Data Intermediaries and Analytics Firms
International treatment of data has led to the creation of a couple of categories of service providers: data intermediaries who are third parties that transfer data from one entity to another and are bound by the rules of specific jurisdictions, and analytics firms who take the data provided by banks or financial institutions and other publicly available data to compose an analysis of that data and report on some aspect of the individual or entity under examination–most commonly this is a credit scoring entity.
Vietnam’s legislation does not currently contemplate either of these entities explicitly. However, both may find through inference and study a few guidelines for their implementation. While there has previously been legislation regarding credit ranking–which is aimed mainly at credit institutions and corporation’s credit worthiness rather–credit scoring, which focuses on individual lenders credit worthiness based on data collected from a jurisdictions credit institutions and governmental organizations, is less clear.
This post will briefly examine what there is to know about each of these entities in Vietnam and what the legislation means for the treatment of an individual’s data.
Rules for data intermediaries in Vietnam
The only definition of “intermediary services” extant in Vietnamese legislation relevant to personal data is listed out as, (i) internet services, (ii) telecommunication services, (iii) lease of digital information storage space services including the lease of website storage services, (iv) online social networks services, and (v) digital information searching services.
Storage of digital information contents by these intermediaries in their systems is transitory, temporary, automatic and for a limited period to meet the technical requirements of digital information content transmission. However, the digital information content in this context is limited to works, performances, phonograms and video recordings, broadcast programs protected under the Intellectual Property Law and is not applied for any other kind of information/data.
As there is no specific definitions or regulations for a “data intermediary” in Vietnam, it is difficult to understand how a data intermediary service would be treated in Vietnam. Though under the new investment law foreign investment is allowed in any sector that is not limited or prohibited, the licensing authorities tend to treat unregulated areas as something they don’t understand and, as a result, don’t license.
One way to proceed with licensing and operating a data intermediary in Vietnam, is to base it on the international concepts of data intermediaries that cover a wide range of different activities and governance models for companies that facilitate access to or sharing of data including the provision of platforms or infrastructure to facilitate the transfer of data. A data intermediary service might then fall within the business lines of data processing, hosting and related activities and/or information portals for providing the platform.
Rules for analytics firms supporting financial services
Data analytics supporting financial services, except for credit information services provided by credit information companies (see Credit Information in Vietnam), may be categorized as services auxiliary to financial services which are not categorized. From the perspective of the laws of Vietnam, analytics services supporting financial services is neither a conditional business (as there is no specific regulations), nor subject to specialized rules. There are no specialized rules governing the activities of analytics firms supporting financial services.
Credit Scoring
Credit scoring services in Vietnam operate in a legal vacuum. Apart from the National Credit Information Center and credit information companies, there are no specific regulations governing credit scoring activities of other companies nor treating such activities as conditional business lines under the Investment Law.
In practice, the credit scoring service is provided by fintech companies (e.g., Trusting Social, FiinGroup JSC, etc.). Such companies are not required to obtain special licenses nor requirements except for being duly registered with the major business lines including data processing , information portals, other information service activities and market research.
In terms of data protection, as a result of the lack of specialized regulations, it is hard to determine what personal data or corporate data is allowed to be collected and processed for the purpose of credit scoring. Therefore, such companies may take the approach that “all data is credit data” and from alternative sources, including but not limited to mobile data, social network data, e-commerce, financial or other business transactions. Depending on the types of data and the provided forms of data (via e-commerce platform or non-e-commerce platform), the companies in question must be subject to compliance with the general regulations on data protection (see Data Protection in Vietnam).
The State Bank of Vietnam has proposed a regulatory sandbox for fintech activities in the sector of banking, which may provide regulations on credit scoring, as a banking support activity. However, the first draft of this decree has been under discussion now for quite some time and there has not been any further legislation detailing the structure or proposed contents. It is uncertain, therefore, whether the regulatory sandbox will govern these two data related activities.
