Special Alert | Decree 147 Refreshes ‘Outdated’ Rules for Internet-Based Businesses

On 25 December 2024, Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and information in cyberspace (“Decree 147”) officially came into force. Decree 147 marks the end of a decade-long implementation of its predecessor, Decree No. 72/2013/ND-CP, along with its amendments (“Decree 72”). It is expected to present both significant opportunities and substantial challenges for organizations, individuals, and businesses, especially in the cross-border information provision, social network services, and online games services.

This article yields key and valuable updates.

Key Takeaways

• Cross-Border Information Provision: Offshore entities providing online content to users in Vietnam must now comply with strict obligations.
• Social Network Services: Social network service providers must meet new, stricter compliance requirements, including verifying user accounts, setting up local content management teams, and maintaining clear contact information.
• Online Games Providers: Online game providers must now adhere to regulations regarding virtual units, virtual items, bonus points.
• Compliance Obligations: Businesses must ensure they comply with the new regulations within 90 days of Decree 147’s implementation.
• Impact on Internet-Based Businesses: Decree 147 brings a more structured and comprehensive regulatory approach to internet-based services in Vietnam.

Refreshment of Definitions

Decree 147 has omitted several terms such as “network”, “public information”, “private information”, and “personal information”. This likely reflects the evolution of technology, where the concept of “network” has expanded and become more complex with the emergence of new types of networks such as 5G, cloud computing networks, and the rapidly developing Internet of Things (IoT), which are no longer confined to traditional networks like telecommunications or LAN/ WAN. These terms are expected to be refined and incorporated into specific legislation such as the draft Law on Digital Technology Industry, and the draft Law on Personal Data Protection.

Abundance of Regulations Governing Cross-Border Activities

Cross-border information provision is defined as the activity of offshore organizations or individuals providing online content and services accessible or usable by users in Vietnam.  While it can be implied therefrom that “cross-border” activities may not require the establishment of a commercial presence, Decree 147 continues to mandate such requirements on the cross-border provision of certain services, including online games services.

For the cross-border provision of information, while Decree 72 had minimal regulations for this area, Decree 147 devotes substantial attention to it, incorporating regulations of Circular No. 38/2016/TT-BTTTT, specifying two scenarios where foreign entities providing cross-border information services to Vietnam are subject to corresponding obligations:

1. Using data storage services located in Vietnam; or
2. Receiving a consistent total of 100,000 or more visits from Vietnam within one (1) month (averaged over six (6) consecutive months).

In such cases, these entities must bear the following notable responsibilities:

1. Notifying contact information to the Ministry of Information and Communications (“MIC”) (Department of Broadcasting and Electronic Information – DBEI);
2. Monitoring, supervising, and removing information, services, or applications that violate Vietnamese laws;
3. Entering into content cooperation agreements with Vietnamese press agencies when using content sourced from Vietnamese media, in compliance with the Law on Intellectual Property;
4. Storing information about users from Vietnam when registering social network accounts;
5. Verifying user accounts on social networks;
6. Preventing and removing content, services, or applications that violate the law within 48 hours of receiving a complaint from a service user in Vietnam; and
7. Submitting annual reports.

Notably, only those offshore entities providing cross-border information to Vietnam that have fulfilled the obligation on providing their contact information to the MIC (DBEI) are allowed to offer livestream functions or any forms of revenue-generated activities.

Strict Compliance Obligations to Social Network Services

Decree 147 has broadened the definition of social networks and introduced new terms such as “user account”, “fanpage”, “channel”, “group”, and “livestream”. Notably, Decree 147 stipulates that only verified user accounts are permitted to post, comment, livestream, or share information on social networks. This measure is expected to reduce the prevalence of fake accounts and online fraud.

Organizations and businesses in Vietnam may only provide social network services if they obtains:

1. License for Provision of Social Network Services (for networks with a significant number of frequent users); or
2. Certificate of Notification of Provision of Social Network Services (for networks with fewer frequent users). However, social networks with lower user traffic may apply for a license if they wish to include livestream functionality or revenue-generating activities.

