Vietnam’s digital music industry has been expanding rapidly over the last decade. A forecast by Statista Inc., an internet statistics portal, shows that the revenue in this segment of the Vietnamese economy was US$21 million in 2019, and will have an annual growth rate of 2.2 percent, which will result in a market volume of US$23 million by 2023. They also state that the user penetration of the market will reach 18.7 percent in 2019 and hit 19.4 percent by 2023. Such growth prospects and impressive advances in mobile networks, with local telecommunications firms racing to roll out 5G connections, have attracted many foreign players to Vietnam’s digital music market. Besides the global giants in the industry such as Apple Music and Spotify who jump into service directly, others have chosen to invest in or acquire Vietnamese music platforms to enjoy the ready-made reputation and customer base. 

Like in any other industry, the investment in or acquisition of a digital music company requires a thorough legal due diligence check to make sure that the investment or purchase is beneficial. Our article focuses on typical legal aspects that need due attention in due diligence for a digital music company in Vietnam, including corporate governance, licenses and permits, intellectual property, cybersecurity and privacy.  

Corporate governance

Most Vietnamese digital music companies have evolved from low-cost and bare-bones start-ups initiated by an individual or several co-founders. The course of decision-making and asset management in these companies is usually over-simplified, with compliance and risk management set aside. Several legal issues could stem from such practice; commonly found issues are ambiguity in ownership and conflict of interest.

Ambiguous ownership is commonplace for a digital music enterprise which an entrepreneur has built up, especially for intangible assets such as copyrights, domain names and trademarks; all of which play a crucial role in a digital music company’s operation. For instance there are situations where the domain name of the music streaming website, or the icon trademark of the music application is found registered under the name of the founder instead of the target company. Another circumstance is where the founder establishes another company that develops and copyrights the mobile application used for running the target company’s service. In such cases, these assets will not be automatically covered by the purchase of the target company, but will need separate transfer post-acquisition.

Conflict of interest often results from related-party transactions between the target company and its partners such as advertising agencies or e-commerce companies. In particular, in some such related-party transactions, the founder is found to be a shareholder in the partner companies. With the simplified procedure, the founder in cases neither reports the share ownership to the general meeting of shareholders (GMS) or the board of members (BOM), nor have the related-party transactions been approved by the GMS or BOM. This does not comply with Vietnam’s Enterprise Law if such share ownership reaches 10%. In practice, related-party transactions not property reported to or approved by the GMS or BOM signals personal interests outweighing company interests, and are the usual cause of disputes between shareholders or board members and the company.

License and permit

Unlike Apple Music or Spotify, which solely run their streaming services via applications, Vietnamese digital music companies tend to offer a multiple-in-one package consisting of:

• A website functioning as either a music streaming platform or a social networking site where users share their own content; and
• A mobile music application for streaming or downloading content with Wi-Fi or cellular connections.

The license and permit necessary for the operation of each platform under Vietnam’s law include:

• Online Social Network Establishment License required for the social networking service. Failure to obtain this license can result in revocation of the domain name. It is worth noting that most Vietnamese companies use the same domain name for the social networking service and music streaming service, so obtaining this license is critical for the operation of both services.
• Registration Certificate for Service of Content Provision on Mobile Telecommunications, in case the digital music company cooperates with mobile network service providers to deliver content to end-users with high-speed and unlimited data packages – a practice commonly seen in Vietnam. To apply for this license, certain business lines must be covered in the company’s enterprise registration certificate. In reality, obtaining this license is usually one of the obligations of the target company under its cooperation contracts with mobile network service providers.

Intellectual property

IP licenses with CMOs

Copyright and related right licenses are vital for the operation of a digital music service. Thanks to the rise of local and international collective management organizations and companies (CMOs), obtaining copyright and related right licenses has never been simpler. There are, however, complications that a due diligence on this matter needs to deal with, including:

• Non-centralization of Copyright/Related Right Collection: It is not easy to guarantee all the necessary licenses are obtained. Most CMOs manage only copyrights for the music compositions or only related rights for the records. In most licensing agreements, the copyright managing CMO disclaims liabilities for the procurement of related rights over the licensed works, and vice versa. Most of the time, the company must contract with two CMOs for proper licenses of a work.
• ImmatureCapacity for Managing License Portfolio: A digital music company could be engaged in dozens of licensing contracts with different CMOs and individual artists. Each licensing contract is accompanied by several annexes detailing the licensed works. A result is that the company may have to manage, on average, a million licensed works with varying licensing scopes and terms. Few Vietnamese companies are developing an advanced internal system or procedure for properly docketing and managing such a large diversity of licenses.

It is therefore essential to conduct a thorough audit of the license portfolio, as well as developing a plan for further portfolio management.

Contractual compliance

• Territorial and Device/Platform Restriction

These restrictions are common in license agreements. Usually, the agreements would limit the use of relevant works to the territory of Vietnam. Similarly, restrictions on devices or platforms could be applied. For example, Vietnamese independent artists would try to exclude the use of their works on YouTube from the licensing scope as they probably have their own channels on YouTube and want to directly make money there. Besides, due diligence lawyers should note that in many cases, only certain devices (e.g. iOS, Android mobile devices or TVs) might be allowed for streaming under the license.

There are risks that the local music companies ignore these restrictions and allow streaming the restricted works to end-users in foreign countries or extend their use of the works to the restricted platforms and devices. Additionally, some agreements try to limit the licensing scope to two or three applicable platforms or devices and exclude others not mentioned in the agreement.

