National Assembly deputies discussed draft laws on electronic identification and authentication and on data security on 4 November, with the Public Security Minister defending the privacy safeguards and a delegate warning that biometrics alone are no longer enough. Thanh Niên and VnExpress reported the debate.

Public Security Minister Luong Tam Quang told the Assembly that the e-identification draft sets out in Article 7 who can be given an electronic identity, and that people and organisations would not have to provide information again to create one. He said the draft builds in several layers of privacy protection: minimal data collected with the owner's consent, no sharing of transaction content, and no sharing of authentication results beyond what is allowed. Detailed rules on collecting and using the data would follow in government regulations.

Under the draft, people using online accounts for securities, telecoms, banking, postal services, e-commerce, medical care and other risky or legally important activities would have to authenticate with the national e-identity and link those accounts. On the data security bill, the minister said a five-level data risk scale, matched to the five levels of information systems under the Cybersecurity Law, is its pillar.

Pham Trong Nhan, a member of Ho Chi Minh City's development research board, said biometrics are still necessary but cannot be the only protection as AI makes fake faces and voices easy. He said banks had matched biometrics against more than 175 million personal customer records by 24 October, and that international reports show one in five biometric fraud attacks uses a deepfake. He cited a Thanh Hoa police case in June in which a ring selling nearly 1,000 bank accounts used videos made from owners' photos to defeat banks' biometric checks.

"We already have a key hanging outside the door and the law makes it the master key," he said. Level-3 authentication under the draft needs at least two factors, one of them biometric.

Mr Nhan also said the draft does not make clear who must prove what in a dispute and argued that, if a person promptly reports unauthorised use of their identity, an authentication result should not by itself count as proof the owner made the transaction. He recommended mandatory level-3 authentication for high-risk transactions.

Both drafts are still before the Assembly.

Sources

This story was compiled by the Da Nang Voice news desk from the published sources listed above. Facts, figures and quotes are attributed to those sources; Da Nang Voice did not conduct interviews for it unless the text says so. Corrections are dated and noted at the top of the story. Read our corrections policy. Spotted an error? Tell us.