Chương III Luật Giao dịch điện tử 2023: Chữ ký điện tử và dịch vụ tin cậy

Chapter III

ELECTRONIC SIGNATURES AND TRUST SERVICES

Section 1. E-SIGNATURES

Article 22. E-signatures

1. E-signatures are classified by their scope of use, including:

a) Special-use e-signatures are e-signatures designated and used by agencies and organizations for their particular purposes according with their functions and tasks;

b) Public digital signatures are digital signatures used in public activities and secured by public digital signature certificates;

c) Civil service digital signatures are digital signatures used in civil services and secured by civil service digital signature certificates;

2. Each special-use e-signature must fully satisfy the following requirements:

a) The signature must be added to recognize the signatory and assert the signatory’s approval for the data message;

b) Data used to generate the special-use e-signature must solely accompany the approved data message;

c) Data use to generate the special-use e-signature must be under the sole control of the signatory at the point of time when the signature is added.

d) Effect of the special-use e-signature can be checked under certain conditions agreed by the parties.

3. A digital signature is an e-signature fully satisfying the following requirements:

a) The signature must be added to recognize the signatory and assert the signatory’s approval for the data message;

b) Digital signature creation data must solely accompany the approved data message;

c) Digital signature creation data must be under the sole control of the signatory at the point of time when the signature is added;

d) All changes of the data message after adding the signature are detectable;

dd) The signature must be secured by a digital signature certificate. A civil service digital signature must be secured by a digital signature certificate of a civil service digital signature authentication service provider. A public digital signature must be secured by a digital signature certificate of a public digital signature authentication service provider;

e) Signature creation device is responsible for qualifying that digital signature generation data must remain confidential, unique and protected from forgery; and data used to generate the digital signature is designed to be used only once; and it does not affect the data to be signed.

4. The use of other authentication forms excluding e-signatures by electronic means to show signatories’ approval for data messages shall comply with other regulations of relevant laws.

Article 23. Legal value of e-signatures

1. E-signatures cannot have their legal value disclaimed for the sole reason that they are expressed in the form of e-signatures.

2. Special-use qualified e-signatures or digital signatures have legal value equivalent to handwritten signatures of individuals on printed documents.

3. Where any law requires a document to be authenticated by a specific agency or organization, it will be considered that a data message has fulfilled such requirement if it is signed by a special-use qualified e-signature or a digital signature of such agency or organization.

Article 24. Civil service digital signature authentication service

1. Civil service digital signature authentication service is a digital signature authentication service in civil services.

2. Civil service digital signature certificates shall be managed and provided by civil service digital signature authentication service providers according to regulations of law on e-transactions and law on cipher.

3. Civil service digital signature authentication service providers shall:

a) Issue civil service digital signature certificates for recognition and maintenance of effect of certificates of signatories to data messages;

b) Revoke civil service digital signature certificates;

c) Inspect and maintain effect of civil service digital signature certificates; do not use technical and technological barriers to limit the effect of civil service digital signatures;

d) Provide essential information to authenticate civil service digital signatures;

dd) Link to national electronic authentication service providers to facilitate inspection of effect of civil service digital signatures;

e) Grant timestamps in civil services.

4. Civil service digital signature certificates and civil service digital signatures must satisfy technical regulations and requirements for digital signatures and digital signature authentication service according to regulations of law.

5. The Government of Vietnam shall elaborate this Article.

Article 25. Use of special-use e-signatures and special-use qualified e-signatures

1. Agencies and organizations that generate special-use e-signatures are not permitted to provide services that involve special-use e-signatures.

2. Special-use qualified e-signatures are special-use e-signatures granted special-use qualified e-signature certificates by the Ministry of Information and Communications.

3. An agency or organization which uses a special-use e-signature to conduct a transaction with another organization or individual or requests recognition of a special-use qualified e-signature shall register with the Ministry of Information and Communications to be grant a special-use qualified e-signature certificate.

4. The Government of Vietnam shall elaborate this Article.

Article 26. Recognition of foreign e-signature authentication service providers; recognition of foreign e-signatures, and e-signature certificates

1. Requirements for recognition of foreign e-signature authentication service providers in Vietnam include:

a) Providers must be legally established and operated in country in which operation has been successfully registered; have technical audit reports of e-signature authentication service systems from auditing organizations legally operated in the country in which it is registered;

b) Foreign e-signatures, and foreign e-signature certificates provided by foreign e-signature authentication service providers must satisfy technical standards and regulations on e-signatures and e-signature certificates according to regulations of Vietnamese laws or international standards that have been asserted or international treaties to which Vietnam is a signatory;

c) Foreign e-signature certificates granted by foreign e-signature authentication service providers are created on the basis of authenticated personal identifiable information (PII) of foreign organizations and individuals;

d) Foreign e-signature authentication service providers must update current status of foreign e-signature certificates on trust service authentication systems of competent authorities of Vietnam;

dd) Providers must have representative offices (ROs) in Vietnam.

