Key takeaways

We have summarized the key issues under Decree 137 below for your consideration:

1. Technical requirements: The decree mandates that information systems involved in document conversion (from paper to data messages and vice versa) must fulfill specific technical requirements. These include the creation of unique identifiers and other information, such as QR codes or similar encoding methods, to facilitate lookups.
2. Classification of information systems: The decree categorizes information systems for e-transactions based on their functions and features within specific sectors, such as administrative procedures, trade, finance and banking. These systems should enable functions like issuing and authenticating e-transaction accounts, concluding electronic contracts, and performing unilateral legal acts. Responsibility for issuing specific regulations for specialized electronic information systems is assigned to ministers and the chairpersons of provincial people's committees.
3. User scale classification: The decree also classifies information systems based on the number of users. A large-scale intermediary digital platform is defined as one that serves 3% to 10% of Vietnam's population. Platforms serving over 10% of the population are classified as very large.
4. Responsibilities of platform owners: Owners of large-scale intermediary digital platforms must regularly collect and report monthly statistics on user numbers. They are also required to clearly publicize mechanisms (in Vietnamese) for users to report illegal content and ensure such content is addressed.
5. Requirements for very large platforms: Owners of very large digital intermediary platforms must publicly disclose the principles, parameters or criteria (in Vietnamese) governing content and advertising recommendations for users. They must also publish a code of conduct and provide mechanisms for users to opt out of content and advertising recommendations.
6. Network credibility criteria: The decree outlines the criteria for assessing the network credibility of information systems serving e-transactions. These criteria include compliance with information security laws, obtaining user consent before processing personal data, encrypting user data with secure algorithms, ensuring that the website does not harbor malicious links or code, and publicly disclosing a contact point for reporting and addressing information security issues.

The issuance of Decree 137 marks a temporary milestone in the governing regulations for digital platforms in Vietnam. This regulation aims to enhance transparency, security and accountability, which could foster greater trust in digital transactions. However, it also presents challenges for tech companies as they must adapt quickly to these new requirements.

* * * * *

Tuan Linh Nguyen, Government Affairs Manager, contributed to this legal update.