In several of my posts lately, I’ve mentioned the possibility of certain services coming under the laws governing the deployment and operation of social networks in Vietnam (see P2P Lending in Vietnam and B2B Lending in Vietnam). But in mentioning it, I have yet to go into any details about what those laws contain and the obligations they impose on organizations and their social networks in Vietnam. First, I’m going to address the laws under the assumption that the owner and operator of the social network is a Vietnamese resident. Only after that will I examine the issues relevant to international social networks.

What is a Social Network in Vietnam?

According to the law, a social network is:

the information system providing network user communities with services of storage, provision, use, search, sharing and exchange of information with one another, including the services of personal website creation, forums, online chat, sharing of sound or images and other similar forms of services.
It is the facilitation of links, the connections between people that used to happen solely through physical means such as face-to-face contact or telephone conversations. It is the creation of the means of digitally conducting those connections on the network. And, just in case you need reminding, under Vietnamese law, a network is “a general concept which means a telecommunications network (fixed-line, mobile,
Internet), or a computer network (WAN, LAN).” So a social network is the creation of a means of connection between people on a network. This would include websites such as Facebook, Twitter, and LinkedIn and mobile apps such as TikTok, Tinder, or–for those with different tastes–Grindr. It would also include platforms such as those discussed in my already cited posts on P2P and B2B lending.

Who Can Set Up a Social Network in Vietnam?

In order for a company to set up a social network in Vietnam–and it must be a company–they must register the relevant business lines with the business registration office and they must obtain a license to operate a social network from the Ministry of Information and Communications, or the MOIC. To obtain a license, an enterprise with the appropriately registered business lines must demonstrate that they have qualified personnel, an approved domain name, meet certain technical requirements, and have put in place measures to protect the safety, security, and management of the social network. I will take each of these in turn.

Qualified Personnel

These requirements are a bit confusing. First, there must be a division of the company in charge of content for the social network. This division must have at least one employee and whether that employee or a second, at least one employee in that division must be either a Vietnamese citizen or a foreigner who resides in Vietnam and has at least six months remaining on a temporary residence card term at the time of application for the social network license. Finally, there must be at least one employee in charge of technical management of the social network.
There are no requirements as to the qualifications necessary for any of these employees, only that they be assigned certain responsibilities. This is different from many other sectors where employees must be able to demonstrate through either education or experience that they have a certain expertise in a given field. Here, however, the only requirement is that they be given the responsibilities assigned. Thus, a non-college graduate could easily fill this position if Vietnamese. Foreigners would be required to meet minimal immigration standards and thus would either have to have a college degree or so many years of experience in the field to qualify for the work permit that would allow them to fill the required position in the first place.

Approved Domain Name

Social networks must obtain at least one URL with the high-level domain of .vn. They may have multiple URLs and most of them may use other high-level domains such as .com or .net, but they must have at least one version which has been registered with the appropriate authorities as .vn. The social network must additionally store information on servers with their IP address in Vietnam. As this requirement comes in the same sentence as the requirement for a .vn domain name it is unclear whether it only requires that only data obtained from the .vn version must be stored in the country or whether all data obtained by the social network must be stored in the country and thus preclude the use of cloud servers or other, international data storage solutions. This is yet another ambiguous provision that addresses when “data” must be “localized” into Vietnam. And this is assuming that the enterprise running the social network is already governed by Vietnamese law.
Three more, brief, requirements pertain to the use of domain names for social networks in Vietnam. First, if the social network also provides news, the domain names for the two separate services may not be the same. This means that a company must register different .vn domain names for each, such as Facebook.vn and Facebooknews.vn. Second, the period remaining on the domain name registration with the Vietnamese registrar must be at least six months at the time of registration for the social network license. And finally, all international domain names must be registered according to law.

Technical Requirements

These requirements are more detailed, and social network providers must demonstrate that they are capable of the following:
  • Store details associated with accounts, login time, log out time, IP address of users, and history of posted information for at least 2 years;
  • Receiving warnings from relevant authorities regarding users’ violations and taking actions against such;
  • Detect, warn against, and prevent illegal access and network attacks
  • Conform to information safety standards;
  • Having a backup plan to maintain safe and continuous operation and repair should breakdowns occur;
  • Registering and storing personal information of users including copies of IDs and permissions of guardians for users under 14 years old;
  • Obtaining the authorization of users via messages sent to their phone or email upon user registration or personal information change;
  • Preventing or eliminating prescribed violations of law (see Major Violations of Law section below); and
  • Establishing a mechanism to warn users of posts containing violating content.

Measures to Protect the Safety, Security, and Management

In order to demonstrate that the social network is ready to obtain a license, they must first publicly post a user agreement on the social network website and develop a method for actively obtaining the user’s consent to such agreement prior to allowing the user to proceed with using the social network. Consent must be obtained through a positive act and cannot be “assumed” by the continued use of the social network. There must be a method to prevent anyone who does not provide such consent from using the social network. For major violations of law (see section below), the social network must be able to eliminate violating information within three hours of being informed by the MOIC of such violation. As part of the user agreement, the social network must allow users to consent to and determine how their personal data will be provided to third parties (for more info on this see Data Privacy Obligations in Vietnam). Specifically, to social networks, the user agreement must also “notify users of the rights, responsibilities, and risks when storing, exchanging, and sharing information online.”

