Securing Power or Restricting Freedom? Vietnam's Authoritarian Drive in Personal Data Digitization and Internet Governance

This article was published in Luat Khoa Magazine on September 1, 2022. Lee Nguyen translated this into English.

The lives of the Vietnamese people will undergo significant changes in the coming years as their government implements its citizen management systems that leverage personal data mainly through electronic identification on mobile phones.

Whether Vietnam becomes a different version of China depends on how efficient the Vietnamese government is in collecting personal information and in monitoring its citizens. Personal data is an individual’s most valuable asset; it holds the potential to both serve and potentially harm them.

There is still time to explore the Vietnamese government's ambitious drive towards digitizing personal data. For over the last 12 years, significant policy measures have been undertaken that have shaped the collection and digitization of personal data for the entire Vietnamese population.

August 2010

Decree No. 90/2010/ND-CP: The Establishment of the National Database on Population

The government issued Decree No. 90/2010/ND-CP in August 2010 which granted the Ministry of Public Security (Vietnam's national police force) the authority to establish the National Database on Population, enabling the collection of 23 distinct categories of information from Vietnamese citizens [1]. Notably, the decree outlines the inclusion of their personal identification numbers in the data collection process. This data will be collected by standardizing existing population statistics and gathering information from specialized databases, such as insurance or healthcare, or through various electronic forms.

June 2013

Decision No. 896/QD-TTg: Establishing the Legal Basis of the National Database on Population

In June 2013, Prime Minister Nguyen Tan Dung's Decision No. 896/QD-TTg mandated the establishment of robust legal frameworks for the collection of citizen data as well as drafting a new decree to replace Decree No. 90/2010/ND-CP. [2]  Aside from this, the decision required personal information to be integrated into "electronic citizen cards." This decision encompassed the philosophy of Vietnam’s population data management: "Centralized and unified registration and management from birth to death." At this point in time, The National Database on Population was expected to be completed by 2020.

November 2014

The Law on Citizen Identification and the Law on Civil Status

The 2014 Law on Citizen Identification, recognized as the highest-level regulation, legalized the provisions for collecting personal data in Decree No. 90/2010/ND-CP while issuing new regulations on new citizen identity cards (“căn cước công dân” in Vietnamese). [3]

The 2014 Law on Civil Status manages information and events related to personal status such as birth registration, marriage registration, and death registration. Moreover, this law integrates the Electronic Household Registration Database with the National Database on Population. [4]

May 2015

The Implementation of E-Government

Prime Minister Nguyen Tan Dung signed Decision No. 714/QD-TTg to deploy six national databases: population, land, business registration, comprehensive statistics on population, finance, and insurance. [5]

October 2015

Resolution No. 36a/NQ-CP: E-Government’s reform of administrative procedures and public services

After several years of implementation, the government’s goal of simplifying administrative procedures did not meet expectations. However, Resolution No. 36a/NQ-CP aimed to remedy this by requiring ministries, sectors, and localities to apply modern technology in their management activities to streamline administrative procedures, with the goal of achieving an effective E-Government. [6]

November 2015

The Ministry of Public Security Receives 3, 367 Billion Dong for the Construction of the National Database on Population

Prime Minister Nguyen Tan Dung signed Decision No. 2083/QD-TTg to allocate funds to the Ministry of Public Security to construct the National Database on Population. A portion of this budget would be used for the issuance of personal identification numbers and the collection of personal data in 2016 - 2017. [7]

December 2015

Decree No. 137/2015/ND-CP: Allowing the Collection, Exploitation of Personal Data, and Integration with the Citizen Identification Database

Decree No. 137/2015/ND-CP is particularly important because it served as a crucial upgrade to its predecessor, Decree No. 90/2010/ND-CP. [8] It governs the National Database on Population, aligning with the provisions in the Law on Citizen Identification. According to this decree, the Ministry of Public Security has the authority to collect and exploit citizen data and allow third parties to use this data as well. It also provided detailed regulations on integrating the National Database on Population with other specialized databases.

