Decree No. 106/2011/ND-CP dated November 23, 2011 of the Government amending and supplementing a number of articles of the government's Decree No. 26/2007/ND-CP of February 15,2007, detailing the e-transaction law regarding digital signatures and digital signature certification services

DECREE

AMENDING AND SUPPLEMENTING A NUMBER OF ARTICLES OF THE GOVERNMENT'S DECREE NO. 26/2007/ND-CP OF FEBRUARY 15,2007, DETAILING THE E-TRANSACTION LAW REGARDING DIGITAL SIGNATURES AND DIGITAL SIGNATURE CERTIFICATION SERVICES

-----------------------

THE GOVERNMENT

Pursuant to the December 25, 2001 Law on Organization of the Government;

Pursuant to the November 29, 2005 Law on E~ Transactions;

Pursuant to the July 2, 2002 Ordinance on Handling of Administrative Violations;

At the proposal of the Minister of Information and Communications,

DECREES:

Article 1. To amend and supplement a number of articles of the Government's Decree No. 26/2007/ND-CP of February 15, 2007, detailing the E-transaction Law regarding digital signatures and digital signature certification services

1. To replace Clause 5, Article 3 with the following:

"5. Public digital signature means a digital signature created by a subscriber using a digital certificate granted by a public certification authority to that subscriber. Special-use digital signature means a digital signature created by a subscriber using a digital certificate granted by a specialized certification authority to that subscriber. Foreign digital signature means a digital signature created by a subscriber using a foreign digital certificate."

2. To amend and supplement Point d, Clause 1, Article 6 as follows:

"d/ Assuming the prime responsibility for, and coordinating with the Ministry of Public Security and the Government Cipher Committee in, managing certification authorities, covering the grant of licenses, certificates of qualification for special-use digital signature safety, and papers of recognition of foreign digital signatures and certificates; supervision, inspection and handling of violations; and other necessary activities."

3. To amend and supplement Clause 2, Article 9 as follows:

"2. The digital signature is created with the use of a private key corresponding to the public key indicated in the digital certificate issued by the Root Certification Authority or a public certification authority or a specialized certification authority which has obtained a certificate of qualification for special-use digital signature safety, or by a foreign certification authority recognized in Vietnam."

4. To replace Article 10 with the following:

"Article 10. Contents of digital certificates

A digital certificate issued by the Root Certification Authority or a public certification authority or a specialized certification authority which has obtained a certificate of qualification for special-use digital signature safety must contain the following contents:

1. The name of the certification authority.

2. The name of the subscriber.

3. The serial number of the digital certificate.

4. The validity duration of the digital certificate.

5. The public key of the subscriber.

6. The digital signature of the certification authority.

7. Restrictions on purposes and scope of use of the digital certificate.

8. Restrictions on legal liability of the certification authority.

9. Other necessary contents as prescribed by the Ministry of Information and Communications."

5. To replace Clause 3, Article 15 with the following:

"3. Personnel conditions:

Having technicians, managers, operators, security officers and customer service officers who meet requirements on professional operations and scope of provision of services and have no criminal records."

6. To replace Article 16 with the following:

"Article 16. License application dossiers A dossier of application for a license to provide public digital signature certification services shall be made in six sets (2 originals and 4 copies), each comprising:

1. The enterprise's application for a public certification license.

2. The enterprise's business registration certificate or investment certificate, stating its business line of providing e-signature certification services.

3. The enterprise's organization and operation charter.

4. A document proving satisfaction of the financial conditions specified in Clause 2, Article 15 of this Decree.

5. A scheme on service provision with the following principal contents:

a/ The business plan, covering the servicing scope and target customers; service quality standards; and the financial plan;

b/ The technical plan to ensure compliance with Clause 4 of Article 15;

c/ The certification regulation;

d/ Judicial record cards No. 2, and diplomas of the enterprise's personnel directly engaged in the provision of certification services."

7. To amend and supplement Clause 2, Article 18 as follows:

"2. A dossier of request for change of license contents shall be made in six sets (2 originals and 4 copies), each comprising a written request for change of license contents; a copy of the valid license; a report on operation; details of the change and reasons for such change."

8. To replace Clause 2, Article 21 with the following:

"2. Enclosed papers, including:

a/ For individuals: a valid copy of the identity card, passport or another lawful personal certification paper;

b/ For organizations: a valid copy of the establishment decision or business registration certificate or a document of equivalent validity; a letter of authorization and a valid copy of the identity card, passport or another lawful personal certification paper of the authorized representative of the organization."

9. To amend and supplement the title of Section 1, Chapter VI as follows:

"CONDITIONS AND PROCEDURES FOR CERTIFICATION OF OPERATION REGISTRATION OF SPECIALIZED CERTIFICATION AUTHORITIES"

10. To amend and supplement the title of Article 46 as follows:

"Article 46. Process and procedures for certification of operation registration of specialized certification authorities"

11. To amend and supplement Clause 6, Article 47 as follows:

"6. A specialized certification authority may request the Ministry of Information and Communications to grant a certificate of qualification for special-use digital signature safety to guarantee safety of digital signatures under Article 9 of this Decree. The conditions and procedures for granting certificates of qualification for special-use digital signature safety comply with Articles 48, 49 and 50 of this Decree."

