Law on Electronic Identification and Authentication - To ensure objective reality without deception

Identification - establishing the identity of all objects in real life and the digital environment

One of the notable advancements in the draft Law is the significant expansion of the scope of objects to be identified. According to Article 7, the objects to be identified include not only agencies, organizations, and individuals, but also products, goods, assets, data, software, digital applications, intellectual property rights, events, transactions, actions, places, and spaces.

This is a significant development, representing a shift from a mindset primarily focused on identifying people to one that identifies objects in the digital economy, society, and environment. This approach aligns with the requirements for building a digital government, digital economy, digital society, and modern national governance.

The significance of this regulation is immense. An identified product can be linked to traceability information, production and distribution processes; an identified asset can be linked to its owner, legal status, and history of changes; an identified transaction can identify the parties involved, the time of execution, and legal responsibilities; an identified event can provide a basis for verifying the time, place, and related parties.

In particular, Articles 8 and 9 of the draft stipulate the model and activities of electronic identification, creating a legal basis for the implementation of identification for each target group. Articles 10, 11, 12, and 13 further specify the registration, collection, verification, standardization of information, creation, and issuance of identification codes. These are important regulations that contribute to the formation of an organized, unified, and interconnected identification system.

Thus, identification is not simply about assigning a number or creating an electronic account. It is the process of establishing the identity of an individual, creating a foundation to distinguish one individual from another, and limiting confusion, impersonation, and substitution in social relationships.Electronic authentication – a crucial tool for protecting truth in the digital age.

If the identifier answers the question of who or what the object is, then authentication answers the question of whether the object matches the established identity.

This is a particularly important issue in the current context. An individual's identity can be impersonated; a product's origin can be misrepresented; a transaction can be altered; an image or video can be created using artificial intelligence but presented as a real event. Without a reliable authentication mechanism, stakeholders in society will struggle to distinguish accurate information from fake information.More worryingly, when misinformation is deliberately fabricated, widely disseminated, and repeated, it can alter public perception of an event, a person, or a social issue. This is the risk of replacing objective reality with realities fabricated in the digital environment.

The draft law dedicates Chapter III to regulating electronic authentication, creating a link between identification and authentication within a unified legal framework.

Accordingly, Article 21 specifies the subjects of electronic authentication; Article 22 specifies the model for implementing authentication activities; Article 23 defines electronic authentication activities; and Article 24 regulates the receipt of requests and the identification of authentication subjects. In particular, Article 25 specifies three levels of electronic authentication, providing a basis for selecting the appropriate level of assurance based on the nature and requirements of each activity.

Articles 26, 27, and 28 continue to regulate the selection of means, inspection of means, and recording and storage of electronic authentication results. Article 29 defines the value of electronic authentication and the use of authentication results, thereby creating a legal basis for agencies, organizations, and individuals to use authentication results in transactions and management activities.

The draft law's relatively comprehensive regulations on the model, methods, levels, processes, and value of electronic authentication represent a significant step forward. These regulations contribute to the formation of a reliable identity verification mechanism, reducing the risk of impersonation, fraud, and illegal use of identity.

Ensuring integrity and traceability – preventing information tampering

One of the key values ​​of electronic identification and authentication is the ability to record, manage, and retrieve information about an entity throughout its existence, movement, and participation in social relationships.

Article 14 stipulates the storage of electronic identities, requiring that information be stored completely, consistently, and not be illegally altered throughout the management and use process. Article 15 regulates information updating; Article 16 regulates the exploitation and use of electronic identities.

These regulations are crucial in ensuring that identification data is managed continuously, accurately, and is valid. Articles 17, 18, and 19 stipulate the suspension, restoration, and termination of the validity of electronic identities and identification codes.

These regulations help establish the legal status of electronic identities at any given time, limiting the misuse of invalid identities for illegal transactions or activities.Article 20 on electronic identity linking further establishes the basis for defining relationships between identified entities. This is a crucial element in modern social management, as entities do not exist in isolation but always have relationships concerning ownership, use, transactions, and legal responsibilities.

