Chương III Nghị định 59/2022/NĐ-CP: Tài khoản định danh điện tử và xác thực điện tử

Chapter III

EID ACCOUNTS AND E-AUTHENTICATION

Article 14. Processes and procedures for registration of eID accounts for Vietnamese citizens

1. Below are the steps in registration of a level-1 eID account via the VNeID app that are applied to any Vietnamese citizen who is holding a chip-based ID card:

a) The applicant uses a mobile device to download and install the VNeID app.

b) The applicant opens the VNelD app to enter his/her personal ID and phone number or email address; provides information according to the instructions available on the VNeID app; takes a portrait photo using the mobile device and sends the registration request for an eID account to the electronic identification and authentication regulator via the VNeID app.

c) The electronic identification and authentication regulator sends a VNeID-app, SMS and email notification of whether the registration request is accepted or refused.

2. Below are the steps in registration of a level-2 eID account:

a) For any Vietnamese citizen who is holding a chip-based ID card:

The applicant contacts the Police of the commune, ward or town or the place where citizen ID cards are issued to register an eID account. The applicant presents his/her chip-based citizen ID card, provides information about his/her phone number or email address and requests any modified information to integrated into the eID account.

The in-charge officer receives information that the applicant provides and allows such information to be entered in the electronic identification and authentication system; takes the applicant’s portrait photo and fingerprint to have them checked against those available in the citizen ID database and confirms approval for registration for an eID account.

The electronic identification regulator sends a VNeID-app, SMS and email notification of whether the registration request is accepted or refused.

b) The Police authority proceeds to issue the level-2 eID account, and the citizen ID card if the applicant has not been issued with a chip-based citizen ID card yet.

Article 15. Processes and procedures for registration of eID accounts for foreigners

1. Below are the steps in registration of a level-1 eID account:

a) The applicant uses a mobile device to download and install the VNeID app.

b) The applicant opens the VNelD app to enter information about the number of his/her passport or international travel document or email address or phone number (if any); provides information according to the instructions available on the VNeID app; takes a portrait photo using the mobile device and sends the registration request for an eID account to the electronic identification and authentication regulator via the VNeID app.

c) The electronic identification and authentication regulator sends VNeID-app, SMS and email notification of whether the registration request is accepted or refused.

2. Below are the steps in registration of a level-2 eID account:

a) The applicant contacts the immigration department of the Ministry of Public Security or the provincial Police to register for an eID account; presents his/her passport or international travel document; provides information about his/her email address or phone number (if any); and requests any modified information to be integrated into the eID account.

b) The in-charge officer receives information that the applicant provides and allows such information to be entered in the electronic identification and authentication system; takes the applicant’s portrait photo and fingerprint to have them checked against those available in the national entry/exit database and confirms approval for registration for an eID account.

c) The immigration department sends the request for issuance of an eID account to the electronic identification and authentication regulator.

d) The electronic identification and authentication regulator sends a VNeID-app, SMS and email notification of whether the registration request is accepted or refused.

Article 16. Processes and procedures for registration of eID accounts for non-person entities

1. The requesting non-person entity’s legal representative or head (already holding a level-2 eID account) logs in for the VNeID app to register an eID account on behalf of the requesting non-person entity; provides information according to the instructions available in the VNeID app and sends an account registration request to the electronic identification and authentication regulator via the VNeID app.

2. The electronic identification and authentication regulator proceeds to verify information about the requesting entity available in the national business registration database, the national database and other specialized databases. If information about the requesting entity is not available in the national business registration database, the national database and other specialized database yet, it must verify information of the requesting entity and send a VNeID app, SMS or email notification of whether the registration request is accepted or rejected to the person acting on the requesting entity’s behalf to submit the registration request.

Article 17. Duration of processing of registration requests for eID accounts

Upon receipt of all valid request documents prescribed herein, the competent Police shall process the registration request for an eID account within the following duration:

1. For any Vietnamese citizen who is holding a chip-based ID card: The maximum duration of completion of processing of the registration requests for level-1 eID accounts and level-2 eID accounts shall be 01 and 03 working days, respectively. For any Vietnamese citizen who does not hold a chip-based ID card: 

The maximum duration of completion of processing of the registration requests for eID accounts shall be 07 working days.

2. For foreigners: The maximum duration of completion of processing of the registration requests for level-1 eID accounts shall be 01 working day; for level-2 eID accounts, if the applicant’s portrait photo and fingerprint is available in the national entry/exit database, 03 working days; for level-2 eID accounts, if the applicant’s portrait photo and fingerprint is available in the national entry/exit database, 07 working days.