Once a properly licensed enterprise has met all of these requirements, they may obtain a license from the MOIC which has a term according to the request of the applicant but no longer than ten years. During the operation of the social network, the enterprise must report infringements of specified laws to the authorities and cooperate in the removal of such infringements. To cooperate with the authorities in general and to provide them with personal data concerning users upon request. To abide by data and network protection regulations and to be subject to regular checks and inspections by the state authorities.

Issues for Foreign Providers of Social Networks in Vietnam

The rules governing the cross-border provision of public information apply to any

overseas organization or individual uses electronic information pages, social networking sites, online applications, search services and other online equivalents in order to provide public information accessed or used by both an entity and an individual in Vietnam.

Anyone involved in these activities is expected to comply with Vietnam’s laws and regulations when conducting these activities. The wording here is broad and suggests that it could apply to any social network that is generally available on the world wide web that hasn’t blocked all IP addresses located within the territory of Vietnam. Perhaps this is why I can’t access certain websites from Vietnam rather than some ideological censorship which I had thought previously because the owners of those websites are seeking to prevent the imposition of Vietnam’s laws on their activities.

Luckily, there exists some more specific guidance. If an organization conducting the cross-border provision of public information rents digital information storage within the territory of Vietnam for the purpose of providing such services or their page, social network, online app, search services or other equivalents have been accessed by one million users in Vietnam in a given month then they are subject to additional obligations.

They must do two things, first, they must provide the MOIC with contact information including their corporate information and the identity and contact method of a “principal contact agent” operating in Vietnam. What this suggests is that those organizations who meet these criteria must hire or appoint a “principal contact agent” in Vietnam if they don’t already have a presence in the country. While not a “data localization” requirement (for more on that see Data Localisation Requirements in Vietnam), it still imposes some financial burden on the cross-border provision of public information. At least it is only imposed in concretely defined instances, unlike other areas of similar law.

The second obligation is to cooperate with the MOIC in handling major violations of law (see discussion in the next section) relating to their provision of services. This cooperation takes the form of removing such violations within 24 hours of receiving a request from the MOIC. If the foreign service provider fails to act at such a request and, again, after a second such request, then the MOIC will take technical actions to stop the service provider from the cross-border provision of public information. In essence, if the foreign service provider doesn’t cooperate with the MOIC upon request, the MOIC will block their website to Vietnamese users. But what violations are big enough to justify the MOIC in taking such actions?

Major Violations of Law

Throughout this article, I’ve referred to major violations of law. For the purposes of social networks, there are a few very specific violations that trigger the responsibilities for cooperation with the MOIC and authorities in their prevention and removal. Those violations include:

  • Offenses against the State of the Socialist Republic of Vietnam; harming the national security or
    social safety and order; destroying the great national unity; propagandizing for wars and
    terrorism; causing feuds and contradictions among different ethnicities, races, or religions;
  • Propagandizing for or provoking violence, obscenity, depravity, crimes, social evils or
    superstition, destroying fine traditional customs of the nation;
  • Disclosing State secrets, military, security, economic or foreign relations secrets, and other
    secrets as stipulated by law;
  • Providing information that distorts, slanders, or insults the reputation of an organization or
    the honour and dignity of an individual;
  • Advertising, propagandizing, selling, or purchasing prohibited goods or services; disseminating
    prohibited works of the press, literacy, art, or publications; and
  • Falsely presenting oneself as another organization or individual and disseminating falsified or
    untrue information that is harmful to the lawful rights and interests of organizations and
    individuals.

It is an imposing list, and for both domestic and cross-border social network providers, the obligations to monitor and, upon request, remove any post or information on their social network that violates it are potentially far-reaching. Some may say it amounts to censorship. I won’t get into that discussion here, but it does, certainly, amount to a considerable commitment to the development and maintenance of monitoring content on a social network for compliance with the law. A commitment that will result in scaling financial and manpower resources to ensure that Vietnam is pleased. Again, another reason why so many websites block countries like Vietnam so as to avoid the burdens of complying with its laws.

Conclusion

With all of that said, it is safe to say you now understand the basics of the law regarding social networks. It’s quite a bit of work to operate one according to the law in Vietnam. Aside from registration and licensing, there are data protection and cybersecurity requirements, content monitoring, and government cooperation obligations to which the social network provider must comply. There are more details–a few at least–that I haven’t gone into, but this is the bulk of it. If you have questions please feel free to contact me through the email link on my bio page, or you can go to www.indochinecounsel.com and contact other lawyers there. As the Lunar New Year celebrations start in just a couple of days, I’ll be taking a break next week so don’t expect an article. Otherwise, have a pleasant week and Chúc Mừng Năm Mới.