On April 15 of this year, Decree No. 15/2020/ND-CP will come into effect which stipulates penalties for administrative violations in the fields of postal services, telecommunications, radio frequency, information technology and electronic transaction (Decree 15). The new legal framework is expected to bring tighter control over the acts of posting, sharing and spreading fake news on social media.

 Fake news control under the Cybersecurity Law

Vietnam’s Cybersecurity Law (“Cybersecurity Law”), which has taken effect for over a year, prohibits, among other things, providing false information, causing confusion among the people, causing harm to socio-economic activities, causing difficulties for authorities and those performing their duty, or violating the legal rights and benefits of other organizations and individuals throughout any form of activities on cyber space. The Cybersecurity Law grants competent government authorities to monitor information on Cybersecurity that is distributed within the country.  Among its provisions are the requirements that both foreign and domestic online service providers store personal data of Vietnamese end-users in Vietnam, surrender such data to Vietnamese government authorities upon request, and supervise user posts to remove prohibited content. For example, the Vietnam Government said Facebook was responsible to implement measures for removal of the slanderous content about Government which was allowing to remain on the platform. Regarding the Government’s concerns, Facebook have cooperated and take down politically undesirable content.

Despite a strong governance system has been established under the Cybersecurity Law, especially to increase control on social media service providers, there is no specific sanction against violations of social media service users to implement these strict legislations. The Government thus started to build a legal framework in order to handle the spread of fake news and toxic information on social media.

Prohibition of fake news on end users under Decree 15

In response to the legislative needs under the Cybersecurity Law, the government recently issued Decree 15 which provides administrative sanctions on the end users in relation to fake news.

Pursuant to Article 101 of Decree 15, a penalty ranging from VND 10 to 20 million will be imposed for violations of publishing and spreading false information on social media which can be fabricated to harm dignity and honour of individuals or offend the reputation of the government agencies and organizations. The similar punishment will be imposed for violations of publishing and spreading false information on social media that causes public concern or induce violence and crime.

Under the forthcoming governance on online service users in compliance with the Cybersecurity Law and the Decree 15, the Government is likely to enforce these legislations to take down any undesirable “fake news” on social media. Therefore, the users will have to think twice before publishing and spreading, sharing a post) their view that might be considered “fake news” by the competent authorities. For simple instance, service users would be punished even in case they just share a Facebook post on their time line that turns out to be “fake news” later.

Incompatibility between the Cybersecurity Law and the EU General Data Protection Regulation

The EU regulation 2016/679 of the European Parliament and of the Council was adopted on 27th of April 2016 and relates to the protection of natural persons with regard to the processing of personal data and on the movement on such data and repealing directive 95/46/EC (GDPR). It came into force on the 25th of May 2018.

Generally, in accordance with the GDPR, processing personal data is prohibited, unless it is expressly allowed by law, or the data subject has consented to the processing. The GDPR’s main goal is to strengthen data privacy by giving users greater control over their personal data. In particular, the GDPR aims to provide a greater solution to fight against falsehoods by limiting access to personal information of users, which is essential to disinformation campaigns.

The GDPR is one of fundamental basis for EU lawmakers’ human rights concerns in their consideration on the EU Vietnam Free Trade Agreement (EVFTA). During this trade deal, EU raised some concerns about Vietnam’s past record on human rights and political freedoms, the concerns also about the Cybersecurity Law that the legislation could restrict political rights and civil liberties online.

Under the Cybersecurity Law, the Vietnam Government has been granted powers to require social media platforms in Vietnam to identify their users if necessary, that might create an incompatibility with the GDPR. In particular, by contrast, in accordance with Article 6.1.e of the GDPR, processing of personal data would be lawful if “the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”, and “the basis for the processing shall be laid down by: Union law; or Member State law to which the controller is subject”. Therefore, as a number of social media platforms providers in Vietnam have been regulated by both regulations (GDPR and Cybersecurity Law) at the same time.

How do we know what is the truth and the need to protect the whistle-blower?

In short, internet users are encouraged to understand that the truth and distorted facts exist simultaneously on social medias and no one knows how to reverse that trend. However, in reality, the falsehood and its following online disinformation is often really inaccurate and frequently malicious.

Although intervention from the Government is necessary, especially in controlling of content and imposing punishment, the Government also needs to protect the truth with negative contents that sometimes might seem to be offensive and unconventional, e.g. the coronavirus whistle-blower – Li Wenliang, a Wuhan doctor who was punished for telling truth about coronavirus in the early days of the disease outbreak. Reportedly, Li gave out such caution because the outbreak happened in a hospital that was close to the seafood market and this fact is quite similar to the cases of SARS. However, he was summoned by police and had been reprimanded for “rumor mongering” about the coronavirus which had already killed more than 3,174 people at the time.

In Vietnam’s current legislation, whistleblowing or denunciation is mainly handled in accordance with the Constitution of Vietnam where the right of denunciation is recognized as a fundamental right of citizens. It is also regulated by the Law on Denunciation that provides for protection of denunciators and management of denunciation settlement work and the Anti-Corruption Law. In combination, those provisions mostly focus on the repression of corruption and does not really concern other general interests or public safety. To better grasp the matter of public security, general provision on the denunciation and whistleblowing are necessary but up until now, not many countries have updated their legislation with such content.


This LBN newsletter are NOT legal advice. Readers are advised to retain a qualified lawyer, should they wish to seek legal advice. VCI Legal are certainly among those and happy to be retained, yet VCI Legal is not to be hold responsible should any reader choose to interpret/apply the regulations after reading this LBN without engaging a qualified lawyer.