On October 26, at the ongoing 2nd session of the 16th National Assembly, General Lương Tam Quang, Member of the Politburo, Minister of Public Security, authorized by the Prime Minister, presented the Government's proposal for the draft Law on Electronic Identification and Authentication.
The draft law outlines regulations on electronic identification and authentication, as well as the rights, obligations, and responsibilities of relevant agencies, organizations, and individuals. It consists of 8 chapters with 46 articles.
Regarding electronic identification subjects, the draft law identifies five groups: agencies, organizations, individuals; products, goods, physical assets, and other physical objects; databases, data files, images, sounds, videos, applications, software, and digital services; events, transactions, behaviors; locations and spaces.
The draft law also noted that the Government is tasked with regulating electronic identification and authentication for subjects in the military, defense, and cryptography sectors.
The draft law proposes two methods for electronic identification:
Firstly, the State invests in and establishes systems and platforms to directly conduct electronic identification activities; locations, spaces; core data, important data; certified ownership and usage subjects; high-risk products, goods, and state secrets.
Secondly, qualified organizations can independently invest in and establish systems, platforms, and infrastructure for electronic identification activities. For other subjects, the draft encourages the commercialization of identification services.
The electronic identification and authentication system, as outlined in the draft law, includes: the national database on electronic identification and authentication; the electronic identification and authentication platform; the national identification application (VNeID); the system for managing the validity of electronic identities and electronic certificates confirming information; the national electronic identification and authentication portal, and other software, applications, and information systems.
Related information systems are connected to the system to serve state management, provide public services, and promote socio-economic development.
Regarding electronic authentication models, the draft law stipulates that all subjects with established electronic identities and identification codes under the Law are electronic authentication subjects. It establishes three models for electronic authentication activities: centralized authentication, intermediary authentication, and independent authentication. It mandates linking and authenticating electronic identities for transactions on digital platforms in certain fields.
The draft specifies conditions for organizations providing electronic identification and authentication services, including their legal status, financial capacity, technical systems, IT infrastructure, specialized personnel, operational procedures, user data protection, cybersecurity, technical connectivity with the System, and liability insurance.
Additionally, the draft Law stipulates the principle of mutual recognition of electronic identities and foreign authentication results for cross-border transactions. It amends and supplements related provisions of the Law on Electronic Transactions, the Law on Identity Cards, the Law on Digital Transformation, the Law on E-commerce, and the Law on Investment to ensure consistency within the legal system.
Presenting the verification report on the draft Law on Electronic Identification and Authentication, Lieutenant General Le Tan Toi, Chairman of the National Defense, Security, and Foreign Affairs Committee, stated that the Committee generally agrees with the name, scope, and subjects of application.
However, there are suggestions to add a provision on the principle of legal application to clearly delineate boundaries with specialized laws such as the Law on Identity Cards, the Law on Electronic Transactions, and the Law on Personal Data Protection. It should clarify that electronic identification and authentication only have technical value for identifying and authenticating subjects, not replacing regulations on ownership rights, transaction conditions, or legal status under specialized laws.
Regarding electronic identities and identification codes, the Committee cautions against allowing specialized agencies or service providers to independently decide on the information fields to be collected, as this could lead to abuse and privacy violations.
It is recommended to add a framework regulation on permissible information fields for collection, with the Government setting limits, issuing technical standards, and emphasizing the principle of minimal collection to protect data subjects' rights.
Regarding organizations providing electronic identification and authentication services, the Committee agrees with the policy of socialization, allowing qualified organizations to participate in providing these services.
However, there are suggestions that state agencies should issue minimum technical standards and common data standards to avoid scattered, unfocused, and inconsistent investments. Additionally, specific regulations on legal liability and compensation mechanisms for service providers in case of data breaches or incorrect identification and authentication should be added.
Regarding electronic identity subjects, the National Defense, Security, and Foreign Affairs Committee generally agrees with the draft Law's provisions. However, there are suggestions to clearly distinguish between "ownership rights" and "management and usage rights" to align with representation and authorization mechanisms under the Civil Code, serving as a basis for resolving disputes and handling legal responsibilities. Provisions on authorization and delegation of management and usage of electronic identities should also be added.
Regarding the suspension, cancellation, termination of electronic identity validity, and data storage, the Committee generally agrees with the provisions in Articles 14, 17, 18, and 19 of the draft Law.
However, there are suggestions to specify the authority and grounds for suspension and cancellation directly in the Law, clearly define the maximum suspension period, and the liability for damages if handled incorrectly. An emergency suspension mechanism should be added in case of security threats, and the rights of subjects to request deletion or cancellation of their identities when no longer needed should be specified. The storage period should be reviewed to ensure compatibility with the Law on Archives and the Civil Code, avoiding unnecessary pressure on storage systems.
Regarding international integration and cooperation, the Committee agrees with the provisions in Chapter VI. However, there are suggestions to continue reviewing regulations on recognizing foreign electronic identities, digital signatures, and authentication results to ensure compatibility with new-generation free trade agreements. The draft Law should include or authorize the Government to specify coordination mechanisms and requirements for cross-border digital platforms providing services in Vietnam in linking and authenticating user identities.
Regarding data exploitation fees and administrative procedure reduction, the National Defense, Security, and Foreign Affairs Committee recommends reviewing to ensure consistency, avoiding overlap with the Law on Data, the Law on Fees and Charges, and calculating reasonable fees for citizens and businesses.
Regarding administrative procedure reduction, there are suggestions to add provisions allowing for the resolution of procedures using traditional paper documents in case of technical failures or in areas lacking digital infrastructure.
Google translate