2. Requirements for recognition of foreign e-signatures, foreign e-signature certificates in Vietnam include:

a) Foreign e-signatures and foreign e-signature certificates must meet technical standards and regulations on e-signatures and e-signature certificates according to regulations of Vietnamese laws or international standards that have been asserted or international treaties to which Vietnam is a signatory;

b) Foreign e-signature certificates are created on the basis of personal identifiable information (PII), which has been verified, of foreign organizations and individuals.

3. Users of foreign e-signatures and foreign e-signature certificates recognized according to Clause 2 of this Article are foreign organizations and individuals; Vietnamese organizations and individuals wishing to enter into transactions with organizations and individuals of foreign countries in which e-signatures and e-signature certificates of Vietnamese service providers have not been recognized.

4. The Ministry of Information and Communications shall elaborate the recognition of foreign e-signature authentication service providers in Vietnam; and the recognition of foreign e-signatures, and foreign e-signature certificates in Vietnam

Article 27. E-signatures and e-signature certificates of foreign nationals accepted in international transactions

1. E-signatures and e-signature certificates of foreign nationals are only accepted in international transactions if they belong to foreign organizations and individuals who are not present in Vietnam, and they are effective on data messages sent to Vietnamese organizations and individuals.

2. Organizations and individuals shall select and take responsibility for accepting e-signatures and e-signature certificates of foreign nationals on data messages to be used in international transactions.

Section 2. TRUST SERVICES

Article 28. Trust services

1. A trust service includes:

a) Timestamping service;

b) Data message authentication service;

c) Public digital signature authentication service.

2. Each trust service is a conditional business line.

3. Each trust service provider must have a service business licence granted by the Ministry of Information and Communications, except electronic contract authentication services in commerce. The provider is entitled to register one or several services prescribed in Clause 1 of this Article. Time limit of the business licence is 10 years.

Electronic contract authentication service providers in commercial transactions must satisfy e-contract authentication service provision requirements according to regulations of law on e-commerce and requirements for trust service provision according to Article 29 of this Law.

4. The Government shall elaborate operation of trust service providers; procedures, applications for issuance, extension, change, re-issuance, suspension, revocation of business licences and other contents according to regulations in this Article.

Article 29. Requirements for trust service provision

1. Requirements for trust service provision include:

a) Being enterprises which are legally established and operated in the territory of Vietnam;

b) Satisfying financial, managerial and technical requirements for each type of trust service specified in Clause 1, Article 28 of this Law;

c) Having information systems serving the trust service provision which satisfy at least information security level 3 requirements according to regulations of law on information security;

d) Having technical plans serving the provision for each type of trust service specified in Clause 1, Article 28 of this Law;

dd) Having plans for technical connections serving supervision, inspection and data reporting by electronic means, which satisfy requirements for state management of trust services.

2. The Government of Vietnam shall elaborate Clause 1 of this Article.

Article 30. Responsibilities of trust service providers

1. Publicly disclose procedures for registering use of services, forms and relevant costs.

2. Ensure 24/7 collection of information and provision of services.

3. Store applications and documents, connect and provide information and data by electronic means in accordance with regulations of law.

4. Ensure that equipment in information systems is coded and ready for technical connection serving state management of trust services.

5. Implement professional measures, suspend, stop provision of services or other professional measures at the request of competent authorities according to regulations of law.

6. Act as administrators of information system serving trust service provision which satisfy at least information security level 3 requirements according to regulations of law on information security.

7. Annually report the trust service provision according to regulations of competent authorities.

8. Pay service fees for maintaining systems for checking status of digital signature certificates according to regulations of law on fees and charges.

Article 31. Timestamping services

1. Timestamping services are services to attach information on points of time to data messages.

2. Timestamps are created in the form of digital signatures.

3. Points of time attached to data messages are points of time when timestamping service providers receive such data messages and such data messages are authenticated by timestamping service providers.

4. Time source by timestamping service providers must comply with regulations of law on national standard time source.

Article 32. Data message authentication services

A data message authentication service includes:

1. Data message storage and integrity verification service;

2. Qualified data message dispatch and receipt service.

Article 33. Public digital signature authentication service

1. Public digital signature authentication service is a digital signature authentication service in public services.

2. Public digital signature certificates shall be granted by public digital signature authentication service providers according to this Law.

3. Public digital signature authentication service providers shall:

a) Issue public digital signature certificates for recognition and maintenance of effect of certificates of signatories to data messages;

b) Revoke public digital signature certificates;

c) Inspect and maintain effect of public digital signature certificates; do not use technical and technological barriers to limit the effect of public digital signatures;

d) Provide essential information to authenticate public digital signatures;

dd) Link to national electronic authentication service providers to facilitate inspection of effect of public digital signatures;

4. Public digital signature certificates and civil service digital signatures must meet technical regulations and requirements for digital signatures and digital signature authentication service according to regulations of law.

5. The Government of Vietnam shall elaborate this Article.