[Joint Statement] Viet Nam’s Identity Verification Mandate will Violate International Human Rights

The undersigned human rights organizations call on Viet Nam’s Ministry of Information and Communication to reconsider the fatally flawed draft Decree 72/2013/ND-CP, that, if adopted, would mandate real identity registration for all social media accounts accessible in Viet Nam. Although there are other parts of the draft Decree that are also deeply concerning, the identity verification rule is a direct and substantial threat to the enjoyment of rights to privacy, freedom of expression and information, and non-discrimination of all social media users in Viet Nam. Also, we demand that the business enterprises affected take measures consistent with the United National Guiding Principles on Business and Human Rights if the decree goes into effect in that flawed form. 

The pending modification to Decree 72 on the management, provision and use of Internet services and online information (2013) will be promulgated by the end of this year. This modification follows closely on the heels of Decree 53 guiding Cybersecurity Law, which went into force in October 2022. Decree 53 requires all international platforms to store data locally and open local offices, should the Vietnamese government so request. 

The government intends to issue these data localization mandates in the event that companies fail to voluntarily comply with requests for user data. As Voice of Vietnam reported, under the pending modification to Decree 72, all social media account users would need to verify their true identities. The decree would apply to domestic and foreign social media platforms. Anonymous accounts, or platforms that fail to implement identity verification measures, will face the risk of losing the posting privilege or outright blocking. The Public Security Ministry and Ministry of Information and Communications are working together to formulate and enforce the new requirements.

Prohibitions of anonymity unduly and arbitrarily restrict human rights and fundamental freedoms, including the right to privacy, freedom of expression, and freedom of association, protected under the International Covenant on Civil and Political Rights (ICCPR), to which Viet Nam is a party. As noted by the then Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression in his 2013 report, restrictions on anonymity “facilitate State communications surveillance” and “have a chilling effect, dissuading the free expression of information and ideas”.

The United Nations Human Rights Committee, the supervisory body for the ICCPR, recently voiced concern that, in Viet Nam, “human rights defenders, activists, and religious leaders, may face arbitrary arrests, detention, and incommunicado detention without charges.” Bloggers and other online activists in Viet Nam have been detained and prosecuted for criticizing State authorities or policies. The real-identity verification requirements exacerbate concerns that the Vietnamese authorities will intensify their surveillance of telecommunications and online activity, and are likely to dissuade individuals from expressing themselves freely. The restriction on people’s ability to speak anonymously online will be especially debilitating to democracy when it is doubtful that the requirement will apply to Viet Nam’s Force 47, the army’s online information warfare unit, which will continue to be able to engage in mass online disinformation campaigns.

Noncompliant with International Human Rights Law and Standards

Under the ICCPR, a governmental measure that serves to restrict or limit the exercise of  human rights such as freedom of expression or right to privacy, it will only be permissible if its terms are defined narrowly and precisely and it is strictly necessary for a legitimate purpose such as protecting reputation of others, national security, public order or public health or morals.  The measure also must be proportionate to that end.  

The identity verification requirement is being proposed on the pretense of combating human trafficking and fraud. It is clear that the restriction imposed by this measure is neither necessary for that legitimate purpose, nor the least intrusive means of achieving it as required by the proportionality principle. As the then Special Rapporteur on freedom of opinion and expression noted in his 2015 report that “[b]lanket prohibitions [on anonymity] fail to be necessary and proportionate.” That report specifically calls out Vietnam for violating free expression rights when it outlawed the use of pseudonyms in 2013. The proposed modification to Decree 72 goes beyond what can reasonably be construed as necessary, as it targets every single social media account, not only those suspected of human trafficking. In fact, it applies even to accounts held by users who might never enter the territory of Viet Nam. Such a blanket regulation fails the requirement to articulate in “specific and individualized fashion the precise nature of the threat.”

Additionally, any limitation on rights, under the ICCPR, must be prescribed by law. Under this principle, laws must not confer unfettered or overly broad discretion for the restriction of freedom of expression and privacy on those charged with its execution. The new Decree 72 will restrict and infringe these rights severely by generating much personal data vulnerable to surveillance when the Vietnamese government has failed to establish an independent oversight body to monitor State demands for disclosure of personal information, nor has it provided any safeguards for the security of such information.

