Digital platforms have made life easier for millions of users. But oftentimes, privacy issues have raised concerns among developed nations to the point that certain legal frameworks were implemented to prevent personal data from being misused. Ever since the General Data Protection Regulation (GDPR) a European legal instrument came into effect in May 2018, there has been a worldwide surge in the interest in Data Protection. A year later, Sri Lanka commenced the drafting of its Personal Data Protection Bill. However, the adoption of a European model with stricter penalties and questionable clauses with regards to the independence of the Data Protection Authority, exclusion of journalistic purpose, powers vested upon the Minister and nature of filing appeals have raised doubts among the media fraternity as well as other civil rights organizations.

Section 85 of GDPR excluded?

During an event organized by the Centre for Policy Alternatives (CPA) to shed light on the Data Protection Bill, attorney-at-law Nuwan Bopage said that if there’s a conflict between the Right to Information (RTI) Act and the Personal Data Protection Bill, there’s a section of the new bill which states that the PDPB overrides the RTI Act. This means that the PDPB is above the provisions relating to media freedom and freedom of expression included in the Constitution as well. But in response Section 35 states that ‘Exemptions, restrictions or derogations to the provisions of this Act shall not be allowed except where such an exemption, restriction or derogation is prescribed by regulations and respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society for the protection of the rights and fundamental freedoms of persons, particularly the freedom of expression and the right to information.’

“But whether it is an infringement of freedom of expression is decided by the Data Protection Authority or controller as mentioned in Section 32. People may think that personal data should be protected with the advancement of technology. But why has journalistic purpose been exempted from this Act? Was it intentional or coincidental? This Act was drafted based on the European Union’s GDPR model and therefore there’s a notion that this is a progressive Act. In that case how do they exempt Section 85 of GDPR which talks about the processing and freedom of expression and information? It states that journalist purpose is included in the freedom of expression in addition to purposes of academic, artistic or literary expression. Then how was this section missed when drafting the Data Protection Bill?” he questioned. 

He further said that when Ramzy Razeek posted a status on Facebook and advocated for an ‘ideological Jihad’ in response to anti-Muslim propaganda, he was arrested on claims that he violated the The International Covenant on Civil and Political Rights Act (ICCPR) Act. “Ramzy Razeek cannot be arrested for posting this status but if someone comments infringing his right to express this idea, then that person can be arrested. That means if someone says that Jihad is a terrorist activity and that he will kill Ramzy, that person could be arrested under the ICCPR Act according to the international legislation. But in Sri Lanka it was used against the person making a statement, limiting his right to freedom of expression. Therefore, there’s a higher chance of the DPB being misused to suppress media freedom and limit opportunities for journalists to do investigative reporting. As a result of public pressure, we were able to halt the passage of the Kotelawala Act. If we need to include Section 85 of GDPR into this Bill, then more professionals have to add pressure on policymakers.”

Weaknesses within media fraternity

“Now that this Bill has been passed, journalists and media houses should be ready to face challenges that come in their way as a result of its passage,” opined Duminda Sampath, President, Sri Lanka Working Journalists Association. “When the ICCPR Act was passed journalists and artistes were inconvenienced as they had to appear for cases filed under this Act. I believe that all these Acts and legislation have been passed in such a way so that they favour politicians.  Politicians have to control people and suppress rights of journalists in order to continue a corrupt regime. One way of suppressing journalists is to bring such Acts and legislation into force. Journalists have been murdered, assaulted and some are in exile, but the media fraternity was unable to develop a mechanism to stand for them. Weaknesses that exist within the media fraternity make it easier for them to bring in such laws. Therefore, owners of respective media houses have a responsibility to ensure the safety of journalists.”

