Comparative Analysis: Data Protection and Privacy in Sri Lanka

This report provides an in-depth analysis of data protection and privacy laws within Sri Lanka, evaluating their strengths and weaknesses. It examines the existing legal framework, including the Electronic Transactions Act of 2006 and the Computer Crimes Act of 2007, highlighting the absence of a specific data protection act. The report offers a comparative perspective, drawing parallels with data protection legislation in India and the UK, emphasizing the importance of specific legislation for safeguarding personal information. It discusses key principles such as fairness, transparency, and accountability. The report also includes recommendations for improving Sri Lanka's data protection laws, advocating for the adoption of measures similar to the EU's GDPR to enhance data privacy and secure the economic interests and fundamental rights of the people. The report underscores the need for a dedicated data protection bill to address gaps in consumer rights and data protection in the digital age.

Legal Research Skills
and Reasoning

TABLE OF CONTENTS
INTRODUCTION...........................................................................................................................3
MAIN BODY...................................................................................................................................3
Data protection and privacy:Comparative perspective from Sir Lanka and Other jurisdiction .3
Data protection and privacy law reform Sri Lanka................................................................3
Strengths and weakness of Data protection and privacy law reform of Sri Lanka................5
Comparative perspective from Sir Lanka and another jurisdiction........................................6
Recommendations................................................................................................................10
CONCLUSION..............................................................................................................................10
REFERENCES..............................................................................................................................12

INTRODUCTION
Data protection is the relationship between the collection and dissemination of data,
technology, the public expectation of privacy, legal and political issues surrounding them. This
laws are made in order to protect the information of individual. This assist in providing privacy
for data of the person. This assignment will include strength and weakness of data protection
legislation of Sri Lanka. The report will outline jurisdiction of Data protection and privacy from
other countries like India and UK. Moreover, it will suggest recommendation for improving this
legislation in order to have more effective data protection legislation in the country. This study
is based on data protection law reform of Sri Lanka with that of India and UK.
MAIN BODY
Data protection and privacy
Right to privacy is a fundamental right winch is given by every national’s constitution to
its every citizen. With advancement of technology the right to privacy has become a critical issue
which in many implications in towards individual liberty nowadays. The advancement
technology and digitization incidences of violation of the privacy through abusing personal data
and information and invasion in the privacy has becomes regular phenomenon (Chatterjee,
2018). With this the necessity of the exploration of the legal framework and mechanism which
have been employed to address the issue to ensure the right of privacy and protection to every
citizen in Sir Lanka and other comparative jurisdiction is seen. For the same strength and
weakness of Sri Lankan legal framework regarding right to privacy and data protection is
examined with two others jurisdictions.
Data protection and privacy law reform Sri Lanka
In Sri Lanka there is no specific Act that mention the name privacy but there are Act
which are made for protecting the data of the individual such as Electronic transaction Act 2006
and Computer Crimes Act, 2007. The Computer Crimes Act, 2007 of Sri Lanka that aims at
protecting the rights of privacy of people through penal sanctions. The Computer Criminal Act,
2007 which includes provisions regarding all types of cybercrimes but does not specifically with
person's right to data privacy. The authorities for data protection and privacy in Sri Lanka are
providing protection to the personal information of the people of Sri Lanka. This Act contains
provisions for protecting the information of individual (Ahluwalia and Bandyopadhyay, 2018).
The provision of this Act applies to person that commit offence which is related to computer

crime. Moreover, The Electronic transaction Act, 2006 which was made by the committee and
the objective of this Act is to facilitate domestic and international commerce by eliminating the
legal barriers. To protect public confidence in the authenticity, integrity and reliability of data
message and electronic communications (Van Dijk and et.al., 2018). Furthermore, Computer
Crimes, 2007 assist in ensuring data protection for providing privacy of information
(COMPUTER CRIME ACT, 2018). There are various rights to privacy for the information which
consist of right to information, restriction of processing etc. Moreover, In Sri Lanka another Act
for protecting the information is Information and Communication Technology Act, 2003.
This Act was implemented in order to provide support to government agencies regarding
information and communication strategies. This Act was not specific for data protection and
privacy but they are indirectly working to provide data protection and privacy for information of
individual by reducing the cybercrime. Moreover, this data protection and privacy helps in
protecting personal data of individual which will helps in reducing crime. Data protection and
privacy laws are important to secure the personal data of persons. This legislation assists in
providing help to those whose data is insecure by using effective system and software for
protecting data.
Data protection reforms Sri Lanka by using GDPR can be effective in
maintaining the data privacy of the individuals
of Sri Lanka which will helps in protecting the
information.
Legislations relevant with data protection  Computer Crimes Act, 2007
 The Electronic transaction Act, 2006
 Information and Communication
Technology Act, 2003
Competent authorities: There are gaps in laws that regulate consumer
rights and data protection in digital platforms.
Moreover, It is identified that Electronics
transaction Act, 2006 which fails to protect
consumers in the digital age. Sri Lanka for
implementing data privacy measures must
adopt European Union's general data protection

