agencies, Vietnamese authorities wasted no time in flexing their muscles under the new law by announcing just days after implementation that Facebook had violated applicable regulations on content control, online advertising, and tax liability. Specifically, Facebook has been accused of allowing Vietnamese users to post anti-government sentiment and delaying removing such content even after being requested to do so by Vietnamese authorities. Facebook is one of several social media companies that have previously raised concerns regarding the Cybersecurity Law and negative impacts it could have on Vietnam’s digital economy and its efforts to position itself as a growing market for tech startups.
Although the requirement to cooperate with the authorities to remove “illegal” content (including, for example, content opposing or otherwise offending the Socialist Republic of Vietnam) existed prior to implementation of the Cybersecurity Law, the new law has brought this into sharper focus by adding data localization, local presence, and other requirements aimed at facilitating enforcement of the content control regulations against foreign online service providers. The Cybersecurity Law also does not provide any recourse for online service providers who take a different view than the authorities regarding the alleged illegality of online user content, nor is there any specified means for resolving any such disagreement. The Cybersecurity Law in its current form therefore makes the relevant Vietnamese authorities the final arbiter as to what content is deemed to be illegal.
On the other hand, it is not entirely clear how the authorities intend to enforce the Cybersecurity Law against foreign online service providers without a local presence in Vietnam. The law’s requirement that foreign online service providers establish a local presence if requested to do so by competent authorities is almost certainly aimed at facilitating such enforcement, but it is not clear what means the government has at its disposal to force foreign providers to actually comply with such a request. The Vietnamese government is not believed to have the capability or resources to block access to social media sites as China has done with some non-China based online communications platforms, nor is it evident that there would be any appetite to do so (even if it were possible) given the enormous popularity of such platforms among Vietnam’s young, tech savvy population. Needless to say, all eyes will be on Vietnam as this first test of the new law plays out.