He further said that the 225 politicians are of a different clan and that if the Opposition becomes the ruling party, they too would put this Act into effect. “This is why they don’t analyse these Bills in detail. They oppose these Bills to maintain face with the public. Therefore, we have a duty as citizens, media personnel and organisations to voice against injustices faced by journalists. This is why there is no investigative journalism in Sri Lanka and that is the reason for mass scale corruption. If journalists exposed foreign monetary transactions received by respective governments over the years and how these funds were utilised, perhaps there wouldn’t have been a forex crisis today. Since journalists don’t want to take a risk, there haven’t been many in-depth articles on these transactions. Therefore, everybody should come to a common ground in order to face these challenges together. These Acts prevent journalists from exposing corruption done by politicians.”

A Bill to suppress journalists?

While many believe that personal data need to be protected as we move into a digital age, several concerning factors exist. “When bringing the Data Protection Bill into force it was revealed in Parliament that this was the first of its kind in South Asia,” opined Attorney-at-law Prabodha Rathnayake. “But rather than being proud we need to look at why other countries have left room for a dialogue on this topic and haven’t rushed a Bill in this manner. I don’t think that we had such a complex issue pertaining to data protection in order to rush the passage of a Bill. They could have discussed with media personnel including veterans and amateurs in the industry first. Another issue was that there was no time to analyse the Bill and file objections. The Young Journalists Association filed a petition within a span of two days and submitted it to courts even with a five-minute delay. But the attempt was unsuccessful. 

Another part that has been missed is with regards to appealing for a penalty. Section 38 states that ‘The Authority may invest its money in such manner as the Authority may determine or use any immovable property that is in its possession as collateral for the purpose of satisfying any liabilities incurred by it’. Appeals aren’t discouraged in modern legislation. In turn it should be encouraged. There are heavy penalties imposed and clauses to discourage appeals give a hint of why this Bill was passed. Another concern is with regards to the Data Protection Authority and whether it would end up becoming a political authority. These Bills are therefore being used to exercise suppression among journalists. It would also impact journalists who utilise social media to disseminate information. For example, an interview published on YouTube could be criticised using this Bill claiming that the interview was done based on personal data of another person. As such, Bills of this nature are often misused,” he added.

Role of journalists 

However, the Young Journalists’ Association took the initiative to file a petition a few minutes after the deadline. Hence, their petition was rejected. “Following the 20th Amendment, citizens only have one week to file objections against a Bill once its presented in Parliament,” said Tharindu Jayawardena, representing YJA. “The Prime Minister presented this Bill on January 20. But as citizens we can access the Bill only when it’s published on the Government Printer’s website. However, it was published only on January 25 and we therefore had only two days to study the Bill and file objections. Therefore, we had to submit petitions at the last minute. Apart, from media, this Bill has an impact on civil society organisations as well. The Computer Crimes Act (CCA) is now used to limit freedom of expression. Over the past few days many people were accused of posting statuses on Facebook and were arrested under this Act. One person was arrested for posting a status which asked citizens to shut down their TVs during the President’s address to the nation. This person was also arrested under the CCA.”

Jayawardena further said that the PDPB has been drafted in a way to discourage appeals. “If the penalty is Rs. One million, then someone has to have collateral worth this amount to make an appeal. This Bill may impact people in many sectors, not just media. One cannot keep data in their possession without consent from another person. So far journalists had the opportunity to reveal information without disclosing sources. But according to this Bill, if that particular Authority questions us, we have to reveal the sources. If somebody questions us on collecting information we have to respond. The Editor’s Guild can do a lot regarding this matter but they too have sent a letter at the last minute. None of the Opposition parties opposed the Bill except for certain statements. Journalists have to play a pivotal role in ensuring that this Bill doesn’t come into effect.”

Powers of the Minister 

Speaking about the powers vested on the Minister, legal officer at Transparency International, Piyumi Madushani said that Section 35 is not sufficient enough as it states that all provisions override those laid by RTI Act. “Is it fair to implement a model from another country? In other countries it is the Personal Data Protection Bill that is at the forefront. But these countries have independent authorities to ensure that the RTI Act and DPB Bill reconcile one another. Sometimes both these Acts are governed by one independent commission or by two independent authorities. But none of these mechanisms exist in Sri Lanka. This is why data processing for journalistic purpose becomes doubtful” she said.