12. To amend and supplement the title of Section 2, Chapter VI as follows:

"CONDITIONS AND PROCEDURES FOR GRANTING CERTIFICATES OF QUALIFICATION FOR SPECIAL-USE DIGITAL SIGNATURE SAFETY"

13. To replace Article 48 with the following:

"Article 48. Conditions for obtaining certificates of qualification for special-use digital signature safety

A specialized certification authority may obtain a certificate of qualification for special-use digital signature safety only when meeting the personnel, technical and other conditions specified in Clauses 3, 4 and 5, Article 15 of this Decree."

14. To replace Article 49 with the following:

"Article 49. Dossiers of application for certificates of qualification for special-use digital signature safety

A dossier of application for a certificate of qualification for special-use digital signature safety shall be made in six sets (2 originals and 4 copies), each comprising:

1. An application for a certificate of qualification for special-use digital signature safety.

2. The establishment decision and operation charter of the authority.

3. The service provision scheme, covering:

a/ The servicing scope and target customers;

b/ The technical plan to ensure compliance with Article 48 of this Decree;

c/ The certification regulation;

d/ Judicial record cards No. 2 and diplomas of the authority's personnel directly engaged in the provision of certification services."

15. To replace Article 50 with the following:

"Article 50. Verification of dossiers and grant of certificates of qualification for special-use digital signature safety

Within 60 working days after receiving a dossier of application for a certificate of qualification for special-use digital signature safety, the Ministry of Information and Communications shall assume the prime responsibility for, and coordinate with the Ministry of Public Security, the Government Cipher Committee and related ministries and sectors in, verifying the dossier and conducting field inspection. If the dossier satisfies the conditions on service provision specified in Article 48 of this Decree, the Ministry of Information and Communications shall grant a certificate of qualification for special-use digital signature safety to the applying authority. In case of failure to satisfy those conditions, the Ministry of Information and Communications shall issue a notice clearly stating the reason."

16. To replace Article 51 with the following:

"Article 51. Rights and obligations of specialized certification authorities possessing certificates of qualification for special-use digital signature safety

A specialized certification authority possessing a certificate of qualification for special-use digital signature safety has the following rights and obligations:

1. To issue regulations on operations, rights and obligations of involved parties in compliance with related laws and principles of the legal system of Vietnam.

2. To make reports on a periodical basis or at the request of competent state agencies.

3. To submit to competent state agencies' supervision, inspection and handling of violations.

4. To provide necessary information according to the legal process and procedures for legal procedure-conducting or security bodies for assurance of information security or for criminal investigation, prevention and control.

5. In cases of emergency provided by the law on the state of emergency or in order to maintain national security, a specialized certification authority possessing a certificate of qualification for special-use digital signature safety shall render all necessary assistance at the request of competent state agencies."

17. To replace Article 53 with the following:

"Article 53. Dossiers of application for papers of recognition of foreign digital signatures and certificates

A dossier of application for a paper of recognition of foreign digital signatures and certificates shall be made in six sets (2 originals and 4 copies), each comprising:

1. The foreign certification authority's request for recognition of its foreign digital signatures and certificates.

2. Documents proving satisfaction of all the conditions specified in Clauses 1 and 2, Article 52 of this Decree."

18. To amend and supplement Clause 1, Article 61 as follows:

"1. Public and specialized certification authorities possessing certificates of qualification for special-use digital signature safety are subject to the Ministry of Information and Communications' annual inspection of their observance of this Decree. Inspection results shall be posted on the website of the Ministry of Information and Communications."

19. To amend and supplement Article 62 as follows:

1. To amend and supplement Point b, Clause 1, Article 62 as follows:

"b/ Certificates of qualification for special-use digital signature safety."

2. To amend and supplement Clause 3, Article 62 as follows:

"3. A fine of between VND 10,000,000 and VND 20,000,000 shall be imposed for one of the following acts:

a/ Erasing or modifying contents of a certificate of qualification for special-use digital signature safety;

b/ Buying, selling, transferring, leasing, lending, renting or borrowing a certificate of qualification for special-use digital signature safety;

c/ Providing untruthful information and documents for the purpose of registering operation or applying for a certificate of qualification for special-use digital signature safety."

20. To amend and supplement Point c, Clause 6, Article 66 as follows:

"c/ Certification authorities with the Ministry of Information and Communications' licenses to provide public digital signature certification services or certificates of qualification for special-use digital signature safety failing to base their certification equipment systems in Vietnam."

21. To amend and supplement Clause 2, Article 69 as follows:

"2. Revocation of licenses to provide public digital signature certification services or certificates of qualification for special-use digital signature safety or papers of recognition of foreign digital signatures and certificates, for any violations specified at Points b and c, Clause 2 of Article 62; Point d, Clause 2 of Article 63; Article 64; and Point b, Clause 2, and Points a, c and d, Clause 3 of Article 66, of this Decree."

Article 2. To replace the phrase "Ministry of Post and Telemetric" with the phrase "Ministry of Information and Communications" in Decree No. 26/2007/ND-CP of February 15, 2007, detailing the E-transaction Law regarding digital signatures and digital signature certification services.

Article 3. Implementation provisions

This Decree takes effect on February 1, 2012.

Ministers, heads of ministerial-level agencies, heads of government-attached agencies and chairpersons of provincial-level People's Committees shall implement this Decree.-