regulations which includes regulation
regarding person's name, locations, IP address
etc.
Key principles There are various principles regarding data
protection that consist of lawful, fairness and
transparency of data, Accountability, Right to
access, Right to rectification, Right to data
portability etc. The Authorities of Sri Lanka
must pass a Bill for data protection laws as it
will be beneficial for the economic interest of
the country as well as provide fundamental
right to people of Sri Lanka.
Strengths and weakness of Data protection and privacy law reform of Sri Lanka
The Electronic Transaction Act, 2006 in Sir Lanka that was enacted to facilitate the
formation of contracts, creation and exchange of data messages, electronic documents etc. But
this Act does not specifically provide provision for data protection and privacy in Sri Lanka. It is
required to develop specific data protection and privacy for protecting the personal information
of the individuals. There is lack of specific provision for data protection and privacy in Sri
Lanka. Having specific data protection legislation assist in prohibiting use of personal data of
customers for providing information about various products. Using data protection and privacy
laws by Sri Lanka will ensure them in providing effective security system which will reduces the
chances of cybercrimes in Sri Lanka.
Computer Crimes Act, 2007 in Sri Lanka is not specifically for data protection and
privacy but the main objective of this Act is to identify computer crimes and provide procedure
for investigation and prevention of such crimes. But as there is lack of specific legislation the
data of individual is insecure due to which the personal information of Sri Lanka people is
unsafe. Moreover, Sri Lanka must enact a specific law for data protection and privacy which
will helps in securing the personal information of the people of Sri Lanka.

Comparative perspective from Sir Lanka and another jurisdiction
The data protection and privacy assist in securing the personal information about the
individual. India in order to provide the public with right to privacy and to protect the personal
data of individuals has passed a bill. India has passed the Bill for personal data protection in the
year 2018. This Act is called as Personal data protection Act, 2018. It will apply to processing of
data such as when data is collected, disclosed or processed in territory of India (Belbin, 2018).
As per this Act, the personal data will be processed only for purposes which are clear, specific
and lawful. As per this Act there are various rights which are provided to the Individual as Right
to privacy which consist of Right to confirmation and access, right to correction, right to data
portability, right to be forgotten etc.
In Sri Lanka, The constitution guarantees the protection of fundamental rights of people
but it does not mention the word privacy. As it is identified that there are no specific data
protection legislation in Sri Lanka for protecting the personal information of individual. It is a
disadvantage for Sri Lanka as other countries are having specific legislation for data protection
and privacy which is not enacted in Sri Lank . For example, UK is having data protection Act,
2018 which is not present with Sri Lanka. For the development of effective data protection
legislation it is required to have particular legislation for data protection and privacy in order to
provide the public with specific right to privacy.
At international level the right of privacy is recognized by the UN guideline on
Regulations of computerized personal data file and Right to privacy in Digital age, 2013. The
Data Protection Act 2018 which is a newer version of the old act made in 1998, defines how
personal information is used by the organizations, business or the government. EU has become
of the first of its own in the international legal framework to make the data protection and
privacy as one of the strongest laws around the globe to protect the privacy and information of its
citizen with strict rules and regulations. For the same the EU have published guidelines to the
GDPR (general data protection regulation) as guidance to data protection Act (DPA). These are
published by the European data Protection Board. Moreover, it has another regulation in this
regard for data protection which is the Privacy and Electronic Communication (Ec directive)
regulation, 2011 (PECR).
In India data protection officer will be assigned by data fiduciary for performing function
as per this Act. This Act will help in protecting the personal information of the people of India