Furthermore, the decree regulated procedures for issuing/canceling personal identification numbers and managing citizen identity cards. In terms of jurisdiction, the decree specified that only the police at the district level and above are authorized to update citizens' personal data.

January 2016

16 Localities Begin Issuing Citizen Identity Cards

The Ministry of Public Security began issuing 12-digit citizen identity cards, which also serve as personal identification numbers, in 16 localities. [9] Other localities continued to issue 9-digit identity cards (chứng minh nhân dân). It was expected that in four years these new identity cards would be issued to the entire population. However, this project failed and by 2020, no additional localities had issued the new identity cards. [10]

August 2018

Decision No. 1072/QD-TTg: The Establishment of the National Committee on E-Government

A committee was established according to Decision No. 1072/QD-TTg, chaired by Prime Minister Nguyen Xuan Phuc, with members including ministers, deputy ministers, and the chairpersons of four companies: Viettel, VNPT, Vietnam Post, and FPT. [11] The committee's task was to study and propose strategies for building an E-government.

Accelerated Phase: The 2020 - 2022 Period

March 2020

Decision No. 366/QD-TTg: Extension of the Implementation Timeline and Adjustment of Investment Capital for the National Population Database Project

The National Population Database project could not be completed by 2017. As a result, Prime Minister Nguyen Xuan Phuc signed Decision No. 366/QD-TTg to adjust the investment policy for this project. [12] Accordingly, the Ministry of Public Security could spend 3085 billion dong from 2018 to 2021.

It should be noted that in November 2015, 3367 billion dong had been allocated to the Ministry of Public Security for the 2016 - 2017 period. However, the total amount spent was not indicated in official documents.

June 2020

Decision No. 749/QD-TTg: Approval of the National Digital Transformation Program

Decision No. 749/QD-TTg by Prime Minister Nguyen Xuan Phuc set forth Vietnam's ambition to reform its application of modern technology to develop a digital government, digital society, and digital economy. [13]

One notable objective of this decision was the full integration of national databases that serve as the foundation for developing e-government. These included databases on population, land, business registration, finance, and insurance. The databases would also be shared nationwide, achieving "one-time declaration, full life-cycle service for citizens, and socio-economic development." Notably, the decision did not mention anything about ensuring proper safeguards for the private and personal data of citizens.

September 2020

Decision No. 1368/QD-TTg: The Approval of Chip-embedded Citizen Identity Cards and an Additional 2, 696 Billion dong in Funding

At this stage, the Ministry of Public Security's goal of issuing citizen identification cards to the entire population failed, with only 16 million produced. [14]

In August 2020, the Ministry of Public Security announced that people should wait and that citizens would receive their identification cards from late 2020 onwards. [15] On September 3, 2020, the prime minister approved the chip-embedded identity card project of the Ministry of Public Security through Decision No. 1368/QD-TTg. [16] Consequently, the Ministry of Public Security began collecting data from the entire population to build the National Population Database.

November 2020

The Passage of the Residency Law

The 2020 Residency Law was passed, marking the transition from paper household registration books to a more modern "electronic" version by 2023. [17] Despite this, the old household registration system was not abolished. Information regarding household registration would still exist and be stored in the Residence Database that is connected to the National Population Database.

The Vietnamese government promotes the convenience of "electronic" household registration. However, this benefit primarily lies in not having to maintain the old paper book. People who migrate to major cities still have to return to their hometowns, their place of permanent registration, to handle administrative procedures. As of now, this digitization project has not addressed this issue.

February 2021

The Publication of the Draft Decree on Personal Data Protection – Encouraging the Population to Obtain Chip-embedded Citizen Identity Cards

At the beginning of 2021, the Ministry of Public Security urged Vietnamese citizens to register for chip-embedded citizen identity cards, according to the prescribed template in Circular No. 06/2021/BCA. [18] The Ministry of Public Security failed to proactively disclose the details of the technology partners involved in this project, such as the sources of these cards, the card management software, and card reading devices, among others.

