Vietnam's National Assembly will discuss the draft Law on Data Security, the draft Law on Electronic Identification and Authentication, and the revised Law on Handling of Administrative Violations during a plenary sitting on November 4, as part of the second session.
The draft Law on Data Security establishes five levels of data security risk. Data controllers will be responsible for classifying risks and applying corresponding protection measures, mainly under a post-inspection mechanism. The measures will cover the entire data lifecycle, from system design to data destruction.
For artificial intelligence research, development and application, the draft requires the origin and integrity of training and derived data to be ensured. It prohibits data poisoning and unauthorised data extraction, and provides for human intervention and oversight of automated decision-making in accordance with the law.
For cross-border data transfers and processing, level-one and level-two data will be exempt from procedures under the law. Controllers of level-three data will have to conduct their own assessments and retain relevant records. Transfers of level-four and level-five data will require prior appraisal and approval by competent authorities.
The draft also addresses foreign requests for data provision, the responsibilities of cross-border service providers, and the integration of data security assessments into existing investment and technology transfer procedures.
The revised Law on Handling of Administrative Violations consists of six chapters and 128 articles. It proposes extending the statute of limitations for administrative penalties to two or three years in certain sectors, raising maximum fines to VND1.5 billion (US$58,200) for individuals and VND3 billion for organisations, and setting maximum fines for each sector.
After reviewing the draft, the National Assembly's Committee for Legal and Judicial Affairs called for further scrutiny and separate provisions for sectors eligible for extended limitation periods. The committee said this would help violations be detected and prevented promptly and penalties imposed quickly.
The committee also cautioned that extending the limitation period to three years, or up to four years in cases referred by procedural authorities, could narrow the legal distinction between administrative violations and criminal offences. The statute of limitations for less serious crimes is five years. This could expose violators to more severe legal consequences and requires particularly careful consideration.
Sources: Viet Nam News