which will assist in reducing the chances of data hack from individuals or organisation. Data
protection laws In India also include Information Technology Act, 2000 which gives right to
compensation for improper disclosure of personal information (Jennette Chalcraft CPA, 2018).
This Act contains provisions to prevent the unauthorized use of computers, computer system and
data stored. It helps in protecting the information about individual which assist in reducing the
offences regarding data breach. With the help of this legislation the personal data of person is
secured as it is unlawful to gather the personal information of any individual.
On the contrary, in UK have certain acts and regulation of its own to endure the
protection of personal information of the citizens as well non-infringement of right to privacy.
This can be seen as the approach of the UK have been very clear in past years as a result of
which the DPA have come into existence one of its own law at global level. This has inspired
many couturiers at international level to make significant laws in this regard two of them are Sir
Lanka and India (Robert and Smit, 2018). India has taken inspiration in past few years an in
2018 a draft bill for the same is made a now the nation is waiting for a significant law over data
protection and Privacy. On the contrary to protect the breach of the privacy stick data privacy
legislation has become the demand of the time in Sir Lanka. The nation do not have a single
codified legislation for data protection and privacy as the Computer Crime's Act deals only with
cyber cries but do not provide any guideline for right of the data privacy of a person.
The data protection laws of India assist in maintaining effective security system for
protection of data of individual. Data protection laws are important to provide safe and secure
information to the individual. For example, BankBazaar, an online lending marketplace, is
prepared to implement necessary data protection standards whenever the law is implemented.
Parag Mathur, General Counsel and Head of Compliance, says, “The average BankBazaar
customer is mobile-centric with the inclination towards a digital format. Currently, we are seeing
90 million visitors in a quarter from more than 1,300 cities across India. Stakeholders must come
together to enact a law which places the customer in charge of data, and companies should
provide value – added services in exchange for that data.
In past with the older version of the DPA the UK was criticized for its inherent gap and
inconsistencies in privacy law reforms. This shows the need of reform in the privacy act and for
the same UK have taken significant steps be formulating GDPR which is essence of the time.
Europe is now covered by the world's strongest data protection rules with mutually agreed

general data and protection regulation which came into force on 23th may 2018. Back in 1990,
UK used to struggle to keep the pace with rapid technological changes. With the GDPR all the
businesses, organizations and even the government is altered on how the personal information
and data of the citizen as well as international consumers must be handled. With a single act over
the protection of data and privacy a control over the cyber and electronic crime has been
mentioned (Nissenbaum, 2018). Previously the data protection in UK was based on the directives
one the legislation which is designed to harmonies data privacy law across the UK with
providing greater protection and rights to the individual.
Lack of data protection laws hampers the security system of the country due to which
many crimes and offences take place. Sri Lanka is having weak data protection legislation due to
which many offences take place regarding hacking of information of various people. Data
protection Act is important as it contains set of principles which government and organisation
have to comply with to keep the data of individual accurate, safe, secure and lawful (Sarabdeen
and Azaad Moonesar, 2018).
The personal data protection Bill is passed in India and is not yet enforced which is a
drawback as until the date enforcement of this Act there are chances of data breaches. Data
protection laws are made in order to prevent breach of personal information and provide the
individual with safe and secure privacy for their data as per Information technology Act, 2000
(Barkatullah, 2018). There are no specific provision which for protecting the personal
information and privacy of individual. It is required to have effective data protection provisions
to provide safe secure information to individuals. The current legal framework of India is
information technology Act, 2000. It lacks sufficient legal and procedural safeguard to protect
individual civil liberties.
UK Data Protection and Privacy Act, 2018 is enacted to protect the information of
individual residing in United Kingdom. The Data protection Act, 2018 is the Implementation of
general data protection regulation which is effective in maintaining the privacy of the individual
and will protect the individual information from various data breaches.
There are various data protection principles which are mentioned in this Act which
everyone has to follow in order to use the personal information of any individual. It includes
Information must be used fairly, lawfully and transparently. This Act provide strong legal
protection for more sensitive information such as race, ethnic background, political opinions etc

(Data protection in the UK (England and Wales): overview, 2018). Moreover, it is the right of
individual to know about their information stored by organization and government (Dimitrova
and Brkan, 2018). The data protection and privacy Act, 2018 is a strength as it assists in
reducing the chances of data breach which leads to criminal offense as per this Act.
If it wants to fully integrate with global digital economy (Yeh, 2018). In Sri Lanka there
is need to have comprehensive data protection regime with an institutional framework. The
information and communication technology legal advisor Jayantha Fernando provided with gaps
in Electronics transaction Act ,2006 which fails to protect customers in digital era. The personal
data protection Act, 2018 will prohibit the organisation and government to take the personal
information of individuals (THE PERSONAL DATA PROTECTION BILL, 2018). India by
effectively implementing the legal framework for data protection and privacy will be able to
reduce the criminal offences which take place due to hacked personal information of individuals.
This legal framework will help in maintaining and controlling the privacy of individual (Bailey,
2018). This data protection legislation will act as strength for India and will reduce the changes
of data hackings and breach of data privacy and will provide right to privacy to every person
residing in India. It is important to have effective legal frame work for protection of data of
individual.
On the Contrary, Sir Lankan do not have strong data protection legislation which will
assist in protecting the data of individual and providing the freedom of privacy. This Legislation
assist is not -present in Sri Lanka which act as weakness for Sri Lanka as there are more chances
of data breach and personal data hacking. Sri Lanka must adopt the legal framework for data
protection and privacy which will assist in getting better secure connection for protecting the
personal data of individual residing in Sri Lanka (Custers and et.al., 2018). Data protection
assist in providing between and secure legal framework for the offences which causes data
breach in the country. It helps in protecting the personal information of the individual by
enacting the effective rules and regulation in such as general data protection regulation which the
most effective for protecting the personal information of the individual residing in Sri Lanka.
Sri Lanka by adopting GDPR will be able to provide the people with fundamental right
to privacy. There are various companies in Sri Lanka which are dealing with EU companies.
Sri Lanka in order to avoid the risk of losing EU customers must comply with GDPR. In Sri

