Thông tư 28/2022/TT-BGTVT đảm bảo an toàn thông tin dữ liệu đăng kiểm phương tiện giao thông

CIRCULAR

ON MANAGEMENT, MAINTENANCE, SHARING, AND INFORMATION SECURITY ASSURANCE OF TRANSPORT VEHICLE REGISTRATION DATA

Pursuant to the Law on Information Technology dated June 29, 2006;

Pursuant to the Law on Cyberinformation Security dated November 19, 2015;

Pursuant to the Law on Electronic Transactions dated November 29, 2005;

Pursuant to the Law on Information Access dated April 6, 2016;

Pursuant to Decree No. 85/2016/ND-CP dated July 1, 2016 of the Government on information system security assurance by classification;

Pursuant to Decree No. 47/2020/ND-CP dated April 9, 2020 of the Government on management, connection, and sharing of digital data of state authority.

...

...

...

At request of Director of Information Technology Center and Director of Vietnam Register;

The Minister of Transport promulgates Circular on management, maintenance, sharing, and information security assurance of transport vehicle registration data.

Chapter I

GENERAL PROVISIONS

Article 1. Scope and regulated entities

1. Scope

a) This Circular prescribes the creation, updating, management, maintenance, connection, sharing, use, and information security assurance of transport vehicle registration data under management of the Ministry of Transport;

b) This Circular does not prescribe data on aircrafts.

2. Regulated entities

...

...

...

b) Agencies, organizations, and individuals receiving shared and/or connected transport vehicle registration data;

c) Other organizations and individuals related to the connection, sharing, and use of transport vehicle registration data.

Article 2. Definitions

In this Circular, the terms below are construed as follows:

1. “transport vehicles” (hereinafter referred to as “vehicles”) include road motorized vehicles, heavy-duty vehicles, sea vessels, inland waterway crafts, and railway vehicles.

2. “platform for integration and sharing of data of Ministry of Transport” refers to the platform where data on information system and databases is connected and shared within the Ministry of Transport and between Ministry of Transport and ministries, central departments, local departments.

3. “governing authority of vehicle registration data” refers to the Vietnam Register.

Article 3. Rules for creating, updating, managing, maintaining, connecting, sharing, using, and ensuring information security of vehicle registration data

1. Complying with regulations on protection of state secrets; regulations on cyberinformation security, regulations on information system security by classification.

...

...

...

3. Ensuring adequacy and legitimacy of data for the purpose of management and use of vehicle registration data.

4. Conforming to Vietnamese e-Government Framework and Ministry of Transport e-Government Framework.

5. Complying with regulations on information security; regulations on intellectual property pertaining to data and privacy of organizations and individuals.

6. Complying with regulations and technical guidelines on data exchange and application of information technology in state authorities.

Chapter II

CREATION, UPDATING, AND INTEGRATION OF VEHICLE REGISTRATION DATA

Article 4. Vehicle registration database

1. Vehicle registration database is a combination of data pertaining of vehicles and created during inspection, examination, and certification of technical safety and environmental protection of road motorized vehicles, heavy-duty vehicles, sea vessels, inland waterway crafts, and railway vehicles.

2. Basic information contained in the vehicle registration database includes:

...

...

...

b) Information under Appendix II attached hereto in case of heavy-duty vehicles;

c) Information under Appendix III attached hereto in case of sea vessels;

d) Information under Appendix IV attached hereto in case of inland waterway crafts;

dd) Information under Appendix V attached hereto in case of railway vehicles.

Article 5. Creation, updating, and integration of vehicle registration data

1. Entities that inspect, examine, and certify technical safety and environmental protection for vehicles shall create and update data upon finishing examination, inspection, and issuance of certificates and registration dossiers via software access to which is authorized and managed by governing authority of vehicle registration data.

If sea vessels are inspected in foreign countries, data of the vessels must be created and updated within 3 working days from the date on which inspecting personnel return to offices.

