Chương III: Nghị định 69/2024/NĐ-CP Dịch vụ xác thực điện tử

Chapter III

E-AUTHENTICATION SERVICES

Article 22. E-authentication services 

1. The e-authentication service is classified as a conditional business line.

2. E-authentication service providers shall meet the conditions set out in Article 23 herein and must seek to obtain the certificate of conformance to e-authentication service business regulations.

3. E-authentication service providers shall be responsible for listing their e-authentication services and products in the e-identification webpage.

Article 23. Conditions for eligibility to provide e-authentication services

1. Organization and enterprise conditions

In order to be eligible to provide e-authentication services, e-authentication service providers must be public service providers; enterprises under the control of People’s Public Security forces.

2. Personnel conditions

a) As an e-authentication service provider, the head of an organization or the legal representative of an enterprise must be a Vietnamese citizen permanently residing in Vietnam;

b) As an e-authentication service provider, the organization or enterprise must employ personnel holding at least undergraduate degrees in information security or information technology or telecommunication electronics majors to be in charge of providing services; running and administering their system; maintaining security for the entire system.

3. Conditions related to facilities, technical equipment and processes for management of provision of services and security or emergency response plans

In order to apply for a certificate of eligibility to provide e-authentication services, the organization or enterprise must have a service scheme, including action plan and process for provision of e-authentication services, including explanations about the information technology system; interpretation of the technical plan in the technological solution aspect; plan for storage, assurance of data integrity, security and safety of the service-providing system; plan for protection of data of individual and organization; security plan; plan for fire safety, response to emergencies, maintenance of stable and smooth working condition of e-authentication services; technical equipment shall be located in Vietnam and inspected for information safety and security according to regulations of law.

4. The e-authentication service provider is entitled to authorize another organization to provide some services, including provision of advice, introduction and response to problems about e-authentication services; find partners, negotiate and agree on contents related to operations and utilities of provision of authentication services; provide support and care for service users and do other trade promotion activities according to regulations of law. The authorization shall comply with regulations of law;

Article 24. Applications and procedures for application for certificates of conformance to e-authentication service business regulations

1. An application includes:

a) Application form for a certificate of conformance to e-authentication service business regulations according to Form No. XT01 in the Appendix enclosed with this Decree;

b) Full texts of the service scheme and documents proving satisfaction of conditions specified in Clause 2, Clause 3 Article 23 of this Decree.

2. Time limit and procedures for processing:

a) The applicant submits 01 application specified in Clause 1 of this Article in person; by post to the Ministry of Public Security; online through the national public service portal or the public service portal of the Ministry of Public Security;

b) If the application is inadequate or invalid, within 03 working days from the date of receipt of the application, the Ministry of Public Security shall send a written notification of any necessary modification to the applicant;

c) Within 03 working days from the date on which the valid application is received, the Ministry of Public Security shall proceed to conduct a survey on opinions of relevant ministries or quasi-ministries;

d) Within 10 working days from the date of receipt of the written request for opinions from the Ministry of Public Security, these ministries or quasi-ministries must conduct inspection and appraisal and send their responses;

dd) Within 30 days of receipt of all required valid documents, the Ministry of Public Security shall conduct the site inspection at the applicant’s office and issue the applicant with the certificate of conformance to e-authentication service business regulations by completing Form XT03 given in Appendix hereto to the accredited applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

Article 25. Reissuance of or revision to certificates of conformance to e-authentication service business regulations

1. Revision to the certificate of conformance to e-authentication service business regulations can be permitted if there is any change in one of the particulars of legal representative, office address, transaction name, plan and process approved by the Ministry of Public Security in accordance with Clause 3 of Article 27 herein.

2. In order to do so, the applicant must submit an application for revision to the certificate of conformance to e-authentication service business regulations to the Ministry of Public Security in accordance with point a of Clause 2 of Article 24 herein. The application includes:

a) Application form for replacement of, revision to the certificate of conformance to e-authentication service business regulations according to Form No. XT02 in the Appendix enclosed with this Decree;

b) Legal documents proving information changes according to regulations in Clause 1 of this Article.

3. If the applicant wishes to change one of the data about their legal representative, office address or transaction name, within 10 days from the date of receipt of the valid application, the Ministry of Public Security shall carry out appraisal; issue the certificate of conformance to e-authentication service business regulations to the accredited applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

4. If the applicant wishes to change one of the data about the plan and process for provision of e-authentication service specified in Clause 3 Article 23 of this Decree, within 30 days of receipt of the valid application, the Ministry of Public Security shall conduct the review and the survey on opinions from relevant ministries or quasi-ministries; carry out the site inspection and issue the certificate of conformance to e-authentication service business regulations to the accredited applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

5. Another certificate of conformance to e-authentication service business regulations shall be re-issued if the previous one is lost or damaged. Procedures for reissuing the certificate of conformance to e-authentication service business regulations shall be followed as follows:

a) In order to do so, the applicant must submit an application for reissuance of the certificate of conformance to e-authentication service business regulations to the Ministry of Public Security in accordance with point a of Clause 2 of Article 24 herein. The application for reissuance of the certificate is composed of: application form for replacement of, revision to the certificate of conformance to e-authentication service business regulations; full texts of the service scheme and documents proving satisfaction of conditions specified in Clause 2, Clause 3 Article 23 of this Decree;

b) Within 03 working days of receipt of the valid application, the Ministry of Public Security shall consider reissuing another certificate of conformance to e-authentication service business regulations to the applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

Article 26. Revocation of certificates of conformance to e-authentication service business regulations

1. E-authentication service provider's certificate of conformance to e-authentication service business regulations is revoked in the following cases:

a) It has not operated for at least six consecutive months;

b) It is dissolved or bankrupt as per law;

c) It fails to remedy violations against regulations on protection of personal data, cybersecurity at the request of the competent state agency.

2. The Ministry of Public Security may issue its decision on revocation of certificates of conformance to e-authentication service business regulations by completing the application form XT04 given in Appendix hereto.

3. The e-authentication service provider that has its certificate of conformance to e-authentication service business regulations revoked shall have the burden of protection of legitimate rights and interests of the eID holder and relevant parties in accordance with law.

Article 27. Costs and expenses incurred from issuance and use of eID accounts and use of e-authentication services 

1. Any eID holder that is a Vietnamese agency, organization, citizen or a foreigner shall be exempted from paying costs and expenses incurred from registering and using eID accounts created by the electronic identification and authentication system and using their eID accounts for electronic transactions.

2. Any organization or individual using e-authentication services shall pay costs and expenses to e-authentication service providers in accordance with law on prices.

3. State agencies, political organizations and socio-political organizations are not required to pay costs and expenses when using e-authentication services.