In February 2021, the Ministry of Public Security published the Draft Decree on Personal Data Protection. [19] This decree allows authorities to collect and process personal information without the consent of the data owners through regulations "according to the provisions of the law" (Point a Clause 1 of Article 6 & Article 10). Point b of Clause 3 of Article 11 of the draft also gives data-collecting parties the power to refuse to notify data owners if "the processing of personal data is regulated by the laws, international agreements, and international treaties."

In addition to fundamental data categories, authorities may also collect sensitive personal data, including political opinions, religion, health, genetics, gender, biometrics, finance, sexual tendencies, residency, social relationships and the like.

March 2021

Amendments to Decree No. 137/2015/ND-CP that Provide Additional Power to Local Police

At the end of March 2021, the Ministry of Public Security issued Decree No. 37/2021/ND-CP to amend Decree No. 137/2015/ND-CP. [20][21] This amendment gave community-level police forces the power to update and modify citizens' personal data.

The decree also provided more explicit regulations on the exploitation and sharing of information from political and social organizations (such as the Vietnam Farmers' Union and Vietnam Women's Union) to the National Population Personal Data Database. In other words, the government would be able to access information about individuals from these organizations and vice versa.

The decree also specified how personal data can be exploited by third parties. Entities such as credit institutions and telecommunication service providers would be granted permission to use personal data if authorized by the government. This regulation carries inherent risks related to the control of third-party responsibilities in ensuring privacy rights.

July 2021

The Ministry of Public Security Provides a List of Services that Can Exploit Data from the National Population Database

The draft Circular by the Ministry of Public Security lists six groups of services that can exploit and use information from the National Population Database, including authentication services, citizen information provision services, citizen information retrieval services, services providing lists of citizens' primary information fields, electronic identification and authentication, and comprehensive data exploitation. [22]

Notably, “economic organizations” were also given the power to mine personal data.

August 2021

Controlling the Flow of Movement During the Pandemic Through the VNEID Application

When Ho Chi Minh City was under lockdown due to the COVID-19 outbreak, the Ministry of Public Security required residents to declare their movements through the VNEID application. [23] This application utilized the accumulated and digitized data collected during the preceding period. This event demonstrates the government's ability to use personal data for population control.

Entrust and MK Group: Partners in Providing Chip-embedded Identity Card Technology

By August 2021, the Ministry of Public Security's partners in supplying the chip-embedded identity cards were revealed. [24] Accordingly, Entrust (USA) collaborated with MK Group (Vietnam) to provide the system and software for issuing 50 million chip-embedded citizen identity cards, beginning in February 2021.

September 2021

Renaming the National Committee on E-Government the National Committee on Digital Transformation

In addition to changing the name of the Committee, Decision No. 1619/QD-TTg also expanded the committee's functions to research, propose, and promote the National Digital Transformation Program instead of solely focusing on building E-government as before. [27] Chairpersons of telecommunications and technology corporations no longer had the status of committee members but were only involved in working groups.

November 2021

Decision No. 34/2021/QD-TTg: Commencing the Issuance of Electronic Identification and Authentication for Citizens

The Prime Minister issued Decision No. 34/2021/QD-TTg, which regulates electronic identification and authentication for citizens. [28] According to the Decision, each individual would be issued an electronic identification account on their electronic devices to conduct transactions. This account is expected to serve as a secondary identity card, integrating various documents for public and private services.