2. Vehicle registration data must be integrated with vehicle registration database within 1 working day by governing authority of vehicle registration data following its creation and update.

Chapter III

...

...

...

Article 6. Vehicle registration data information system

1. Vehicle registration data information system means an information technology system that consists of information technology infrastructures, software, and vehicle registration database.

2. Role and functions of vehicle registration data information system

a) Jointly manage vehicle registration data and information on a nationwide scale;

b) Provide supports for creation, updating, connection, and sharing of vehicle registration data.

3. Governing authority of vehicle registration data and entities creating, updating vehicle registration data are responsible for ensuring:

a) Adequate network connection of information system and infrastructures for the purpose of creation, updating, management, connection, and sharing of vehicle registration data;

b) Tools and measures for protecting and verifying data during connection and sharing of vehicle registration data;

c) Other technical conditions and resources for the purpose of creation, updating, connection, and sharing of vehicle registration data.

...

...

...

Expenditure on building, maintaining, upgrading, managing, and operating vehicle registration data information system shall be covered by state budget and other legal funding sources as per the law.

Article 8. Information security assurance

1. Agencies, organizations, and individuals engaging in the creation, updating, management, maintenance, connection, sharing, and use of vehicle registration data are responsible for ensuring information security of vehicle registration data information system.

2. The assurance of information security must conform to tasks, powers, and guarantee legal benefits of relevant organizations and individuals as per the law.

3. Governing authority of vehicle registration data shall produce written classification proposal for information system and adopt information security measures respective to the approved classification according to Decree No. 85/2016/ND-CP dated July 1, 2016 of the Government.

Chapter IV

CONNECTION, SHARING, AND USE OF VEHICLE REGISTRATION DATA

Article 9. Entities and methods of vehicle registration data connection and sharing

1. Governing authority of vehicle registration data shall connect and share vehicle registration data that serves state management purposes with common database of the Ministry of Transport.

...

...

...

a) Agencies performing state management purposes;

b) Legal owners or managers of vehicles as per the law;

c) Other organizations and individuals that request so.

3. Information in vehicle registration database to be provided and shared shall be information stated under Clause 2 Article 4 hereof.

4. Methods of sharing data

a) Via platform for integration and sharing of data of Ministry of Transport;

b) Direct connection between information registration data information system and information system of organizations that request to access the data;

c) Online search on website of the governing authority of vehicle registration data;

d) Written presentation of the information.

...

...

...

1. Share vehicle registration data via platform for integration and sharing of data of Ministry of Transport

If agencies mentioned under Point a Clause 2 Article 9 hereof wish to access vehicle registration data, they shall submit a written request to the governing authority of vehicle registration data which must state purpose of access, requested information, methods of connection, and access frequency.

Based on the written request, governing authority of vehicle registration data shall decide and cooperate with authority presiding the platform for integration and sharing of data of Minister of Transport in establishing connection, granting access, and providing technical guidance on making connection. Any rejection must be followed by a written response and reason for rejection.

2. Share vehicle registration data via direct connection between vehicle registration data information system and information system of requesting organizations

If agencies mentioned under Point a and Point c Clause 2 Article 9 hereof wish to access vehicle registration data, they shall submit a written request to the governing authority of vehicle registration data which must state purpose of access, requested information, methods of connection, and access frequency.

Based on the written request, governing authority of vehicle registration data shall decide, grant access, and provide technical guidance on making connection. Any rejection must be followed by a written response and reason for rejection.

3. Share vehicle registration data via online search on website of governing authority of vehicle registration data

Entities under Clause 2 Article 9 hereof have the right to look up vehicle registration information for vehicles under their legal ownership or management on website of the governing authority of vehicle registration data without account and password.

