Vision & Associates
 |
| Vietnamese citizens aged full 14 years or older who have been issued ID cards or whose citizen ID cards remain valid will be granted level-1 or level-2 e-ID accounts__Photo: VNA |
On June 25, the Government issued Decree 69/2024/ND-CP, regulating electronic identification and authentication (Decree 69), which will take effect from the beginning of July and replace Decree 59/2022/ND-CP dated September 5, 2022 (Decree 59).
With highlighted novel points, Decree 69 expands the scope of regulation and subjects of application. Accordingly, the new Decree applies not only to Vietnamese agencies, organizations and citizens as well as foreign organizations and individuals residing and operating in Vietnam’s territory like those specified Decree 59, but also to foreign organizations and individuals directly engaged in or related to electronic identification and authentication (EIA), and electronic identity (e-ID).
New definitions
Compared to Decree 59, the new Decree adds some new terms and modifies some others. Specifically, the term “electronic identity subjects” is now added to include also “agencies”. Decree 69 adds the term “means of authentication”, which is defined as methods that allow users to perform e-authentication, including not only a password, secret code, barcode, terminal device, device or single-use password software, cryptographic equipment or software, identity card (ID card), citizen identification card (citizen ID card), passport, face image, and fingerprints as specified in Decree 59, but also voice, iris or other tools and methods used for e-authentication purpose.
At the same time, the new regulation amends some definitions mentioned in Decree 59. It defines electronic identification account (e-ID account) as a collection of login names, passwords or other means of authentication created by the EIA management agency, which may be used to access and use features, utilities and applications of the EIA system and the information system already connected and shared in accordance with law.
The term of e-authentication is redefined as activities of authenticating, confirming, affirming, certifying or providing e-ID, e-ID account or other information belonging to the National Population Database, the Identity Database and the National Immigration Database through the EIA system and platform.
Meanwhile, authentication factor is defined as a means of authentication which may be used to accurately certify and confirm the e-ID subject before proceeding with the access to and exploitation of information in the EIA system.
Under Decree 69, the “VNeID” application on digital devices is renamed as national identification application, collectively referring "dinhdanhdientu.gov.vn" and "vneid.gov.vn" as e-identification website. These are utilities created and developed by the Ministry of Public Security from the EIA system to perform EIA activities in settling administrative procedures, public administrative services and other transactions in the electronic environment; and develop features, utilities and applications to serve agencies, organizations and individuals.
Electronic identity of individuals
The new Decree’s provisions on e-ID of foreigners remain almost unchanged as compared to Decree 59 (which includes identification number of a foreigner; surname, middle name and first name; date of birth; gender; citizenship; number, symbol, date and place of issuance of passport or international travel document; face image; and fingerprints). Decree 69 only makes it more specific that a foreigner's identification number is the unique sequence of natural numbers established by the EIA system to manage his/her e-ID. Worthy of note, the new Decree removes the provisions on e-ID of Vietnamese citizens.
Electronic identity of agencies and organizations
As specified in Decree 69, e-ID information of an agency or organization includes not only: identification number; name, including name in Vietnamese, abbreviated name (if any) and name in a foreign language (if any); date of establishment; and head office address of the agency or organization as mentioned in Decree 59 but also other information details, such as tax identification number (if any); enterprise identification number (if any); e-ID code (if any); full name and personal identification number (or foreigner's identification number) of the legal representative or head of the agency or organization who performs procedures for applying for an e-ID account for the agency or organization. Of these details, the identification number of an agency or organization is a unique sequence of natural numbers established by the EIA system to manage the e-ID of such agency or organization.
Electronic identification accounts
Grant of electronic identification accounts
The new Decree gives more specific provisions on the grant of e-ID accounts as follows:
- Vietnamese citizens aged full 14 years or older who have been issued ID cards or whose citizen ID cards remain valid will be granted level-1 or level-2 e-ID accounts;
- Vietnamese citizens aged between full 6 years and under 14 years who have been issued ID cards will be granted level-1 e-ID accounts or level-2 e-ID accounts on demand;
- Vietnamese citizens aged under 6 years who have been issued ID cards will be granted level 1 e-ID accounts on demand;
- Foreigners aged full 6 years or older who have been issued cards for permanent residence or temporary residence in Vietnam will be granted level-1 e-ID accounts or level-2 e-ID accounts on demand;
- Foreigners aged under 6 years who have been issued cards for permanent residence or temporary residence in Vietnam will be granted level 1 e-ID accounts on demand; and,
- Agencies and organizations established or registered to operate in Vietnam will be granted e-ID accounts regardless of level.
Use of electronic identification accounts
The new Decree adds new provisions on the use of e-ID accounts and other e-transaction accounts created by agencies, organizations and individuals, saying that level-1 e-ID accounts of Vietnamese citizens and foreigners may be used to access, exploit and use information about e-ID and some features, utilities and applications of the EIA system and information systems already connected and shared in accordance with law.
Meanwhile, level-2 e-ID accounts of Vietnamese citizens may be used to access, exploit and use e-ID cards; information other than the information already included in e-ID cards that is shared, integrated and updated from national databases and specialized databases and all features, utilities and applications of the EIA system and information system already connected and shared in accordance with law.
