You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

November 15, 2024

Changes to Domain Name Dispute Resolution Under Vietnam’s New Internet Decree

Vietnam’s new Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (“Decree 147”), which will come into effect on December 25, 2024, replacing Decree No. 72/2013/ND-CP (“Decree 72”), introduces several changes to the regime for domain name dispute resolution. The new decree aims to clarify the legal framework and address some longstanding inconsistencies between Vietnam’s laws on intellectual property and information technology.

The main changes related to domain name dispute resolution under Decree 147 are summarized below.

Removal of Prescriptive Actions

Decree 147 no longer lists specific actions for resolving domain name disputes. Decree 72 had outlined three methods: negotiation/mediation, arbitration, and court. However, IP practitioners had long criticized this approach, arguing it conflicted with the IP Law, which additionally allows administrative action.

By omitting these methods, the new decree implies an acceptance of administrative action as provided in the IP Law. However, Decree 147 remains silent on establishing a dispute resolution forum aligned with the CPTPP’s requirement for a UDRP-like model. Currently, Vietnam’s available forums do not fully conform to the UDRP framework. An anticipated circular may provide further guidance on this aspect.

Deactivation of Domain Names

Decree 72 does not have any provision on the deactivation of a domain name. However, Decree 147 has stipulated some situations where domain names will be deactivated, such as when there is a request from an authority, or when it is discovered that incorrect information was used for registration.

Clearer Criteria for Dispute Resolution

Article 16 of Decree 147 sets out three clear criteria that must be met for domain name dispute resolution to proceed: (i) confusing similarity with the plaintiff’s trademark, trade name, or personal name; (ii) the defendant’s lack of legitimate rights or interests in the domain name; and (iii) bad faith.

Previously, Decree 72’s broader list of elements led to potential misinterpretation, suggesting that proving any single element (such as confusing similarity) might suffice to justify domain name cancellation. By clarifying these elements, Decree 147 resolves this ambiguity and represents a significant improvement in legal clarity.

Formalizing Domain Name Freezing During Proceedings

Decree 147 also formalizes the freezing of disputed domain names during proceedings, a practice briefly mentioned in Decree 72 that was previously regulated by ministerial circulars. Decree 147 gives VNNIC (Vietnam Internet Network Information Center) the obligation to lock domain names at the request of authorities; as a government-issued decree, this carries greater regulatory weight than a ministerial circular. Practical challenges may persist, especially in civil lawsuits, where domain name freezing requires a preliminary injunction. Such injunctions are rarely granted in IP cases in Vietnam; in fact, only one preliminary injunction has been issued since the IP Law took effect in 2005.

Enforcement of Judgment

Decree 147 formally addresses the process for domain name transfer or cancellation following a successful dispute resolution. Under the new rule, the plaintiff has a 45-day grace period after the judgment’s effective date to register the domain name. After this period, the domain name will become available for public registration.

This provision conflicts, however, with the Law on Enforcement of Civil Judgments, which grants plaintiffs a five-year window to enforce judgments. Given that enforceable judgments are often delayed—particularly in cases involving foreign respondents, where judgments may be delayed by over a year—the 45-day period may be impractical.

This timeline also differs from the UDRP model, which mandates domain name transfer to the complainant within 10 days of a decision without further action.

Lack of Effective Remedies

Decree 147 does not introduce new remedies beyond domain name cancellation and re-registration within the 45-day window. In cases where the complainant seeks a transfer, VNNIC may require additional documentation, including agreements, VAT invoices, and transfer prices—requirements that complicate the dispute resolution process unnecessarily.

While Decree 147 represents progress, it falls short of resolving the fundamental issues arising from overlaps between the IP Law and IT Law. For example, courts handling disputes under the IP Law may award legal fees, whereas such recovery is not permitted under the IT Law. Additionally, the decree’s mention of “unfair competition” as proof of bad faith overlaps with existing IP Law provisions (under Article 130.1(d)) on domain name disputes.

Moving forward, Vietnam may consider unifying its domain name dispute resolution framework under a UDRP-based model. Such a unified regime would simplify the process and better protect brand owners’ rights in Vietnam’s digital economy. In the coming time, the Ministry of Information and Communications is expected to issue a circular to provide further guidance on domain name dispute resolution. This anticipated circular may help bridge gaps and offer more detailed instructions on handling domain disputes under both legal frameworks.

A version of this article appeared in Managing Intellectual Property.