Article 30 stipulates the use of electronic certificates to verify information, and Article 31 stipulates the use of electronic identity verification and tracing. These regulations provide a basis for verifying information and tracing identities when necessary, supporting state management activities, resolving disputes, and handling violations.

As can be seen, the draft Law has formed a relatively synchronized series of regulations, from identity creation, identification code issuance, storage, updating, exploitation, linking to authentication, recording results and tracing. This is a crucial legal foundation to ensure the ability to identify and verify objects in the digital environment.

When an object is identified, related information is systematically managed and changes are recorded, limiting the possibility of falsifying the object's identity, origin, and legal status. This is a particularly important value of the law in protecting the authenticity of social relations.

Building a unified, modern, and secure electronic identification and authentication infrastructure

Another highlight of the draft Law is that it has established a relatively comprehensive legal basis for the construction, management, operation, and exploitation of the Electronic Identification and Authentication System.

Article 32 stipulates the construction of the system, identifies its components, and requires ensuring the ability to connect, share, and synchronize data. Article 33 stipulates the collection, updating, and synchronization of data into the National Database on Electronic Identification and Authentication. Articles 34 and 35 stipulate the exploitation and use of electronic identification and authentication data.

These regulations are crucial in addressing the problem of scattered and inconsistent data, facilitating the access of information by agencies and organizations within their jurisdiction, and providing more convenient services to citizens and businesses.

In particular, the draft Law clearly demonstrates the requirement to ensure data security and safety. Article 4 establishes the principles of electronic identification and authentication, emphasizing the protection of state secrets, cybersecurity, data security, and the protection of personal data. Article 6 stipulates prohibited acts such as appropriating, buying, selling, renting, lending, or illegally using electronic identities; interfering with, disrupting, or interrupting systems; impersonating identities; and falsifying information.

These are necessary regulations to ensure that the electronic identification and authentication system not only operates effectively but also safely and reliably, protecting the legitimate rights and interests of participating entities.

Electronic identification and authentication – a crucial foundation for protecting national security

In the digital age, data has become a strategic resource and a subject that needs to be protected from national security threats. Therefore, the Law on Electronic Identification and Authentication is not only significant for administrative reform, the development of the digital economy and digital society, but also contributes to building the national digital security infrastructure, enhancing the capacity to prevent, detect, and handle acts of forgery and fraud in the electronic environment.

Article 5 outlines the State's policy on electronic identification and authentication, emphasizing investment in infrastructure development, research, technology application, and system security and safety. Articles 40, 41, and 42 stipulate the responsibilities of state agencies and service providers, as well as the rights and obligations of electronic identity subjects, thereby establishing a mechanism for defining responsibilities in the management, operation, and use of the system.

In particular, Article 43 stipulates the responsibilities when using artificial intelligence in electronic identification and authentication activities. This is a new point with profound practical and timely significance, keeping pace with the trends of modern science and technology. Including artificial intelligence within the scope of regulation shows that the draft Law has addressed new issues arising from technological development, while also requiring risk control, ensuring transparency, accountability, and responsibility of entities using the technology.

These regulations contribute to the formation of an important legal basis for preventing the misuse of technology to impersonate individuals, falsify information, and commit acts that infringe upon the legitimate rights and interests of organizations and individuals, the interests of the State, and national security.

A significant step forward in perfecting the national governance system in the digital age

Overall, the draft law represents a significant step forward in legislative thinking and policy design. The enactment of this law stems not only from the need to reform administrative procedures and improve the efficiency of state management, but also from the urgent demands of practice: building a digital society capable of accurately identifying entities, verifying identities, tracing origins, and curbing fraudulent activities and information manipulation. This is a crucial step towards protecting the truth and public trust, ensuring that objective reality is not distorted in the digital age.

Hong Nhung