Decree 147 expands government control over access to information on the internet for vaguely defined reasons of “national security” and “social order”.
This statement was originally published on hrw.org on 10 December 2024.
Authorities further tighten access to information, free expression
The Vietnamese government should repeal a draconian new decree tightening control of internet use and the 2018 Law on Cybersecurity, Human Rights Watch said today. The regulation, which undermines access to information and freedom of expression in Vietnam, goes into effect on December 25, 2024.
In November, the Vietnamese government issued Decree 147 to regulate the use and provision of internet services and online information. It expands government control over access to information on the internet for vaguely defined reasons of “national security” and “social order,” and to prevent transgressions of Vietnam’s “morals, beautiful customs, and traditions.” The authorities have extensively misused such objectives to repress political dissent. The decree requires social media platforms providing services to users in Vietnam to store user data, provide it to the authorities on demand, and take down anything the authorities consider “illegal content” within 24 hours.
“Vietnam’s new Decree 147 and its other cybersecurity laws neither protect the public from any genuine security concerns nor respect fundamental human rights,” said Patricia Gossman, associate Asia director at Human Rights Watch. “Because the Vietnamese police treat any criticism of the Communist Party of Vietnam as a national security matter, this decree will provide them with yet another tool to suppress dissent.”
Decree 147 requires “foreign organizations, enterprises and individuals” to verify users’ accounts via their phone numbers or their personal identification number, thus exposing dissidents, who have tended to post anonymously, to a risk of arrest.
Article 23 of the decree requires “foreign organizations, enterprises and individuals” that provide cross-border information use data storage services in Vietnam, or have 100,000 visits from users in Vietnam to:
- Store Vietnam users’ personal data, including their names, birth dates, and phone numbers, if they register their accounts, and provide it on demand to the Ministries of Information and Communications, and of Public Security, and other authorities.
- Monitor, inspect, block, and remove information, services, or apps that violate article 8 of the Law on Cybersecurity, which broadly prohibits any online criticism or opposition to the government, or other laws, within 24 hours upon receiving requests from these ministries or other authorities and within 48 hours upon receiving complaints from users in Vietnam.
- Ensure that only accounts verified through their phone number or identification number can publish (post, comment, or livestream) and share information.
- Provide search and content scanning tools upon request from the Ministries of Information and Communications and of Public Security.
- Temporarily suspend individual accounts, community pages, groups, or channels that frequently publish violating content. After three suspensions, they will be shut down permanently.
If foreign organizations, enterprises, and individuals do not adequately comply with these regulations, Vietnamese authorities have threatened to carry out “technical measures,” such as completely blocking content, services, or apps and carrying out “administrative punishments” to enforce the laws.
Decree 147 includes other problematic provisions. Article 6 requires owners of public internet access points, such as at hotels, restaurants, airports, and other public spaces, to prevent internet users from carrying out “propaganda against the state.” The decree does not stipulate what these owners must do to prevent such acts, nor what punishment would apply to them if such acts occur.
As a prerequisite for registering all .vn domain names, article 9 of the decree requires the “exclusion of any phrases that violate national interests” and “phrases that can be easily mistaken for a press agency or press product if the registered users is not a press agency” and that they be “in accordance with social morality.”
Article 36 requires “all account users, content channel owners, and community group administrators on social media not to name the account, the page, the channel, the group the same names or similar names with a press agency, nor to name them with terms (in Vietnamese or in foreign languages) that may be mistaken for a press agency or carry out the work of a press agency, including words such as: newspaper, radio, magazine, news, information, broadcast, television, communication, media, news agency, etc.” It also requires administrators of community pages or groups or channels “to remove contents that violate law” within 24 hours upon receiving requests from the Ministries of Information and Communications, and of Public Security, and other authorities.
Decree 147 fails to meet international human rights standards in many respects, Human Rights Watch said. International standards require that any restrictions on the right to free expression must be necessary to pursue a legitimate aim and be formulated with sufficient precision to allow individuals to regulate their conduct accordingly.
International human rights standards provide that access to user data be authorized by an independent authority, which considers on a case-specific basis whether the request is necessary and proportionate and subject to challenge and redress. Decree 147’s enhanced enforcement measures for Vietnam’s Law on Cybersecurity, including sweeping rapid removal orders, are of particular concern as the underlying law already fails to meet international human rights standards.
Decree 147 is the latest in a series of laws and decrees to restrict internet use and access in Vietnam. In 2018, Vietnam passed the highly problematic Law on Cybersecurity, which prompted nationwide protests, to which police responded with excessive force. In 2024, Freedom House listed Vietnam as a country with no freedom on the internet.
In 2024, government-controlled Vietnamese courts convicted and sentenced at least 36 critics to long prison terms because of posts or livestreams they had made on internet platforms criticizing government actions or policies. All were charged with “conducting propaganda against the state” under article 117 or “abusing freedom and democracy to infringe upon the interests of the state” under article 331 of Vietnam’s penal code.
Vietnam has volunteered to host the signing ceremony in 2025 for the United Nations Convention against Cybercrime. This deeply problematic convention is poised to become an unprecedented tool for surveillance and cross-border cooperation on a range of crimes, without adequate human rights safeguards. Vietnam’s track record of cracking down on online dissent makes it a fitting host for the cybercrime convention’s signing ceremony, Human Rights Watch said.
“Vietnam should repeal the rights-violating Decree 147 and Law on Cybersecurity, and release everyone imprisoned for exercising their free speech rights on the internet,” Gossman said. “Vietnam’s leaders should treat freedom of expression as a basic human right to be upheld, not throttled.”