RELATED INSIGHTS​ 

May 15, 2024
On May 1, 2024, Thailand’s National Cyber Security Committee (NCSC) published the draft NCSC Notification Re: Cloud Cybersecurity Standards for a public hearing period, which was open until May 14, 2024. These standards have been drafted to drive the country’s cloud-first policy with the aim of minimizing risks from cyber threats to cloud services utilized by government agencies, supervising or regulating organizations, and critical information infrastructure (CII) organizations. The key points of the draft Cloud Cybersecurity Standards are below. Scope The standards apply to government agencies, supervising or regulating organizations, and CII organizations under the Cybersecurity Act B.E. 2562 (2019), as well as cloud service providers (defined below). The standards prescribe cloud system cybersecurity measures for cloud service customers (defined below) and providers only to the extent that the service is provided to the in-scope organizations outlined above. Definitions Cloud service customers (CSCs): In-scope organizations that have a formal contractual agreement to use cloud services provided by a cloud service provider. Cloud service providers (CSPs): Persons who enable cloud services to be used by a cloud service customer, responsible for maintaining infrastructure, platforms, and software that enable provision of the cloud services and for managing these resources to ensure their accessibility, security, and scalability for their cloud service customers. Application In-scope organizations that will use or have been using cloud services must comply with the Cloud Cybersecurity Standards by taking into account their data or technology information systems’ level of impact, as specified in the previously issued Notification of the NCSC Re: Standards for Defining the Security Category for Data and Information Systems B.E. 2566 (2023). The impact level related to personal data is to be rated as being at least at the medium level, and the minimum standards for that level specified in the draft Cloud Cybersecurity Standards
May 13, 2024
On May 2, 2024, Vietnam’s Ministry of Justice published on its online platform the most recent version of the draft decree on administrative sanctions for violations in the field of cybersecurity (“Draft Sanction Decree”) to gather feedback and contributions from the community and stakeholders. After receiving the Ministry of Justice’s assessment, the Ministry of Public Security (“MPS”), in charge of drafting the Draft Sanction Decree, may make further revisions before submitting it to the government for review and final decision on enactment. The decree is expected to have an effective date of June 1, 2024. The stringent penalties for infringements involving personal data of the previous draft version remain in this Draft Sanction Decree—a sign of the proactive stance of the MPS in enforcing the Personal Data Protection Decree (“PDPD”). Effective Date and Transitional Provisions It is important to note that the Draft Sanction Decree does not impose any new obligations on organizations or individuals, and only sets out the administrative sanctions that could be imposed on violators as soon as June 1, 2024, which is indicated as the effective date in Article 49. This signals the MPS’s eagerness to begin taking enforcement actions against recalcitrant organizations and individuals that have not complied with the various obligations imposed on them under the Law on Network Information Security (enacted in 2015), the Law on Cybersecurity (enacted in 2018) and its guiding decree (Decree 53 – enacted in 2022), and the most recent PDPD (enacted in 2023). Article 50.1 of the Draft Sanction Decree outlines the transitional provisions regarding administrative violations in the cybersecurity field. It clarifies that the decree does not have retroactive effect, by stating that violations occurring before its effective date, but discovered or under review after such effective date will be subject to the regulations on administrative
May 9, 2024
As non-cash payments continue to surge in Vietnam, the requirement for strong security standards and a clear legislative framework for intermediary payment services (“IPS”) is becoming more and more critical. Recognizing this, the State Bank of Vietnam (“SBV”) has been working on a draft decree to supersede the outdated Decree No. 101/2012/ND-CP dated November 22, 2012, on non-cash payments (“Draft Non-Cash Payment Decree”), which will lay the groundwork for non-cash payments in general and the provision of IPS in particular. Building upon this, the SBV recently issued a draft circular to replace Circular No. 39/2014/TT-NHNN dated December 11, 2014, on IPS (“Circular 39”) (“Draft IPS Circular”), which will offer more detailed guidance on the provision of IPS in Vietnam on top of the Draft Non-Cash Payment Decree. The Draft IPS Circular will be applicable to (i) IPS providers; (ii) foreign organizations providing IPS in Vietnam; and (iii) organizations and individuals involved in the provision of IPS. Some key updates regarding the Draft IPS Circular are as follows: Scope of Application The Draft IPS Circular sets out further guidance for the provision of IPS as listed under the Draft Non-Cash Payment Decree, including: (i) electronic clearing services; (ii) electronic wallet (“e-wallet”) services; (iii) collection and payment support services; (iv) financial switching services; (v) international financial switching services; and (vi) electronic payment gateway services. Notably, the Draft IPS Circular has explicitly excluded from its scope of application the provision of accounts by goods/service providers to their customers solely for the purpose of payment within the systems of such providers (e.g., cards/coupons or service/transaction accounts of online game service providers, transportation service providers, or securities companies, etc.). Requirements on the Provision of IPS Electronic Clearing Services: The Draft IPS Circular introduces regulations to cover certain elements of electronic clearing services that have
May 9, 2024
On April 29, 2024, Thailand’s Office of the Personal Data Protection Committee (PDPC) issued the master plan for personal data protection, which outlines the PDPC’s strategies for developing and enhancing the data protection framework in Thailand from 2024 to 2027. A draft of this four-year plan had previously been released for a public hearing on November 27, 2023. Overview The master plan sets out the long-term direction for the protection of personal data in Thailand, analyzing the current landscape, challenges, and obstacles encountered since the full enactment of the Personal Data Protection Act B.E. 2562 (2019) (PDPA). It aims to align with Thailand’s National Security Policy and Plan for 2024–2027 and focuses on key sectors in its initial two years. These sectors are: Public security and key government services; Retail and e-commerce; Information and communication technology and telecommunications; Finance, investment, and insurance; Public health; Tourism; and Education. Objectives The master plan’s goals include increasing organizational compliance with the PDPA, reducing data breaches, updating the PDPA to reflect current circumstances, introducing various PDPC e-services, and enhancing Thailand’s global competitiveness in data privacy and personal data protection. It sets targets and indicators of the plan’s success, such as achieving a 100% PDPA compliance rate across all sectors in Thailand and raising Thailand’s digital competitiveness to at least 30th in the World Digital Competitiveness Rankings from the IMD World Competitiveness Center. Strategic Initiatives To achieve these objectives, the master plan introduces four strategic initiatives: Effective and balanced PDPA enforcement: Develop standards, principles, criteria, tools, indicators, and data privacy governance, including law enhancements. A recent example of this is the PDPC’s launch of the Personal Data Protection Surveillance Centre (PDPC Eagle Eye) to monitor data breaches. Knowledge and trust enhancement: Build human capacity and trust by enhancing knowledge through initiatives like the forthcoming