Vietnam’s Ministry of Information and Communications (MIC) has been working to replace the outdated 2009 Telecom Law with a new version more suited to today’s digital economy. A draft Telecom Law was made available for public consultation from October 27 to December 27, 2022. On January 17, 2023, the MIC submitted an amended draft (the “Draft”) to the Ministry of Justice for appraisal (the Vietnamese version of the Draft and accompanying documents in the dossier can be accessed here). The Draft is scheduled to be discussed by the National Assembly in May 2023 and submitted for approval in October 2023. The key content and changes of the Draft as compared to the existing law are set out below. 1. Licensing Telecom Services For domestic enterprises, the 2009 Telecom Law only provides two types of licenses—telecom network establishment licenses and telecom service business licenses—without differentiating the conditions and licensing procedures for various types of telecom services. This no longer meets management requirements and does not encourage enterprises to participate in providing new services on already existing infrastructure. Although the Draft retains the two main types of licenses—licenses to provide telecom services with network establishment for a term of not more than 15 years; and licenses to provide telecom services without network establishment with a term of no more than 10 years—it also provides different licensing conditions for different types of telecom service provision, with three kinds of licensing: (i) individual licenses for certain enterprises with specific conditions and obligations based on telecom management objectives at the time of licensing; (ii) class licenses for businesses that meet the prescribed licensing conditions; and (iii) registration, which requires businesses only to submit registration information according to the prescribed form to be licensed. In addition, to avoid the situation of licensed telecom network enterprises

Noppparat Lalitkomon, head of Tilleke & Gibbins’ data protection team in Thailand, has prepared the Thailand contribution for the Data Privacy Trends and Topics Report, published by Lex Mundi. The report provides brief overviews of recent and upcoming regulatory and legal developments concerning data privacy in the jurisdictions of Lex Mundi member firms in 53 jurisdictions around the world. Drawing on the expertise of Lex Mundi member firms from around the world, the report features local insights to help businesses handle cross-border data and cybersecurity challenges. Lex Mundi has also compiled a global overview of how firms in each region assess the likelihood of significant changes to the data protection landscape in 2023. Notably, Asia and the Pacific is identified as the region most likely to undergo changes, with 73% of reporting firms expecting significant developments in their jurisdictions. The report containing all 53 contributions—grouped by world region—is available on the Lex Mundi website or through the button below.

Thailand has issued a Royal Decree on the Supervision of Regulated Digital Identification Authentication and Verification Service Businesses B.E. 2565 (2022) (the “Royal Decree”), aimed at regulating business operators that provide digital identification authentication and verification services (“Digital ID Services”). The Royal Decree was published in the Government Gazette in December 2022, and will take effect 180 days from the publication date, i.e., on June 21, 2023. The key details and requirements of the Royal Decree are as follows: Regulated Digital ID Services Under the Royal Decree, the provision of the following Digital ID Services requires prior approval from the Electronic Transaction Development Agency: Identity verification service – Services for collecting and identifying information relating to the identity of a person, and verifying the connections between the person and the identity. Authenticator issuance and management service – Services relating to the connection between a person who has passed the identification process with an authenticator, and managing actions which are used to identify a person. Authentication service – A process to authenticate a person by inspecting his/her authenticator. Digital ID networks/systems – Provision of networks or systems used to exchange information for digital identification purposes, excluding services provided by an intermediary. Exempted Digital ID Services The Royal Decree also specifies a list of Digital ID Services that are exempted from supervision under the Royal Decree, as follows: Issuance of certificates to support the use of electronic signatures in accordance with the Electronic Transaction Act. Digital ID Services conducted for use within the operator’s own business only, and which do not involve the provision of such services to third parties. Other Digital ID Services as prescribed by the Electronic Transaction Committee. Qualifications of Business Operators The types of business operators qualified to operate Digital ID Services include (i) private limited companies;

On January 16, 2023, Thailand’s Securities and Exchange Commission (SEC) prescribed a set of security measures that digital asset business operators must implement if they provide custody of digital assets for their customers. The new security measures are prescribed in two notifications from the SEC and its office on digital asset wallet management systems and cryptographic key management systems, with the aim of safeguarding digital assets in custody against loss, fraud, and cybertheft. The notifications took immediate effect. The new security measures and the management systems are summarized below. Policy and guidelines for managing systems related to digital asset custody Digital asset business operators must have a written risk management policy for all systems relating to digital asset custody, approved by their board of directors and made accessible to all employees. The policy must be reviewed or revised at least once annually, or promptly if any potential risks are identified. Specific procedures must be implemented, such as establishment of a compliance team and internal controls. Management of systems for digital asset wallets and cryptographic keys Digital asset business operators must have policies and procedures for managing all systems relating to digital asset custody. This includes properly designing, developing, and managing digital asset wallets in a safe and secure manner. The same requirement on policies and procedures applies to cryptographic key management as well. Management of incidents that may affect systems related to digital asset custody Digital asset business operators must have measures in place to manage incidents that may impact systems related to digital asset custody. The measures include designating a person responsible for incident management, testing and reviewing the incident management policy annually, reporting any incidents affecting digital asset custody to the designated responsible person and the SEC immediately, and conducting a digital forensic investigation with an independent