3. For non-person entities:

a) The maximum duration of completion of processing of the registration requests for eID accounts shall be 01 working day if verifiable information about the requesting entity already exists in the national database or specialized databases.

b) The maximum duration of completion of processing of the registration requests for eID accounts shall be 15 working day if verifiable information about the requesting entity is not available in the national database or specialized databases.

Article 18. Activation of eID accounts

EID holders can activate their eID accounts on the VNelD app within 07 days of receipt of notifications of approval for eID account registration requests. Within 07 days after receipt of the notification, if any eID account is not activated, the eID holder must contact the electronic identification and authentication regulator via the receiver switchboard and address issues related to electronic identification and authentication requirements to activate the eID account pending activation.

Article 19. Locking and unlocking eID accounts

1. Locking Vietnamese citizen's eID accounts

a) The electronic identification and authentication system automatically remembers and locks an eID account if the eID holder makes the request for locking his/her account; the eID holder is in breach of terms of use of the VNeID app; the eID holder's ID card is revoked; the eID holder dies. The system can remember through the eID holder’s declaration made on the VNelD app or input of updated eID information into the electronic identification and authentication according to Article 10 herein.

b) If a procedure-conducting agency, competent regulatory authority or service user requests an eID account to be locked, the account locking request must be sent to the Police to seek their approval for such request.

c) Within 02 working days, the request-receiving Police’s head can approve the locking request in the case specified in point b of clause 1 of this Article, and notify this to the agency or entity making the account locking request and the eID holder. In case of rejection, a written reply with clear reasons for such rejection must be sent.

2. Locking foreigner's eID accounts

a) The electronic identification and authentication system automatically remembers and locks an eID account if the eID holder makes the request for locking his/her account; the eID holder is in breach of terms of use of the VNeID app; the eID holder's passport or international travel document is revoked; the eID holder’s residence permit expires; the eID holder dies. The system can remember through the eID holder’s declaration made on the VNelD app or input of updated eID information into the electronic identification and authentication according to Article 10 herein.

b) If a procedure-conducting agency, competent regulatory authority or service user requests an eID account to be locked, the account locking request must be sent to the Police to seek their approval for such request.

c) Within 02 working days, the request-receiving Police’s head can approve the locking request in the case specified in point b of clause 1 of this Article, and notify this to the agency or entity making the account locking request and the eID holder. In case of rejection, a written reply with clear reasons for such rejection must be sent.

3. Locking non-person entity's eID accounts

a) The electronic identification and authentication system automatically remembers and locks an eID account if the eID holder makes the request for locking its account; the eID holder is in breach of terms of use of the VNeID app; its business is dissolved or closed under law. The system can remember through the eID holder’s declaration made on the VNelD app or input of updated eID information into the electronic identification and authentication according to Article 10 herein.

b) If a procedure-conducting agency, competent regulatory authority or service user requests an eID account to be locked, the account locking request must be sent to the Police to seek their approval for such request.

c) Within 02 working days, the request-receiving Police’s head can approve the locking request in the case specified in point b of clause 1 of this Article, and notify this to the agency or entity making the account locking request and the eID holder. In case of rejection, a written reply with clear reasons for such rejection must be sent.

4. Unblocking eID accounts

a) The electronic identification and authentication automatically unlocks an eID account immediately when grounds for automatically locking that eID account no longer exist;

b) If a procedure-conducting agency, competent regulatory authority or service user requests an eID account to be unlocked, the account unlocking request must be sent to the Police to seek their approval for such request.

c) Within 02 working days, the request-receiving Police’s head can approve the unlocking request in the case specified in point b of clause 2 of this Article, and notify this to the agency or entity making the account unlocking request and the eID holder. In case of rejection, a written reply with clear reasons for such rejection must be sent.

5. Ways to request locking and unlocking of eID accounts

a) The eID holder takes the steps specified in the instructions given on the VNeID app to request locking of an eID account;

b) The requesting eID holder must contact the switchboard receiving and responding to requests related to electronic identification and authentication; provide verified information about the eID account holder to request locking or unlocking of the eID account;

c) The requesting eID holder must contact the electronic identification and authentication regulator; provide verified information about the eID account holder to request locking or unlocking of the eID account.

6. Locking or unlocking an eID account at the request of the procedure-conducting agency or competent regulatory authority

The requesting procedure-conducting agency or competent regulatory authority must sent a written request for locking or unlocking of an eID account, clearly stating locking reasons and period of time, to the equivalent-level electronic identification and authentication regulator.

Article 20. Authority to grant eID accounts and issue decisions to lock or unlock eID accounts

1. Director of the Police Department on Administrative Management of Social Order under the Ministry of Public Security shall be mandated to issue eID accounts; issue decisions on automatic locking or unlocking of eID accounts on the electronic identification and authentication system, and requests for locking or unlocking of eID accounts of central department-, equivalent- or higher-level agencies.

