A major fuss has arisen over Sri Lanka’s Personal Data Protection Bill, to be taken up for the 2^nd reading in Parliament on Wednesday (9^th March 2022).

Media organisations and civil society have both protested over the fact that a ‘Government controlled entity’ will be given the power to decide what data should be protected with very wide coverage on ‘special categories’ of data. The Editors Guild of Sri Lanka has pointed out that this will be a problem to journalistic reporting of corruption stories as the Bill places obstacles by protecting ‘personal data relating to offences, criminal proceedings and convictions’.

In an editorial that first pointed to the dangers, the widely read the Sunday Times asked on February 13^th 2022 as to why, ‘In an era of information disclosure that Sri Lanka has pledged to be part of after passing a world class Right to Information (RTI) Act in 2016, …a Bill on Data Protection presented to Parliament recently by the Prime Minister must revert to ancient terminology by including a clause on Official Secrecy?’

The editorial warned that ‘care must be taken to ensure that protection of data does not prevent the release of information which is in the public interest’ and observed that the Bill, as it stands, ‘contains too many ambiguities that must be corrected before it passes into law.’

The Young Journalists Association (YJA) meanwhile challenged the Bill in the Supreme Court but the petition was dismissed by the Court on a technicality, that it had been filed in the Supreme Court registry out of time. This was despite the petition being filed just minutes after the official time of filing which was 3pm. The YJA had stated that ’journalistic purpose’ should be stated as an exception to the processing of data as is the case in all other countries , that the RTI Act should be balanced with the purpose of data protection and that the Data Protection Authority should be independent rather than ‘Government controlled’ as the Bill provides.

It also pointed to the dangers of a ‘Government controlled’ Authority being given the power to impose hefty fines up to ten million rupees per every act seen as ‘violating’ the Act without these other concerns being addressed.

Colombo Telegraph learns that the Government has promised media organisations that their concerns would be addressed while the Opposition has assured that it would support the amendments proposed by the media to the Bill.

On Monday, the Sri Lanka Press Institute together with the Newspaper Society of Sri Lanka (NSSL), Free Media Movement (FMM), Sri Lanka Working Journalists Association (SLWJA), Tamil Media Alliance (TMA), Sri Lanka Muslim Media Forum (SLMMF), Federation of Media Employees’ Trade Unions (FMETU), South Asia Free Media Association (SAFMA) and the SLPI, issued a press release informing that they had handed over a letter to the Minister of Mass Media, Minister of Justice and the Secretary of the Ministry of Information Technology highlighting key concerns with the Bill.

They pointed to the fact that while the proposed Personal Data Protection Act is being recognised as an important one in the digital era, serious thought should be given to the implication and infringement to the rights of professional journalism and media freedom. It was emphasized that definitions regarding personal data and special categories of personal data remain arbitrary given that special categories also include data related to offenses, criminal proceedings and convictions which do not recognise the journalistic right to exercise free speech in delivering such information.

It was also noted that the proposed Act would prevail over every other law in any inconsistency, including the Right to Information (RTI) Law which would compromise the access to information that the public and journalists have via the prevailing RTI law.

Transparency International Sri Lanka meanwhile also raised similar concerns, asking the drafters of the Bill why they had decided to omit important protections in the initial draft on personal data protection released in 2019. The preamble of the 2019 framework refers to Sri Lanka’s constitutional Right to Information (RTI)as a crucial right, recognizing the need for the public interest to be balanced with the protection of personal data.

However, as TISL pointed out, this balance is not reflected in the Bill which had omitted that reference. Also, the 2019 framework had called for the appointment of independent three members to a nine member Data Protection Authority through a public application process. The Bill has deleted that safeguard, saying only that the Authority is to be a ‘Government controlled entity.’ This is in violation of all international standards which call for the Data Protection Authority to be independent from government.

The Bar Association of Sri Lanka(BASL) has however remained silent on concerns relating to the Bill, particularly the lack of independence of the proposed Data Protection Authority. Its office bearers, including its President Saliya Pieris and others, have applauded the Bill while not acknowledging its serious drawbacks, young journalists who challenged the Bill in the Supreme Court say, pointing out that it is the duty of the Bar to objectively respond to bills that infringe on rights.

Colombo Telegraph also spoke to several experts on data protection, including a senior law academic associated with the early drafts of the Bill who questioned as to why the 2019 data protection framework had been radically changed. A researcher who had worked with the Right to Information Commission (RTIC) clarified that though it is claimed by those pushing the Bill through Parliament, that the Bill had been examined by the RTIC, this was distorting facts as it was only the 2019 framework on data protection that had been sent for feedback to the RTIC.

If Parliament approves the Bill in its current form, it will force all Sri Lankan editorial newsrooms, non-governmental organisations and research institutes to have Data Protection Officers who will answer to the dictates of a ‘Government-controlled’ Data Protection Authority, experts warn. This will further erode the freedom of expression in Sri Lanka, already under massive threat by a security state, they say.