However, shortly after the Decision was issued, the Ministry of Public Security announced that another decree would be issued to replace it in 2022. [29] The draft of the replacement decree specified that the VNEID application would be used for electronic identification accounts. [30]

January 2022

Decision No. 06/QD-TTg: Approval of the Plan for Developing Population Data, Electronic Identification, and Authentication Applications until 2025

The prime minister approved the plan under Decision No. 06/QD-TTg, listing the tasks that need to be completed for applying data, electronic identification and authentication technologies, to the entire population. [31] This decision requires the "involvement of the entire political system" and the society to "ensure the success of digital transformation."

Accordingly, the government would use the VNEID application for electronic identification and authentication in 2022, in the banking sector and other selected fields. The application will integrate population data with specialized sectors' data to establish Monitoring Centers and City Intelligent Operations Centers (IOC) that will use artificial intelligence cameras and monitor social networks. By mid-2022, provinces and cities would continue to build IOC centers to monitor, collect, and process information within their jurisdictions. [32]

March 2022

Resolution No. 27/NQ-CP: Cases When Personal Data Can be Processed Without Consent

The government issued Resolution No. 27/NQ-CP approving the documents for the construction of the Personal Data Protection Decree. This resolution agreed with the Ministry of Public Security and states that, in some instances, private data could be processed without the consent of citizens. [33]

The National Assembly Standing Committee would provide additional opinions on this draft before its issuance in 2022.

Electronic Identification for Managing Citizens in an Online Environment

In March 2022, the Ministry of Public Security informed Tuoi Tre newspaper that the introduction of chip-embedded identity cards would be accompanied by an electronic identification application. Its primary purpose was to facilitate the "management" of citizens' online activities, including limiting violations of honor, dignity, reputation, threats to national security, social order and safety, and crime prevention. [34]

July 2022

The Issuance of Electronic Identification Numbers to the First 10 Citizens

According to the Ministry of Public Security, electronic identification accounts were issued on February 25, 2022. [35] However, it was not until July 2022 that the first 10 citizens had their accounts approved. [36] Over 6 million citizens are currently on the waiting list.

The electronic identification account has two levels. Citizens only need to register online for a Level 1 account to access basic features such as reading the news and declaring health information. At Level 2, the account becomes an electronic identity card. However, citizens must register directly with the police to create this kind of account, which would also integrate various personal documents.

Currently, the campaign to issue chip-embedded identity cards is being expedited. The Ministry of Public Security aims to complete the issuance of chip-embedded identity cards for the entire population before September 30, 2023. [37] Five centrally-administered cities must complete it earlier by August 30, 2023. [38]

What Can We - the People - Do?

Understanding Our Rights

Citizen participation is crucial in public policies, especially those directly related to rights such as the protection of personal data.

Nevertheless, from the construction of the National Population Database to the issuance of chip-embedded identity cards and the implementation of "citizens' movement tracking," it is evident that citizens are not given opportunities to voice their opinions. The legal drafts are published on low-traffic websites and state media often reports this after the fact, and the decision is irreversible.

The minimum we can do is to monitor significant developments and understand our rights as defined by the law. For example, Article 5, Clause 1 of the Law on Citizen Identification stipulates:

“Citizens have the following rights:

a) To have their personal and family secrets kept confidential in the National Population Database and the Citizen Identification Database, except in cases subject to the provision of information and documents as prescribed by law;

[...]

d) To lodge complaints or denunciations about or initiate lawsuits against law violations on citizen identification, the National Population Database and the Citizen Identification Database under law.”

Understanding the law may not prevent abuse of power by authorities, but it can help maintain a more resilient mindset in adverse situations.

Paying Attention to Upcoming Developments

The VNEID application is the most crucial thing to pay attention to. This application functions as an electronic identity card. In 2023, the VNEID application will continue to expand its functions to include cashless payments, utility payments, document integration, crime reporting, and more. [39]

In the future, it may even become necessary to use it for personal transactions such as opening bank accounts, staying in hotels, or even registering for social media accounts. All of this personal data may be collected and stored by the authorities. Monitoring the power and control associated with the VNEID application is something that should be done to protect privacy rights.