“During the second reading it was repeatedly said that most appeals will be entertained in the form of orders. The Bill mentions the power of the Minister to give orders in several places. Section 44 for instance states that The Minister may make regulations with the concurrence of the Authority in respect of any matter required by this Act to be prescribed or in respect of which regulations are authorized by this Act to be made. Power of the Minister and needs of journalists need to be incorporated.”

Constitution nullified?

Having penned a book on media law, Sri Lanka Podujana Peramuna Parliamentarian Dr. Wijeyadasa Rajapakshe said that democracy cannot exist in the absence of free media. “If the government is curtailing media freedom, then we are heading towards a dictatorship. In democratic countries there is no legislature of this sort” Even penalties are too high and a lot of journalists will end-up in jail. In democratic countries there is no legislature of this sort.”

He further said that certain aspects of Article 14 of the Constitution have also been nullified by this Act. “If this Bill affects free media, then it’s the duty of journalists to get together and voice against it. When asked if there’s any point in contesting against the Bill following its passage, Dr. Rajapakshe said that there’s a point since Parliament can open the Bill and make any amendments at any given time. It’s up to the professionals to bring in proposals to amend the Bill. All media institutions should fight for that.”

Role of the Opposition

In his comments, CPA Executive Director Dr. Paikiasothy Saravanamuttu said that the PDPB shouldn’t impinge on media freedom. “Human rights should be protected. There needs to be a serious discussion on the drafting of a Bill in conformity with international human rights and principles.”

He further said that Opposition parties should take a stance in Parliament to open it and challenge it. “If it’s not challenged, then it’s an issue. After all, the PDPB shouldn’t in any way take away the rights given by the Right to Information Act.”

A complex law 

“The independence of the Data Protection Authority is one of the key changes proposed in the amendments,” opined veteran policy expert and founding chair of LIRNEasia Prof. Rohan Samarajiva. When going through the amendments, one can see that new language has been introduced to create an authority which looks very much like other ‘independent’ authorities. The appointment of individuals to this authority is like that of other independent authorities with limitations of the 20th Amendment.”

He further said that these kinds of Acts go back to data protection Acts introduced in other countries.  “The GDPR model is a European invention. Sweden is one of the earliest countries to have introduced this legislation. Describing actions of the Data Protection Authority, Section 35 states that ‘Exemptions, restrictions or derogations to the provisions of this Act shall not be allowed except where such an exemption, restriction or derogation is prescribed by regulations and respects the essence of the fundamental rights and freedoms.’ 
Having observed the developments of the Bill, Prof. Samarajiva further said that it’s a complex law that would be difficult to implement. “The scope is so vast for the DPA to do its job. There aren’t sufficient funds or resources. It doesn’t have its own funds.”

Section 39 (2) states that ‘Any expense incurred by the Authority in any suit or prosecution brought by or against the Authority before any court shall be paid out of the Consolidated Fund, and any costs paid to, or recovered by, the Authority in any such suit or prosecution shall be credited to the Consolidated Fund.’
He further said that there’ll be restrictions on using cloud services and that the Bill will affect the private sector as well. “Smaller economies like Sri Lanka doesn’t need such complicated laws. I agree that data needs to be protected but there could have been a simpler solution.”

A misunderstood Bill 

In his comments, Justice Minister Ali Sabry said that people have totally misunderstood the Bill. When asked about the independence of the Data Protection Authority he said that the Authority has been appointed after listening to professionals and by following certain criteria. “Even the Chief Justice is appointed by the President. In that case who’s going to appoint judges? We have put sufficient safeguards in the Act.”

Responding to claims on the exclusion of journalistic purposes, Sabry further said that Sections 4, 5, 35 and 36 should be carefully read. “Freedom of Expression and Fundamental rights have been secured. Exceptions to the rule in the DPB is public interest. Freedom of Expression exercised by journalists is part of the rights covered in Article 14 of the Constitution and it has been sufficiently covered. Journalists have privileges in their rights to seek information and these are covered in the DPB.”