Vietnam's New Cybersecurity Law Will Hurt Economic Growth -Tác giả David Shear

The passage of a restrictive cybersecurity law by Vietnam’s National Assembly is a giant step back—one that comes at the expense of Vietnam’s small and medium-sized businesses.

As U.S. Ambassador to Vietnam from 2011 to 2014, I would console myself when faced with a diplomatic setback that Vietnam has always achieved progress by taking two steps forward and one step back. However, the passage of a restrictive cybersecurity law by Vietnam’s National Assembly is a giant step back—one that comes at the expense of Vietnam’s small and medium-sized businesses (SMBs) in particular.

In May 2017, the Vietnamese Government released an ambitious directive to guide the country through the Fourth Industrial Revolution (4IR). Directive 16, as it is officially known, instructed government agencies to improve Vietnam’s competitiveness by leveraging digital and communications technology. It warned against falling behind in the development of digital capabilities and exhorted government agencies to “enable people and enterprises to easily and fairly grasp the opportunities for digital content development.”

The directive assessed the information and communication technology (ICT) sector’s significant potential contribution to Vietnam’s economy accurately. Vietnam’s GDP growth topped 6.8 percent last year, supported by a buoyant internet economy and foreign direct investment. According to a recent study by Temasek and Google, the internet economy increased from $3.3 billion to $5.7 billion between 2015 and 2017. E-commerce is also a particularly promising sector. The Ministry of Industry and Trade has also reported that Vietnam’s e-commerce retail sales growth in 2016-20 will reach 20 percent per year.

Hence, the National Assembly’s June 12 passage of the new cybersecurity law was a surprising blow to this positive trajectory. The law undermines the huge potential of Vietnam’s ICT sector. It establishes sweeping prohibitions on internet content deemed threatening to the Vietnamese state or society. It requires that foreign firms providing ICT services to Vietnamese consumers establish representative offices in-country. Most worryingly, it also requires those firms to store Vietnamese users’ data within Vietnam’s territory. The new law turns Vietnam into a silo at a time when Vietnamese firms, especially SMBs, must access global markets and technology. Under the 4IR, businesses must become more data-driven to stay competitive, using social media, e-commerce, and cloud computing to bolster productivity. But under strict data localization requirements, they cannot access the best data and cloud computing services the world has to offer. SMBs, which account for 98 percent of all businesses in Vietnam, will suffer disproportionately because of their limited capacity to mitigate regulatory setbacks. For instance, a Leviathan Security Group study found that data localization can increase a small firm's costs of computing by 30 to 60 percent.

It’s no surprise that implementation of the new law could have significant negative consequences for Vietnam’s economy. In 2014, the European Center for International Political Economy (ECIPE) estimated that full data localization measures would reduce Vietnam’s GDP growth by 1.7 percent per year. These measures would also likely reduce domestic investment by 3.1 percent. That’s why concerned Vietnamese industry associations have publicly joined international data service providers in expressing dismay over the new law.