In last week’s Economist there featured an article about the Chinese founded app TikTok. As the article was written with an America aligned editorial policy it took a warning stance suggesting that even though ByteDance, the holding company that owns TikTok is domiciled in the Cayman Islands, the ultimate beneficial owners remain it’s Chinese founders.  

The Economist pointed out that, in addition to the ability of the Chinese Government to influence content posted on the app through censorship and strong arm tactics, they may also be able to access private data connected to users.  

According to the article, China has an existing legal policy that gives the government the right to access all data collected by Chinese companies, even if that data is hosted offshore. And this, for a western economy, promotes fear and caution more so than the possibility of the Chinese government controlling editorial content through propaganda or spam based content.  

While Vietnam goes out of its way to keep a cultural and policy separation between itself and China, it remains associated with China from its geographical proximity and single party governance. And through that association one can easily forecast the future challenges that Vietnamese companies may face as they reach a critical point of global adoption and, more specifically western countries. 

Even Axie Infinity, the largest and most successful effort to date by Vietnamese founders. But the question of whether Vietnam can access the various data collected by Axie Infinity from its users is both legislatively and practically difficult to answer. 

Axie Infinity is owned by a Singapore holding company called Sky Mavis. It’s dispute resolution is arbitration in the Cayman Islands, yet its data is stored in the United States. This gives rise to a few questions. 

First, there has been little to no data privacy legislation passed by the federal congress. The data protection laws that do exist have been passed by individuL states so it is difficult to determine what law would apply to the data collected by Axie Infinity. It is likely, however, that data stored in the United States will be subject to search and seizure by the authorities if they have obtained a properly legalized search warrant. This means that data collected on users in Vietnam, the Philippines , or any third country would subsequently be accessible by the authorities in the United States. Thus creates a major vulnerability for developing-world users living in countries that may have minimal protections for their citizens’ data. 

Second, what other countries might be able to access the data stored in the United States? The Cayman Islands, where Axie Infinity is domiciled? Singapore, where Sky Mavis is domiciled? Or the countries in which the data subjects live? And by a simple extention of such a question, what countries’ governments can request access to that information through either legitimate searches or through fiat demands of such data? 

Third, as a resident of Vietnam which is currently considering the passage of more extensive data protection regulations, what rights do they retain in the data collected on foreign individuals?  

I use Vietnam, here, as an example fir there is little privacy between the founders and Axie itself as the corporation exists in Singapore. But the concept remains whether the country in question is Singapore or Vietnam. Ultimately, the answer turns on whether the data protection laws in existence in that country allow for data sharing of all users or only users domiciled within that country’s boundaries? 

In China, it does. And previously in Vietnam there has been no such power granted to the Ministry of Public Safety. And a review of the second draft personal data protection decree fails to clarify this question. We must therefore turn to the Cybersecurity Law which requires the localization of all data collected about Vietnamese citizens within Vietnam. A draft decree softens this requirement somewhat, and oral statements from the Ministry of Public Safety reveals that they only enforce this regulation based on the failure to remove information at the request of the authorities. But even thus is not an answer. 

It would seem, therefore, that Vietnam’s leaders have not imagined the situation in which a Vietnamese internet company becomes popular enough that it’s treatment of such foeigner’s data remains unregulated and unrecognized. I suspect that the National Assembly or the governmen4 will realize all to soon that they are sitting on a treasure trace of data that could give them a greater understanding of foreign habits and information.  

Another option that the government may take is to require foreign internet services who collect data in Vietnam to submit to requests by the Vietnamese authorities to hand over the data collected by them about Vietnamese citizens. Already, they have given warning that they can shut down given domains from accessing Vietnam if they find a company to be uncooperative.  

But to date, the National Assembly has not seen fit to draft laws which could great expand Vietnamese’ regulators access to data that is currently collected by foreign internet companies.