The lawmakers also pose obstacles for social network services providers with newly strict compliance obligations, including:

1. Establishing content management and technical management teams, with content management personnel required to be Vietnamese nationals (contrasting with Decree 72, which allowed foreign nationals with temporary residence cards);
2. Maintaining a clear and accessible official address and contact number;
3. Ensuring that users agree to a Terms of Service Agreement, which now must include:

• mechanisms for handling user complaints;
• descriptions the measure to ensure the user’s right to make decisions regarding collecting and transferring their information to third parties.

1. Assigning staff to operate 24/7 to address issues raised by authorities and Vietnamese users; and
2. Categorizing and displaying warnings for content unsuitable for children.

Additionally, social network services providers are responsible for temporarily or permanently locking (depending on the nature/degree and frequency of violations) user account, fanpage, group, or channel that frequently post content that violates the law.

Responsibilities of Online Games Providers

Definitions have been clarified for “virtual units”, “virtual items”, “bonus points”, and “top-up cards (game cards)”. Importantly, virtual items, virtual units, and bonus points are restricted for use within online games and cannot be converted back into cash, mobile telecommunications prepaid cards, bank cards, shopping vouchers, game cards, gift cards, or any physical assets with transactional value outside the online game. Moreover, trading of virtual items, virtual units, and bonus points among players is strictly prohibited. While Decree 147 introduces these provisions with a view to establish a strictly legal framework for the gaming sector, the mechanisms for detecting and addressing violations in practice remain a tough challenge.

As mentioned, Decree 147 maintains the requirement for businesses (including foreign entities) to establish a legal presence in Vietnam to provide online gaming services. This regulation may stem from the fact that providing illegal and cross-border online games into Vietnam affects the healthy development of the domestic gaming market, creating unfair competition. Online games providers must then complete licensing or certification procedures depending on the type of online games being offered (G1, G2, G3, or G4).

In addition, a new rating level 16+ for online games is included in Decree 147 but leaves the distinction between 16+ and 12+/18+ age groups somewhat unclear, and vague. This will potentially cause difficulties for businesses when classifying the age of online games. Age-rating symbols must be also displayed continuously on game screens and advertisements, with easily recognizable size and color.

Further responsibilities for online games providers include:

1. Ensuring that users have the right to decide whether their information can be used for promotional/ media purposes or transferred to third parties;
2. Complying with intellectual property, cybersecurity, and user information confidentiality laws; and
3. Implementing child protection measures in compliance with laws on child protection in digital environments.

With an eye toward streamline digital platform and optimize in terms of time and cost for the public, Decree 147 allows the submission of relevant documents via the Online Public Service System and the use of digital signatures, and reduces the processing time for most licensing procedures (e.g., fall from 30 days to 20 days for G1 online games license, from 20 days to 15 days for G2, G3, G4 online games certificate). However, the effectiveness of these measures will heavily depend on technical infrastructure and human factors.

Compliance Issue – Thorough Preparations and Prompt Actions

The transitional provision of Decree 147 is particularly critical upon the effective date. Accordingly, organizations, individuals, and businesses take responsibility to review the validity and/or comply with corresponding obligations within 90 days of the effective date in case of possession of the following licenses/ certificates:

1. License for Provision of Social Network Services;
2. License for Provision of G1 Online Games Services;
3. Approval Decision of Content and Script of Online Games under Decree 72;
4. Approval Decision of Content and Script of Online Games under Joint Circular 60/2006/TTLT-BVHTT-BBCVT-BCA;
5. Certificate for Provision of G2, G3, G4 Online Games Services; and
6. Confirmation of Notification of Provision of G2, G3, G4 Online Games Services.

Besides, there is a requirement for the service providers to verify the active accounts of social network service users when providing cross-border information into Vietnam and social network services domestically. Otherwise, failure to comply with these obligations will result in legal penalties.

Although Decree 147 has completely changed the names of the licenses/certificates compared to Decree 72, it does not clearly specify which license will replace/correspond to another. This leads to confusion and difficulties in practical application. Additionally, the incorrect citation of legal bases (specifically Decree No. 27/2013/ND-CP, which is unrelated) is also a loophole in the drafting process of Decree 147.

Conclusion

Decree 147 serves as the backbone for regulating internet-based services, with an extensive set of procedural requirements. This will significantly impact existing organizations, individuals, and businesses, as well as potential investors in future.