1)         Introduction

On 22 June 2023, the National Assembly issued a new Law on E-transactions, which will take effect from 1 July 2024 (LET 2023). The LET 2023 has the following notable points:

• Unless otherwise clearly excluded, the LET 2023 applies to e-transactions in all areas whether by companies, individuals or Government agencies.

• A data message converted from paper document or vice versa must have clear marking that it has been converted from paper document and information of the converter.

• A natural person may not be able to create and use his/her own e-signature and may have to use digital signature for his/her e-transactions.

• For the first time, trust services are introduced. The service provider must be licensed by the Ministry of Information and Communication (MIC).

We discuss below each of these new points and some more. This post is written by Nguyen Quang Vu, Hoang Thi Thanh Thuy, Trinh Phuong Thao and Phan Thi Phuong Mai.

2)         Broader scope and subjects of application

Scope of application - Unlike the LET 2005 which does not govern certain sectors such as issuance of land use right certificates, real estate ownership certificates, inheritance documents, marriage certificates, decisions on divorce, birth/death certificates, bills of exchange and other important documents, the LET 2023 applies to all activities. However, the LET 2023 also makes clear that it only regulates the implementation of transactions via electronic means and the contents, conditions and forms of transactions will be governed by specialized laws.

The LET 2023 however does not define what constitutes a “transaction” (giao dịch) under the LER 2023. It seems that the term transaction will include not only contracts, agreements but also correspondence or documents issued or exchanged by any individual or organization.

Subject of application – While the LET 2005 only applies to organizations/individuals opting for making transactions by electronic means, the LET 2023 expand its subject of application to any organization/individual directly or related to electronic transaction. Accordingly, an enterprise which is not a party to an electronic contract but mentioned in the contract (e.g., a third party) may also be subject to the LET 2023.

An “opt-out” approach  - The LET 2023 make it clear that even if a different law is silent on e-transactions, then e-transactions under such different law are permitted and are subject to the LET 2023. A law must clearly provide that transactions under such law cannot be made in form of e-transactions.

3)         More details on data messages

The validity and value of data messages

The LET 2023 basically retains the regulations in the LET 2005 which confirm the legal validity of a data message, the value of data message as written documents, the value of data message as original and the value of data message as evidence. However, the LET 2023 also has several new provisions regarding data message. For example,

• The LET 2023 makes clear that a data message can be created by converting a paper documents into a data message.

• The LET 2023 provides that if a written document is required to be notarized then a data message can satisfy such notarization requirement if it satisfies the requirements of the law on notarization. The provision seems to pave the way for e-notarization in Vietnam.

• The LET 2023 has a clearer mechanism to determine when or where a data message is sent or received. In particular, if a representative of a party receives or sends a data message then such data message is also regarded as being sent or received by such party. The LET 2023 also considers the place of sending or receiving a data message being the residential addresses or head office of the sender or receiver regardless of where they are when the data message is actually sent or received.

E-certificates

The LET 2023 redefines e-certificates (chứng thư điện tử) to mean certificates, licenses, registration or approval issued by competent authorities. The LET 2023 provides the main legal requirement for an e-certificate to be effective including:

• the e-certificates must be signed by a qualified digital signature;

• the information contained in the e-certificates can be retrieved and used in a complete form; and

• if the e-certificate must have a date then the e-certificate must be time-stamped.

The LET 2023 also provides for the legal requirements when a e-certificate is transferred.

Conversion between paper documents and data messages

The LET 2023 provides detailed provisions on the conversion of paper documents into data messages and vice versa. Before the LET 2023, the provisions on conversion of paper documents into data messages and vice versa are provided in some specialized legislation in banking or social insurance sectors. One important requirement of the LET 2023 is that the converted paper document or data message must have:

• a specific marking to confirm that the converted data message or paper document have been converted from paper document or data message, respectively; and

• information of the person conducting the conversion.

4)   E-signatures

Types of e-signatures

Based on the use purpose, the LET 2023 categorizes e-signature into the following types:

• specialized e-signatures (chữ ký điện tử chuyên dùng). Specialized e-signatures are used by organizations for their “own private operations”. The requirements of a specialized e-signature are similar to those applicable to e-signatures under the LET 2005.

• public digital signature (chữ ký số công cộng). Public digital signatures are digital signature used for “public activities” and are secured by an e-certificate confirming the public digital signature. The LET 2023 does not define what constitutes “public activities”. For example, it is not clear if execution of a contract between two different companies is regarded as public activities or as the private operation of these entities. In the former case, a public digital signature is required and in the latter case, only specialized e-signature is required.

• specialized digital signature for official use (chữ ký số chuyên dùng công vụ).  Specialized digital signature for official use are digital signatures used for official activities and are secured by an e-certificate confirming the specialized digital signature for official use.

Under the LET 2023, the means used to create a digital signature must ensure that:

• the data used to create a digital signature cannot be disclosed, retrieved or used to create false digital signature; and

• the data used to create a digital signature can only be used once.

E-signature by individuals

The LET 2023 fails to provide if there is an e-signature to be used by a natural person. It is not clear whether this means that (1) a natural person is not allowed to use e-signature created by himself or herself, or (2) a natural person cannot use e-signature at all. In either case, the right of an individual to use e-signature under the LET 2023 is significantly reduced.

5)         Trust services and other activities

For the first time, the LET 2023  introduce trust services (dịch vụ tin cậy) which support by ensuring “trust” in e-transactions. These trust services are:

• Timestamp issuance service is a service for attaching time information to data messages;

• Data message certification service including (1) storing and verifying the integrity of data messages and (2) sending and receiving the secured data messages; and

• Public digital signature certification service is a service of certifying the digital signature in public activities.

• Most of these trust services are conditional services and require a license from the Ministry of Information and Communication (MIC) which has a term of 10 years.

In addition to trust services, the LET 2023 also introduces the concept of “information system serving electronic transactions” and imposes various responsibilities for the operator of such information system. For example, the operator of an extremely large-scale intermediary digital platform serving e-transactions have the following obligations:

• publishing general principles, parameters or criteria of the recommendation system used for displaying suggested content, advertising to users;

• allowing users to uninstall any preinstalled applications without affecting the basic technical features to keep the system working correctly; and

• publishing the code of conducts for persons using the information system.