Though the modification to Decree 72 is alleged to combat trafficking, there is no evidence to suggest that real-name verification will have any substantial impact on incidence of trafficking.  This was the view of the Republic of Korea’s Constitutional Court, which in 2012 struck down a similar real name verification law pursuant to a legal challenge filed by Open Net’s founders.

The South Korean rule, like Viet Nam’s, mandated identity verification regardless of the content of the posting. The Court held that “many prospective posters, not completely sure of what is a prohibited posting, are likely to give up on posting at all in fear of discipline or prosecution… [s]uch a result of suppressing a great majority’s legal postings on the account of the existence of a minority of people abusing the Internet is an excessive restriction on freedom of anonymous speech.” The Court found that a “perpetrator can always evade identity verification by using another’s name and resident registration number” and that “the data submitted by the Korean Communication Commission fails to show any significant decrease in the defamatory, insulting posting after the [identity verification rule] was instituted.” The law was therefore in conflict with the enjoyment of human rights and fundamental freedoms. 

In another example in Asia, in early 2022, the Philippine government also tinkered with online identity verification, but withdrew its proposed law out of concerns for human rights. 

Reconsider or Substantially Amend the Modification

The real name verification requirement, if it goes into effect, will violate Viet Nam’s international human rights obligations. The breach of anonymity is neither necessary nor proportionate to the stated aim of the modification. Further, evidence from jurisdictions such as the Republic of Korea demonstrate that such laws fail to deter crime, and harm domestic users and companies. While we acknowledge the imperative of protecting people from trafficking, we urge the Vietnamese authorities to do so in a manner that respects and ensures the rights to privacy, freedom of expression and information, association, and assembly, and non-discrimination.

Calls to Business Enterprises  

The United Nations Guiding Principles on Business and Human Rights (UNGPs) were endorsed by the Human Right Council in 2011 as the primary global framework on business and human rights. These principles place a responsibility on companies to respect human rights by avoiding actions that adversely impact human rights and address any actual adverse consequences they may have caused or contributed. This is particularly important for technology companies operating in Viet Nam, which have a responsibility to identify, prevent, and mitigate risks to privacy and freedom of expression while avoiding involvement in human rights abuses. Investors in the tech industry are also expected to be mindful of the harm inflicted on non-users and affected communities. To ensure accountability, both the government and private sector should abide by international laws related to the right to an effective remedy.

To promote the protection of the right to privacy, it is important to collaborate with local civil society and media organizations. Working with local stakeholders, companies should consider adopting policies, products, and operational changes that advance the protection of their customer’s right to privacy.

In Viet Nam, the social media companies carrying out the identity verification rule will be forced to collect, amass, and store huge amounts of personal data at great costs, which will attract identity thieves, making the security level of all users suffer. Concentration and amassing of personal data is not only harmful to the users’ data security but will make their privacy more vulnerable to government surveillance demands. 
Business enterprises and their associations should therefore oppose and, if possible, configure their businesses in a way that will avoid application of the identity verification mandate. After the identity verification rule was instituted in South Korea in 2007, many Korean operators that could not afford the security risk to their users, stopped operating comments sections or bulletin boards to avoid application. Foreign companies preferred to cease operations out of the bases in South Korea, instead of complying with the law. YouTube turned off the uploading feature for the “Korea” country setting as the identity verification rule applied only for the users making postings.  The business enterprises and their associations should act to push back on this mandate eliminating people’s right to anonymous communication in order not to repeat the terrible episode both for Yahoo! and a Chinese dissident journalist who was sentenced to prison after Yahoo! disclosed details of his email in 2005. 

Signatories*: 

Access Now
ARTICLE 19
Bloggers Association of Kenya (Kenya)
DAKILA Philippines
Electronic Frontier Foundation (EFF)
Foundation for Media Alternatives (FMA)
Free Expression Myanmar (FEM)
Human Rights Online Philippines (HRonlinePH)
Human Rights Watch (HRW)
International Commission of Jurists (ICJ)
Life campaign to abolish the death sentence in Kurdistan
Manushya Foundation
Paradigm Initiative (PIN)
Philippine Alliance of Human Rights Advocates (PAHRA)
Public Virtue Research Institute (PVRI)
Security Matters (SecM)
Southeast Asia Freedom of Expression Network (SAFEnet)
Open Net (Korea)
Organization of the Justice Campaign