Vietnam’s Law on Cyber Information Security Comes Into Effect
Vietnam’s Law on Cyber Information Security (“LOCIS”) came into effect 1 July 2016. The LOCIS imposes, inter alia, restrictions and conditions on entities engaging in the import, export and trade of (i) civil encryption products and services, and (ii) other cyber information security products and services.
Decree No. 58/2016/ND-CP (“Decree 58”) (see our previous alert here) clarifies and further details the restrictions and conditions on entities that engage in the import, export and trade of civil encryption products and services (under the administration of the Government’s Cipher Committee). Decree No. 58 came into effect 1 July 2016.
Correspondingly, the Government passed Decree No. 108/2016/ND-CP (“Decree 108”) on 1 July 2016, which further details the restrictions, conditions and business license application procedure for entities engaging in the import, export and trade of other cyber information security products (“CIS Products”) under the administration of the Ministry of Information and Communications (“MIC”).However, different from Decree No. 58, Decree No. 108 required an implementing Circular to detail the permit application procedure for the import of other CIS Products.
Consequently, the MIC recently published the draft Circular (“Draft Circular”) that details such procedure. Public comment on the Draft Circular may be made until 25 December 2016.
We highlight key points from the Draft Circular below.
1. CIS Products subject to an import permit
Appendix 1 of the Draft Circular lists CIS Products that would require an import permit from the MIC. Appendix 1 covers three broad categories of products:
(i) Cyber information security verification and evaluation products
Hardware and software devices that have the following basic functions: ability to scan, verify and analyze the architecture, status and log data of an information system in order to detect vulnerabilities and weaknesses; provide risk assessments of an information security system.
(ii) Cyber information security surveillance products
Hardware and software devices that have the following basic functions: ability to supervise and analyze data transmitted on an information system, collect and analyze log data in real time, detect and provide alerts on unusual incidents that may potentially endanger an information security system.
(iii) Anti-attack and anti-intrusion products
Hardware and software devices that have the basic functions to block an attack or infiltration into an information system.
The above three categories are broken down into sub-categories that contain general descriptions of CIS products subject to an import permit and their corresponding HS codes. Currently, the Draft includes two HS code options: 8471/8517 headings and the 99 series.
The 8471 heading covers products such as:
automatic data processing machines and units, magnetic or optical readers, machines for transcribing data onto data media in coded form and machines for processing such data;
while the 8517 heading covers:
telephone sets, including telephones for cellular networks or for other wireless networks, other apparatus for the transmission or reception of voice, images or other data, including apparatus for communication in a wired or wireless networks (such as a local or wide area network), respectively.
The 99 series is a special chapter reserved for national use that has yet to be legally implemented.
The import of a CIS product requires an import permit only if it (i) bears an HS code as listed in Appendix I AND (ii) matches the product description in Appendix I. CIS product components or accessories do not require an import permit.
2. Import permit application procedure
The Draft Circular charges the Authority of Information Security (“AIS”) under the MIC with the assessment of application dossiers and issuance of import permits. CIS Products importers may eventually submit an application dossier online. However, the process is yet to be detailed by the AIS; as such an importer must submit their application dossier by hard copy.
An import permit application dossier must include the following:
(i) Application form;
(ii) Certified copy of the business licence for trading CIS products and services;
(iii) Certified copy of the certificate of conformity for the CIS Products;
(iv) Copies of CIS Product specifications certified by the importer;
(v) Certified copies of commercial invoices, which includes the names, notations and quantities of the imported CIS Products; and
(vi) Certified copy of the commercial contract or documentary evidence, bill of lading, including the name, notations, quantity and manufacturer of the imported CIS Products.
AIS must determine and notify an applicant of the validity of their application dossier within three working days of receipt.
Applicants have up to five working days to supplement or amend their application dossiers as required by the AIS or else AIS will not issue the import permit.
Within ten working days of receipt of a valid application dossier, the AIS must issue the import permit to the applicant.
In the event that the AIS refuses to issue an import permit, they must provide reasons for their refusal and a written notification.
The Draft Circular specifies that an import license is valid for each shipment of CIS Products and such quantity will be specified in the permit. This may mean that a bulk import permit, i.e., a permit that covers multiple import shipments, may not be available to importers.
3. Amendment, reissuance and extension of an import permit
The importer must request the AIS to amend an issued import permit if there is any change in regard to the (i) quantity and type of CIS Products to be imported and/or (ii) name of the importer or the seller of the CIS Products.
The AIS will only issue a replacement import permit if such permit is lost or destroyed, its validity term has not expired and the batch of goods permitted thereunder has not completely cleared through customs.
If the import permit is no longer valid but the batch of goods permitted thereunder has not completely cleared through customs, the importer must request to extend its import permit.
The Draft Circular provides detailed documentation requirements, forms, and procedures for the amendment, reissuance and extension of an import permit.
Should you have any questions on the above or on the LOCIS, please do not hesitate to contact us.