Chương IV Nghị định 59/2022/NĐ-CP: Dịch vụ xác thực điện tử

Chapter IV

E-AUTHENTICATION SERVICES

Article 26. E-authentication services

1. The e-authentication service is classified as a conditional industry.

2. E-authentication service providers are obliged to meet the conditions set out in Article 27 herein and must seek to obtain the certificate of conformance to e-authentication service business regulations.

3. Agencies, non-person entities and individuals creating eID accounts according to clause 3 of Article 13 herein shall not comply with the regulations laid down in Article 27, 28, 29 and 30 herein.

Article 27. Conditions for eligibility to provide e-authentication services

1. Organization and business conditions

In order to be eligible to provide e-authentication services, e-authentication service providers must be state-owned public or government service units; businesses under the control of People’s Public Security forces.

2. Personnel conditions

a) As an e-authentication service provider, the head of a non-person entity or the legal representative of a business must be a Vietnamese national permanently residing in Vietnam.

b) As an e-authentication service provider, the non-person entity or business must employ personnel holding at least undergraduate degrees in information security or information technology or telecommunication electronics majors to be in charge of providing services; running and administering their system; maintaining security for the entire system.

3. Conditions related to technical expertise, processes for management of services and security or emergency response plans

In order to apply for certificates of eligibility provide e-authentication services, non-person entities and businesses must have their service scheme including the following documents:

a) Action plan and process for provision of e-authentication services, including explanations about the information technology system; interpretation of the technical plan in the technological solution aspect; the plan for storage, assurance of data integrity, security and safety of the service providing system; the plan for protection of data of individuals and non-person entities; the security plan; the plan for fire safety, response to emergencies, maintenance of stable and smooth working condition of e-authentication services;

b) Introduction brochures about their machinery and devices in Vietnam satisfying regulatory fire safety requirements; resistant to flood, inundation, earthquake, electronic interference or unauthorized human access.

Article 28. Documentation requirements and procedures for application for certificates of conformance to e-authentication service business regulations

1. What documents to be submitted:

a) Application form XT01 given in Appendix hereto;

b) Full texts of the service scheme, enclosing the description sheet prescribed in clause 3 of Article 27 herein.

2. Certificate-issuing procedures, duration and approaches:

a) The applicant submits 01 set of documents specified in clause 1 of this Article directly; by post to the Ministry of Public Security; online through the national public service portal or the public service portal of the Ministry of Public Security;

b) If any of the documents specified in clause 1 of this Article is missed or invalid, within 03 working days after submission, the Ministry of Public Security must send a written notification of any necessary modification to the applicant.

c) Within 03 working days from the day on which valid documents are received, the Ministry of Public Security proceeds to conduct a survey on opinions of relevant ministries or quasi-ministries; within 10 days of receipt of the written request for opinions from the Ministry of Public Security, these ministries or quasi-ministries must send their responses;

d) Within 30 days of receipt of all required valid documents, the Ministry of Public Security conducts the site inspection at the applicant’s office and issues them with the certificate of conformance to e-authentication service business regulations by completing Form XT03 given in Appendix hereto to the accredited applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

Article 29. Reissuance or replacement of certificates of conformance to e-authentication service business regulations

1. Revision of the certificate of conformance to e-authentication service business regulations can be permitted if there is any change in one of the particulars about legal representative, office address, transaction name, plan and process approved by the Ministry of Public Security in accordance with clause 3 of Article 27 herein.

In order to do so, the applicant must submit one set of documents to apply for revision of the certificate of conformance to e-authentication service business regulations to the Ministry of Public Security in accordance with point a of clause 2 of Article 28 herein. Documents to be submitted to apply for revision of the certificate are composed of the followings: Application form XT02 given in Appendix hereto; documents evidencing information changes.

a) If the applicant wishes to change one of the data about their legal representative, office address or transaction name, within 10 days of receipt of all required valid documents, the Ministry of Public Security conducts the inspection; issues the certificate of conformance to e-authentication service business regulations to the accredited applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent;

a) If the applicant wishes to change one of the data about the plan and process for provision of e-authentication service, within 30 days of receipt of all required valid documents, the Ministry of Public Security conducts the review and the survey on opinions from relevant ministries or quasi-ministries; carries out the site inspection and issues the certificate of conformance to e-authentication service business regulations to the accredited applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent;

2. Reissuing another certificate of conformance to e-authentication service business regulations if the previous one is lost or damaged:

a) In order to do so, the applicant must submit one set of documents to apply for revision of the certificate of conformance to e-authentication service business regulations to the Ministry of Public Security in accordance with point a of clause 2 of Article 28 herein. Application documents for certificate reissuance are composed of: Application form XT02 given in Appendix hereto;

d) Within 30 days of receipt of the completed application form, the Ministry of Public Security considers reissuing another certificate of conformance to e-authentication service business regulations to the applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

Article 30. Revocation or withdrawal of certificates of conformance to e-authentication service business regulations

1. E-authentication service provider's certificate of conformance to e-authentication service business regulations is revoked in the following cases:

a) As an e-authentication service provider, the non-person entity or business has not operated for at least six consecutive months;

b) It is dissolved or bankrupt as per law;

c) Its service is ceased;

d) It violates law on data privacy and cybersecurity.

2. The Ministry of Public Security may issue its decision on revocation of certificates of conformance to e-authentication service business regulations by completing the application form XT04 given in Appendix hereto.

3. The e-authentication service provider in question shall have the burden of protecting legitimate rights and interests of eID holders and related parties or stakeholders in accordance with law.

Article 31. Costs and expenses incurred from issuing and using eID accounts and using e-authentication services

1. Any eID holder that is a Vietnamese agency, non-person entity or citizen shall be exempted from paying costs incurred from registering and using eID accounts created by the electronic identification and authentication system.

2. Any non-person entity or individual using e-authentication services shall pay fees and charges to e-authentication service providers in accordance with law.