For level-2 e-ID accounts of foreigners and e-ID accounts of agencies and organizations, they may be used to access, exploit and use e-ID information and other information that is shared, integrated and updated from national databases and specialized databases and all features, utilities and applications of the EIA system and information system already connected and shared in accordance with law.
Decree 69 further clarifies the provisions on the use of e-transaction accounts. It stipulates that agencies, organizations and individuals may create e-transaction accounts in accordance with the law on e-transactions in order to serve their transactions and activities and are responsible for authenticating and ensuring the accuracy of accounts they create, and decide on level and use value of each level of accounts. Information used to create an e-transaction account must be provided by the account holder and the account holder agrees to permit the concerned agency, organization or individual to use such information for creating such account.
Representatives and guardians may use e-ID accounts of persons aged under 14 years, wards and principals to carry out transactions and other activities to serve the latter’s rights and interests.
If wishing to use e-ID accounts, persons aged under 14 years old, wards and principals are required to obtain the consent of or certification by their representatives or guardians through the national identification application.;
The EIA management agency shall connect, share and authenticate data for e-ID subjects to use their e-ID accounts in other countries under treaties to which Vietnam is a contracting party.
The new Decree also contains more comprehensive provisions on the probative value of e-ID information and e-ID account information. Specifically, information about e-ID and information included in e-ID cards and e-ID accounts has the probative value and is equivalent to the provision of information or use and presentation of papers and documents containing such information in performance of administrative procedures, public services, transactions and other activities. The use of e-ID accounts and e-authentication services is legally valid to confirm and prove that the e-ID subject has conducted and approved the transaction.
Locking/unlocking and activation of e-ID accounts
The new Decree has more detailed provisions on processes, procedures and authority to grant, lock and unlock e-ID accounts for Vietnamese citizens, foreigners, agencies and organizations. However, the time limit for granting e-ID accounts remains unchanged compared to Decree 59.
The new regulation requires e-ID subjects to activate their e-ID accounts on the national identification application within seven days after receiving a notice of results of grant of e-ID accounts. Upon the expiration of such time limit, if an e-ID account is not activated, the e-ID subject is required to contact the EIA management agency through the hotline for receipt and resolution of requests for EIA in order to have its/his/her e-ID account activated.
Information storage in the EIA system
The new Decree retains the period of information storage in the EIA system specified in Decree 59. It states that all information about e-ID and e-ID cards and other information included in e-ID accounts are permanently stored in the EIA system.
Electronic identity cards, electronic authentication
Decree 69 defines, for the first time, e-ID card as a feature or utility of the national identification application through logging in e-ID accounts that is granted together with a level 2 e-ID account to a Vietnamese citizen. The use of e-ID cards by logging in citizens’ level-2 e-ID accounts is equivalent to the use of valid ID cards or citizen ID cards in performance of administrative procedures, public services, and other transactions and activities. The Decree also specifies the order and procedures for granting, locking and unlocking e-ID cards.
Conditions and procedures for electronic authentication
Decree 69 adds new provisions, stating that e-authentication for e-ID and e-ID accounts is carried out through the EIA system and platform. Organizations and individuals not belonging to state agencies, political organizations, socio-political organizations and public service providers may request e-authentication through services of e-authentication service providers.
The e-authentication for e-ID and e-ID accounts as requested by organizations and individuals may be carried out after obtaining the consent of e-ID subjects through making confirmation on the national identification application or SMS via the subscribers’ phone numbers or in other forms of confirmation specified by law.
Organizations and individuals may not provide or share e-authentication results to/with other organizations or individuals, unless otherwise prescribed by the law on personal data protection. E-authentication results may not be used as authentication factors in other transactions.
Authentication levels of e-ID accounts
The new Decree retains Decree 59’s provisions on four authentication levels of e-ID accounts, specifically as follows:
Level 1: E-ID account authentication is based on an authentication factor and relevant means of authentication without biometric information.
Level 2: E-ID account authentication is based on two different authentication factors and relevant means of authentication without biometric information.
Level 3: E-ID account authentication is based on two or more different authentication factors and relevant means of authentication, including one biometric information item.
Level 4: E-ID account authentication is based on authentication factors, including at least one biometric factor (face image, fingerprints, voice, iris), at least one factor owned by the e-ID subject (ID card, digital device, software) and one factor known by the e-ID subject (password; secret code; two-dimensional barcode).
Electronic authentication services
The new Decree continues to define e-authentication services as a conditional business line. Organizations providing these services must satisfy statutory conditions and be certified by the Ministry of Public Security as eligible for providing e-authentication services. It retains the provisions of Decree 59 regarding conditions for providing e-authentication services but additionally requires e-authentication service providers to display the list of e-authentication products and services they provide on the e-identification website.
In addition, e-authentication service providers may entrust other organizations to perform a number of activities in accordance with law. These activities include: providing consultancy on, introducing and answering questions about e-authentication services; seeking partners, negotiating and agreeing on contents related to activities and utilities providing authentication services; supporting and caring for service users, and other trade promotion activities.-
