The 2nd plenary session of the 16th legislature continued on October 26 in Hà Nội. — Photo from the National Assembly

HÀ NỘI — A new Law on Electronic Identification and Authentication has been officially tabled for reviews by the parliament, with a view to strengthen cybersecurity, crack down on anonymous SIM cards and fake accounts, and prevent increasingly sophisticated biometric fraud using artificial intelligence.

Minister of Public Security Lương Tam Quang presented the draft law to the National Assembly on Monday, during the ongoing 2nd plenary session of the 16th legislature.

The proposed legislation aims to establish a comprehensive legal framework for creating, managing and using electronic identities in state management, electronic transactions and the development of the digital economy and society.

It also seeks to expand identification beyond individuals to encompass physical and non-physical entities, including vehicles, locations, goods, real estate, digital assets, databases, software, digital services, events and transactions.

Presenting the proposal, Minister Quang said the expansion from personal identification to the identification of a broader range of entities was an urgent requirement in the current management environment.

The law would provide a secure and reliable framework for electronic identification and authentication, helping prevent cybercrime, eliminate anonymous SIM cards and fake accounts, combat online scams and counter sophisticated biometric impersonation enabled by AI.

Eight chapters, six key policy areas

The draft comprises eight chapters and 46 articles, covering general provisions, electronic identification, authentication, the national identification and authentication system, service provision, international cooperation, rights and responsibilities, and implementation.

Its six main policy areas include defining the entities subject to electronic identification, establishing identification models, developing the national identification and authentication system, regulating authentication methods, setting conditions for service providers, and facilitating cross-border recognition of electronic identities.

The draft identifies five main groups of entities eligible for electronic identification: agencies, organisations and individuals; products, goods and physical assets; databases, digital files, images, audio, videos, applications, software and digital services; events, transactions and acts; and locations and spaces.

It also prohibits the use of fake biometric data, artificially generated images and other technological fraud to create or falsify electronic identities. The draft provides for the recording, tracing and auditing of identification and authentication activities, alongside accountability requirements.

The proposed identification system would comprise the National Database on Electronic Identification and Authentication, an electronic identification and authentication platform, the national identification application VNeID, a system for managing the validity of electronic identities and certificates, and a national electronic identification and authentication portal.

Related information systems would be connected to the system to support state management, public services and socio-economic development.

The draft also establishes three authentication models: centralised, intermediary and independent authentication. It would require electronic identities to be linked and authenticated for digital-platform transactions in certain sectors.

Organisations seeking to provide electronic identification and authentication services would have to meet requirements covering legal status, financial capacity, technical systems, information technology infrastructure, specialised personnel, operational procedures, user data protection, cybersecurity, system connectivity and liability insurance.

Cross-border recognition and digital trade

The proposed law would provide a legal basis for the mutual recognition of foreign electronic identities and authentication results for cross-border transactions.

According to the Government, standardised data and identification frameworks would help Vietnamese businesses meet international market requirements, including the European Union's Digital Product Passport requirements.

The legislation is also intended to protect the provenance of domestic goods, address barriers to trade and improve Việt Nam's competitiveness in global supply chains.

The draft was developed in line with the country's policies on digital government, the digital economy and the protection of human rights in the digital environment. It also seeks to reduce transaction and compliance costs for individuals and businesses while creating greater flexibility for innovation.

Lawmakers raise privacy and feasibility concerns

In its appraisal report, the National Assembly's Committee on National Defence, Security and External Affairs agreed on the need for the legislation, saying it would consolidate existing regulations, address shortcomings in implementation and provide a foundation for trusted digital identification.

However, the committee highlighted several issues requiring further consideration, particularly the protection of personal data and privacy, the feasibility of identifying a wider range of entities, and the technical and financial resources needed to implement the system.

Some opinions argued that the proposed scope of electronic identification was too broad and called for a clearer distinction between entities that must be identified and those for which identification would be encouraged.

Concerns were also raised over the risk of information leaks involving entities containing state secrets or business secrets, as well as the practicality of identifying non-physical entities such as digital files, applications, events and acts.

Regarding electronic identity information, some opinions called for a clearer legal framework specifying which data fields could be collected. They proposed that the Government establish limits on data collection and technical standards, in line with the principle of collecting only the minimum information necessary.

On identity linkage, some opinions recommended making it compulsory only for transactions where sector-specific legislation requires it. The scope and level of linkage should be proportionate to the purpose of management and the risk associated with each transaction, they said.

The committee also supported allowing qualified organisations to provide electronic identification and authentication services, but called for minimum technical standards and common data standards to ensure interoperability and avoid fragmented investment.

It further recommended clarifying providers' legal responsibilities and compensation mechanisms in cases involving data leaks or inaccurate identification and authentication.

The committee concluded that the draft law's documentation had been prepared in accordance with legal requirements and that the bill was eligible for consideration by the National Assembly at its second session. — VNS