Protecting personal data: Account authentication will not require ID

According to the draft Law on Personal Data Protection (DLCN), social network service providers are not allowed to request images or videos containing full or partial citizen identification (CCCD) content as a factor for account authentication. This is one of the notable provisions mentioned in the draft Law on Personal Data Protection submitted by Deputy Prime Minister Le Thanh Long on behalf of the Government to the National Assembly at the 9th session of the 15th National Assembly.

Clear notification is required.

According to the draft, social network service providers must clearly notify the content of DLCN collected when data subjects install and use social networks and online communication services; do not illegally collect DLCN and do not collect DLCN outside the scope of the agreement with customers. In particular, social networks are not allowed to request images or videos containing full or partial identity card, CCCD, or citizen identification card content as a factor in account authentication. Social networks also need to specifically and clearly notify in writing about sharing DLCN as well as apply security measures when carrying out advertising and marketing activities based on customers' DLCN.

According to Deputy Prime Minister Le Thanh Long, the development of the Law on Protection of DLCN aims to perfect the legal system on DLCN protection, create a legal corridor for protection work, promote the lawful use of DLCN to serve socio-economic development...

In fact, the regulation that social networks are not required to provide ID cards to authenticate accounts has received the approval of many users in the context of increasing risks of information security. A newly published report on the information security risks in Vietnam by Viettel Cyber ​​Security shows that in 2024, the number of leaked information and businesses increased sharply with 14.5 million exposed accounts, accounting for 12% of the total number of cases globally. Of which, Facebook ranked first with more than 4.8 million exposed accounts, Twitter (now X) with more than 958,000 exposed accounts, followed by public service platforms, banks... Worryingly, many personal information and business documents have been publicly sold on online platforms. According to a survey by the National Cyber ​​Security Association, the total damage caused by online fraud in 2024 is estimated at VND 18,900 billion.

Social network Facebook is asking users to provide citizen identification to verify their accounts.

Ms. Nguyen Thi Kim Hoa, an office worker in District 1 (HCMC), shared that this regulation is very necessary to protect people. Sometimes, just a little carelessness can lead to personal information being revealed, which is very dangerous for fraud. "However, if not authenticated by CCCD, how will the platforms manage virtual accounts, when fake news and impersonation are still rampant?" - Ms. Hoa wondered. Mr. Tran Van Hau (Binh Thanh District, HCMC) said that many users are forced to provide sensitive information for fear of having their accounts locked, while it is unclear how that data will be stored and processed. "Not authenticating CCCD is a good way to limit the risk of disclosure, but there needs to be an effective alternative solution to control virtual accounts" - Mr. Hau expressed.

Using mobile subscriber identification

According to records, many social networking platforms such as Facebook and Zalo are requiring users to provide their ID cards to authenticate their accounts, in order to control fake accounts and ensure compliance with community regulations. This new regulation is agreed by many experts and is believed to contribute to strengthening the protection of DLCN and user privacy.

According to Mr. Le Hong Duc, founder of OneAds Digital Company, the above regulation is a positive signal in the context of increasingly complex DLCN leaks. However, stopping authentication by CCCD needs to be accompanied by strong enough alternative measures to avoid creating loopholes for fake accounts, impersonation or fraudulent behavior.

Mr. Duc suggested that it is possible to utilize the mobile subscriber identification system - which has been authenticated by the network operator - as an effective authentication tool. At the same time, it is necessary to build a coordination mechanism between the network operator - platform - management agency to detect and prevent violations.

Users also need to be vigilant when providing CCCD information for promotions, winning prizes or online shopping, as this could be a source of data leaks from outside social networks. "For cross-border platforms, there is currently no legal representative in Vietnam. Management agencies need to build a legally binding mechanism to ensure that these platforms fully comply with domestic DLCN protection regulations," Mr. Duc suggested.

From a legal perspective, lawyer Truong Van Tuan, Head of Trang Sai Gon Law Office, assessed that the regulation that social networks are not required to provide ID cards to authenticate accounts will help enhance privacy because users do not have to provide sensitive information that can be easily disclosed or abused. At the same time, this regulation does not cause difficulties for authorities because social networks can still authenticate users via phone numbers (identified by ID cards). This method still ensures tracing and handling of violations when necessary without violating privacy.

Lawyer Tuan said that according to Decree 147/2024/ND-CP on management, provision and use of internet services and online information, people are only required to authenticate their social media accounts with their own mobile phone numbers in Vietnam. Only if they fall into one of the following two cases will they be required to authenticate their social media accounts with their CCCD (i.e. personal identification number), including users who do not have a phone number in Vietnam and users who use the livestream feature for commercial purposes. However, current laws do not have specific regulations on the elements that constitute the buying and selling of DLCN, especially activities involving the intermediary of many individuals and organizations, making it difficult to prove the crime.

Need to specify regulations, increase deterrence

According to lawyer Truong Van Tuan, in the current situation of widespread trading and leakage of DLCN, the absence of sanctions or sanctions that are not strong enough or not sufficiently deterrent will not resolve the situation. Therefore, in addition to technical verification measures, violations need to be specified in regulations to have appropriate and sufficiently deterrent measures.

Source: https://nld.com.vn/xac-thuc-tai-khoan-se-khong-can-can-cuoc-19625050621111055.htm