If agencies under Point a Clause 2 Article 9 hereof request accounts, password and web address, they shall submit a written request to the governing authority of vehicle registration data stating purpose of use and requested information. Based on the written request, governing authority of vehicle registration data shall decide and provide the requesting agencies with accounts, password, and web address. Any rejection must be followed by a written response and reason for rejection.

...

...

...

a) If agencies, organizations, and individuals under Clause 2 Article 9 hereof wish to access vehicle registration data, they shall submit a written request to the governing authority of vehicle registration data or entities inspecting, examining, and certifying technical safety for their vehicles and include purpose of use, requested information.

Based on the written request, governing authority of vehicle registration data or entities inspecting, examining, and certifying technical safety for the vehicles shall provide information in written form within their powers.

b) Organizations and individuals under Point b and Point c Clause 2 Article 9 hereof, upon receiving the written presentation of information that they have previously requested, must incur the costs for printing, photocopying, duplicating, and sending information in accordance with 46/2018/TT-BTC dated May 14, 2018 of the Minister of Finance.

Article 11. Suspension and termination of data connection and sharing on the internet

1. Governing authority of vehicle registration data shall suspend data connection and sharing when:

a) Information system or information infrastructure is expanded, upgraded, or under maintenance;

b) A force majeure that severs data connection and sharing or affects operation of the information system or data security occurs;

c) Agencies or organizations provided with vehicle registration data fail to use the data for the intended purposes or scope stated under the written request for data connection and sharing;

d) Connection with agencies or organizations granted access to vehicle registration data connection and sharing is deemed to be a security or safety hazard.

...

...

...

a) Connection cannot be restored due to incidents or objective causes which lead to the governing authority of vehicle registration data’s inability to maintain data sharing;

b) Agencies, organizations, or individuals granted access to data connection and sharing no longer wish to continue having data connection and sharing;

c) Competent bodies request termination of data connection and sharing in accordance with regulations and law.

Chapter V

ORGANIZING IMPLEMENTATION

Article 12. Responsibilities of governing authority of vehicle registration data

1. Building, maintaining, upgrading, managing, and operating vehicle registration data information system.

2. Establishing data folders in the vehicle registration database.

3. Providing professional training for organizations and individuals to create, update, maintain, and manage vehicle registration database.

...

...

...

5. Receiving and dealing with difficulties that arise during connection, sharing, and use of vehicle registration data.

6. Suspending and terminating vehicle registration data connection and sharing in accordance with Article 11 hereof.

Article 13. Responsibilities of entities creating and updating vehicle registration data

1. Promptly creating and updating vehicle registration data in accordance with Article 5 hereof.

2. Maintaining information security and confidentiality during creation, updating, and use of vehicle registration data.

3. Using information in vehicle registration database when inspecting, examining, and certifying vehicles for technical safety and environmental protection in order to stay consistent.

4. Promptly notifying and cooperating with governing authority of vehicle registration data in dealing with difficulties during creation, updating, and use of data.

5. Providing vehicle registration information that they have created and updated via method under Point d Clause 4 Article 9 hereof when needed.

Article 14. Responsibilities of agencies, organizations, and individuals granted access to vehicle registration data

...

...

...

2. Maintaining confidentiality and using the right accounts, password, connection methods, and address provided by governing authority of vehicle registration data.

3. Promptly notifying and cooperating with governing authority of vehicle registration data in dealing with difficulties that arise during connection, sharing, and use of vehicle registration data.

4. Refraining from sharing provided vehicle registration data to a third party without the consent of governing authority of vehicle registration data.

Article 15. Entry into force

1. This Circular comes into force from February 1, 2023.

2. If legislative documents referred to in this Circular are amended or replaced, the newer documents shall prevail.

Article 16. Responsibilities for implementation

Chief of Ministry Office, Director of Vietnam Register, Director of Information Technology Center, heads of entities and relevant organizations and individuals are responsible for the implementation of this Circular./.

...

...

...

PP. MINISTER
DEPUTY MINISTER




Nguyen Danh Huy