Report on the Implementation of the Center for the Promotion of International Economic Partnerships Field Survey (Vietnam, January 2019)
Finished

Report on the field survey conducted by the Center for the Promotion of International Economic Partnerships
(Vietnam, January 2019)


1. digital regulatory landscape: flexible foreign investment policy despite data localization

Digital Economy Supported by a Thick Young Population]
　In Vietnam, a latecomer among ASEAN member countries, digitalization has been growing rapidly in recent years. National social infrastructure development is significantly improving the telecommunications situation, which had previously been an obstacle. In addition, the rapid spread of smartphones and mobile devices has led to the gradual penetration of commercial digital services in urban areas, such as app-based vehicle dispatch and shopping. Although it is pointed out that cash is still the mainstream payment method and that a cashless society will not arrive in the foreseeable future, Vietnam's strength lies in the fact that the average age of its population is in its mid-twenties, which means that the digital economy, especially among the younger generation, is poised to develop, including in rural areas. In addition to the state-owned Vietnam Post and Telecommunications Group (VNPT), FPT, CMC, and other major local companies, competition among start-ups to develop digital services is becoming increasingly prominent. Foreign companies also seem to be increasingly developing their businesses in various fields, anticipating not only the abundant young labor force but also their potential as users.

[The industry's view is that there will be no excessive government intervention like in China.
　Under these circumstances, the Vietnamese government has been promoting the strengthening of the IT industry, such as in its "Decision to Make Vietnam an Information and Communications Technology Superpower (2010)," which calls for increasing the share of the information and communications industry in GDP to 8-10% by 2020 and making it a driving force for economic development. On the other hand, the Vietnamese government tends to be seen as taking a protectionist stance, as it imposes regulations in areas such as data localization obligations and digital content. The government seems to have a desire to utilize the technological and capital strengths of foreign companies while protecting and fostering local companies and emerging industries as a matter of national policy. However, with the addition of lobbying for market liberalization and deregulation by foreign firms, particularly U.S.-based firms, there is a trend toward a more flexible stance, such as improving the business investment environment, compared to previous years. However, with the Communist Party Congress coming up in 2020, the government seems to be holding off on enforcing or amending new laws at this time. On the other hand, based on past experience, new policies are expected to be implemented under the new regime in the first half (two to three years) of the term after the Party Congress. In addition, the majority of the industrialists believe that there will be no excessive protectionism, such as excessive intervention by the government, as in the case of China.

Growing awareness of personal information protection
　Like neighboring Asian countries, Vietnam has long been relatively tolerant of the sharing and use of personal information, but awareness of personal data protection has increased over the years. Although there is no comprehensive personal data protection law, personal information and data are now protected through individual laws such as the Cyber Information Protection Law (2015) and the Cyber Security Law (2018). For example, the Cybersecurity Act imposes an obligation to store data in-country for businesses that handle large volumes of personal information, such as e-commerce platforms. In addition, when data transfer becomes necessary, a safety assessment is required in accordance with the rules set by the Ministry of Public Security, among other measures. However, the details are expected to be stipulated in subordinate laws to be enforced in the future, and so far no actual action seems to have been taken against those who violate the law. The Cyber Security Law imposes domestic preservation obligations on domestic and foreign companies that collect, extract, analyze, and process non-personal data, such as service user-related data and data created by users.

　Due to the inherent political system in Vietnam, there is little lobbying or lobbying by private companies or industry associations. It is effective to make proposals on desirable policies and improvement measures by utilizing the contacts with Communist Party members, politicians, and other influential people.

2. impact on industry and business

[Reactions to the Cybersecurity Act
　The Cyber Security Law was met with strong opposition from other countries due to its strict regulations, such as the establishment of local subsidiaries and the obligation to store data in Japan, etc. However, more than a year has passed since its enforcement, and the subordinate rules have not yet been established. Under such circumstances, the following opinions were heard from industry associations and companies (including Japanese-affiliated companies).

[Claire] Positive feedback.
- The government aims to increase foreign investment, and it will not be that detrimental to foreign companies. (Government agencies, industry associations, Japanese companies)
- People who make anti-government comments on Facebook and other sites are marked by authorities and occasionally hanged. We believe that the cybersecurity law is more about the government's desire to control speech in cyberspace than it is about restricting the investment activities of companies. (Japanese company)
- They are trying to maintain the same level of information security measures as in Japan and are aware that there is no problem at present because they exceed the required level of the Cyber Security Law. (Japanese company)
- We are relieved to observe that the bylaws do not cover cloud services. (Japanese company)

[Claire] Negative.
- We have pointed out to the Ministry of Public Security that regulations such as data localization and the establishment of domestic local laws could be a barrier to foreign investment. Since the law itself allows for flexible interpretation, it is necessary to define the scope in a government ordinance. For example, the law only stipulates "in cases where the authorities require it," and it should be clearly stated in what situations and for how long it will be applied. (Industry group)
- Currently, the scope of the law is unclear. It is clear that the Vietnamese government wants to regulate social networking sites (e.g., Facebook and ZARO) that have online communities where anti-government movements and speech are rampant. However, in a broader sense, there is concern that universal e-mail and websites (e.g., those that can be written on, such as inquiry forms) may also be subject to regulation. (Japanese companies)
- The impact on companies and the industries that will be affected will vary greatly depending on which of the three layers are targeted, including (1) cloud providers, (2) community operators, and (3) users participating in the community. (industry associations, Japanese companies)
- Businesses that utilize cloud computing are also problematic if they are subject to regulations. For example, if a machine room has to be physically set up, servers that are difficult to procure in Vietnam will have to be imported from Malaysia or Japan, which will increase costs. (Japanese company)
- If server installation becomes mandatory in Vietnam, companies with operations in multiple ASEAN countries will be faced with a difficult choice. Those already centrally managing operations in the region in Singapore, Thailand, etc. will be affected. (Japanese companies)