It is important that the due diligence lawyers ensure that the target company uses the licensed works in accordance with the scope of the license agreement.

• Other Requirements (Misc. issues and technical standards)

Under many IP license agreements, major licensors require their licensees to label explicit content, or publish a policy/term of use to incorporate certain provisions such as i) prohibit the sale or rental or other redistribution of licensed content; or, ii) prohibit the use of licensed content by any third party and provide that it is for the end-user’s own personal and non-commercial use. Usually, the target company neglects this obligation in doing so it may constitute a contractual breach. This is something that the due diligence lawyers should examine.

Furthermore, some agreements may require the music platforms to block open proxy and VPN, or apply SSL technology to protect user data. (SSL stands for Secure Sockets Layer and, in short, it’s the standard technology for keeping an internet connection secure and safeguarding any sensitive data that is being sent between two systems.) As the communication between the legal department (who understand the license agreement inside out) and the IT department handling the technical compliance is not always smooth and streamlined, delay or non-compliance over technical compliance could potentially be a problem. Checking technical white papers and interviewing relevant stakeholders on these issues may be necessary.

Non-transferability of integrity rights

Vietnam is a country that could be considered as an author rights and pro-employee country; the law pays close attention to the well-being and entitlements of employed authors. Under IP law, copyright and related rights for works made by employees shall belong to the employers during working hours, unless the parties have agreed otherwise. However, the employee is entitled to personal rights to their work (i.e. named as the author or rights to integrity of the works).

In practice, the right to integrity of the works is troublesome for employers as it would potentially block them from modifying the works (especially after a bitter dismissal). There is a settled case in Vietnam that reflects the court’s viewpoint over this issue. In February 2019, in a lawsuit over ‎the right to develop copyrighted comic characters (the integrity right), the District 1 Court of Ho Chi Minh ‎City ruled in favour of the author. The company that hired the author to create the comic characters, ‎though owning the copyright, was deprived of the right to develop the characters further.‎ The court’s approach, in this case, worried many employers in the creative industry.

It is also worth noting that local music companies create the mobile application, website and potentially artworks for promotional campaign, by themselves (using their own employees) instead of engaging with third parties. Therefore, it is necessary that employers preemptively take steps to establish a proper control of the copyright, including elaborating the employer’s ownership of copyright over works created by employees and requesting employees to sign certain waivers not to excise the right to integrity.

Therefore, due diligence should ensure that the employers and employees have proper agreements to address potential IP disputes, including those related to the right to integrity. If there are no such agreements in place, the due diligence lawyers should recommend that the target company puts those documents in place.

Copyright infringement

Under the 2019 Special Report 301, which is prepared annually by the Office of the United States Trade Representative (USTR) and identifies trade barriers to United States companies and products due to intellectual property laws in other countries, Vietnam remains on the Watch List in 2019 as enforcement continued to be a challenge and online piracy remains prevalent. It is quite possible that a target company may face IP infringement, especially against their copyright or licenses.

It is imperative that the target company proactively protects its own copyright where the infringement may lessen the value of such IP. Also, protecting the licensed copyright and related right may be the contractual obligation the target company should uphold. Many licensors also set out the failure to comply with that obligation as a material breach and they could unilaterally terminate IP license agreement.

For example, paying for online music has not been traditional in Vietnam, therefore, many internet users try to use hacking tools to bypass the download restriction. The existence of such tools hurt the legitimate streaming business in general. The due diligence lawyers should run simple online searches for such potential infringements and scrutinize if the target company actively fights against those tools or proceeds with proper reports to the licensors.

Cybersecurity and data privacy

A digital music company which runs both a streaming service and an online social networking service undoubtedly collects, processes and stores an enormous amount of data daily. The company is subject to obligations of guaranteeing cybersecurity and user data protection.

Vietnam’s cyber-information security law classifies a data system of an enterprise providing a conditional business service. For example, an online social networking service, or an online service processing personal information of minimum 10,000 users as a 3rd-Class information system. Most Vietnamese digital music companies would fall into this class. Cybersecurity requirements imposed on this class’ companies include, without limitation to, establishing an internal cybersecurity unit and arranging for annual cybersecurity examination and assessment with competent agencies.

Also, the company is required to ensure that only the users who provide completely and precisely their data, including names, ages, addresses, ID numbers, phone numbers, and email address, can establish their pages and share content on the social networking site. In practice, this obligation is often neglected, i.e. users of the social networking service can still establish pages and share content without providing the necessary personal data.

Last but not least, the company’s music streaming website would be considered as an e-commerce website under the law, which triggers the requirement of users’ opt-in consent for the collection of their personal data. In practice, most companies do not establish an opt-in mechanism for data collection.

Although non-compliance with the above obligations only results in modest monetary fines under the current legal framework, upcoming regulations on data protection are expected to stipulate more stringent requirements with heavier sanctions.

Conclusion

Any of the above issues should be addressed by specific warranty, indemnity or other ‎contractual protection from the seller, and subject to proper solving post-acquisition as we discussed in specific paragraphs. In any case, legal advice is necessary.

As the amount that the Vietnamese population spend on digital music rapidly grows, foreign investment in this industry will persist with further M&A activities. However, the acquisition of digital music companies by foreign investors may not be a common practice that Vietnamese due diligence lawyers are familiar with. Besides coporate, labour and contract laws which are typical in due diligence, knowledge in specialized legal areas such as intellectual property and data protection is essential in dealing with a due diligence case in this industry.