2. Directors of Police Sub-Departments on Administrative Management of Social Order under Police Departments of provinces and centrally-affiliated cities shall be mandated to issue decisions on eID account locking or unlocking requests filed to these Police Departments.

3. Directors of Police Divisions of districts shall be mandated to issue decisions on eID account locking or unlocking requests that the Divisions receive.

4. Directors of Police Sub-Divisions of communes shall be mandated to issue decisions on eID account locking or unlocking requests that the Sub-Divisions receive.

Article 21. Storing information in the electronic identification and authentication system

1. Information about eID accounts shall be stored permanently in the electronic identification and authentication system.

2. History of access to eID accounts shall be stored in the electronic identification and authentication system for no more than 05 years after account access.

Article 22. Getting connected and access to eID accounts created by the electronic identification and authentication system

1. In order for individuals or non-person entities to get connected to the electronic identification and authentication system, the following conditions must be satisfied:

a) Their information facilities and systems must be in place to get connected to the electronic identification and authentication system;

b) Their information systems helping in getting connected to the electronic identification and authentication system must meet level-3 or higher-level safety requirements for information systems set out by law.

2. Documentation requirements and procedures for application for connection to the system:

a) Any individual or non-person entity wishing to get connected to the electronic identification and authentication system sends the written request for connection to the electronic identification and authentication regulator, clearly stating the scope and purposes of connection, and other papers or documents evidencing satisfaction of conditions for connection set out in clause 1 of this Article.

b) Based on the connection conditions specified in clause 1 of this Article, the scope and purposes of connection of individuals or non-person entities requesting connection, the electronic identification and authentication regulator conducts site inspection and issues decisions on whether connection is permitted or not.

c) Within 30 days of receipt of the connection request, the electronic identification and authentication regulator considers issuing a decision to permit connection in writing; in case of rejection, a written response, clearly stating reasons, must be sent.

3. Getting connected to the system:

a) After receiving the written consent to connecting the electronic identification and authentication system with information systems of individuals or non-person entities, electronic authentication service providers can make connection through service contracts with these connection-requesting individuals or non-person entities.

b) Electronic authentication service providers can cease connection if these contracting individuals or non-person entities are in breach of contractual terms and conditions. Electronic authentication service providers must report on this case in order for the electronic identification and authentication regulator to notify the connection-requesting individual or non-person entity.

Article 23. Electronic authentication

1. Agencies managing specialized databases, state agencies, political organization, socio-political organizations and organizations administering public services are entitled to authenticate information can authenticate information of eID holders via agencies managing the national database, specialized databases, electronic identification and authentication system; verify eID accounts through the electronic identification and authentication system.

2. Individuals or non-person entities other than those defined in clause 1 of this Article can request electronic authentication service providers to verify that their eID accounts are created by the electronic identification and authentication system and remain in use when they are applying to implement administrative procedures, public administration services and other transactions in cyberspace. Electronic authentication service providers reserve their right to refuse to verify ID information of eID holders and other information about eID account holders, unless otherwise decided by the Minister of Public Security.

Authenticating eID accounts at the request of individuals or non-person entities other than those specified in clause 1 of this Article shall be bound by terms and conditions of service contracts with electronic authentication service providers. eID account authentication must be subject to approval from eID holders.

3. Ministers, heads of quasi-ministries, People's Committees of provinces and centrally-affiliated cities in charge of the national database and specialized databases shall provide guidance on authentication of information of eID holders available in the respective database under their control.

Article 24. Levels of eID account authentication

1. Level 1: Authenticate an eID account by a single factor of authentication defined in clause 9 of Article 3, and by a means of authentication defined in clause 10 of Article 3 herein, except biometric data.

2. Level 2: Authenticate an eID account by two different factors of authentication defined in clause 9 of Article 3, and by a corresponding means of authentication defined in clause 10 of Article 3 herein, except biometric data.

3. Level 3: Authenticate an eID account by two or more different factors of authentication defined in clause 9 of Article 3, and by a corresponding means of authentication defined in clause 10 of Article 3 herein, including a biometric datum.

4. Level 4: Authenticate an eID account by checking factors of authentication, including portrait photo and fingerprint, against data available in the ID card or the citizen ID database or the national entry/exit database.

Article 25. E-authentication methods for use in services performed via the electronic identification and authentication system

1. With respect to online services, the e-authentication process shall be carried out through means of authentication whose levels of safety are required by providers of these online services.

2. Authentication of account information administered at the places where services are rendered shall be carried out by employing authentication solutions available in the VNeID app.