Lanka there are 30% of people which Have access to Internet. Thus, It needs to move towards
establishing data privacy as a fundamental rights of people.
Recommendations
From the above analysis of legal framework over data protection and privacy of Sri
Lanka with comparison to jurisdiction of India and UK the fact has been identified that UK has
strongest in data protection in international level. India is on its way of improvising the laws and
legislation in this matter, as a draft bill for the same is made in 2018. So, soon India will aloes
have an effective law in this regard. Sir Lanka do have legal framework for correction of
personal information of citizen but all of them are a decade old nothing precise have been done
in recent years. This calls for reform in Sri Lankan jurisdiction over the right of privacy, data
protection as well as cybercrime prevention. The reform in legislation in Sir Lanka is asserted in
order to reflect recent changes and trends in the international level.
Despite the fact the there are laws made in this regard as remedy is available for violation
or breach of the privacy under the common law of Sri Lanka. Still, the need for effective
legislation for recognition of the right of the privacy as well the guidelines and rules of handling
the private data remains open. To shut it out and meet the need of present time Sri Lankan
government is required to look into this matter for bringing reform in the legal framework over
the protection of personal information and keeping intact the right of privacy of people of Sri
Lanka. A clear and certain law in this area has become the demand of the time with existing
circumstances of frauds and misuse of the information through cybercrimes. With an effective,
certain and concise legislative framework over this matter effective legal protection of the data
can be ensured regarding protection of data and right of privacy in Sri Lanka. It is imperative for
Sri Lanka to propose a law on data protection and privacy rights of human in context with
international standards to protecting data and information of the consumer as well citizens as it
is their fundamental right which is also required to protect economic interest as well.
CONCLUSION
From the above report can be concluded that with the technological and digital
advancement cyber and electronic crime rate have increased. It has been clearly identified that
Sri Lanka do not have precise and significant laws and regulation on this subject matter, rather
UK have become the strongest nation in data protection by making DPA, 2018. On the other
hand India have also started following the path of UK as a draft bill over data protection and

privacy in 2018 and the same will convert into law in near future but Sri Lanka have not yet been
started to follow this path. It is not like that Sri Lanka absolutely do not have laws in this regard
but there is no significance presence of the legislation over data protection and for same
recommendation have been and with effective justification.

REFERENCES
Books and Journals
Ahluwalia, S. and Bandyopadhyay, T. K., 2018. Data protection in medical research: A
comparative analysis. Journal of Data Protection & Privacy. 1(4). pp.345-355.
Bailey, J., 2018. Data Protection in UK Library and Information Services: Are We Ready for
GDPR? Legal Information Management. 18(1). pp.28-34.
Barkatullah, A. H., 2018. Does self-regulation provide legal protection and security to e-
commerce consumers? Electronic Commerce Research and Applications. 30. pp.94-101.
Belbin, R., 2018. When Google Becomes the Norm: The Case for Privacy and the Right to be
Forgotten. Dalhousie J. Legal Stud. 26. p.17.
Chatterjee, S., 2018. Surveillance Threating Privacy and Data Protection: A
Review. International Journal of Current Trends in Science and Technology. 8(03).
pp.20583-20590.
Custers, B. and et.al., 2018. A comparison of data protection legislation and policies across the
EU. Computer Law & Security Review. 34(2). pp.234-243.
Dimitrova, A. and Brkan, M., 2018. Balancing National Security and Data Protection: The Role
of EU and US Policy‐Makers and Courts before and after the NSA Affair. JCMS: Journal
of Common Market Studies. 56(4). pp.751-767.
Jennette Chalcraft CPA, C. A., 2018. DRAWING ETHICAL BOUNDARIES FOR DATA
ANALYTICS. Information Management, 52(1), pp.18-25.
Nissenbaum, H., 2018. Respecting context to protect privacy: Why meaning matters. Science
and engineering ethics. 24(3). pp.831-852.
Robert, R. and Smit, L., 2018. The proposal for a directive on digital content: a complex
relationship with data protection law. In ERA Forum (pp. 1-19). Springer Berlin
Heidelberg.
Sarabdeen, J. and Azaad Moonesar, I., 2018. Privacy protection laws and public perception of
data privacy: the case of Dubai e-health care services. Benchmarking: An International
Journal, (just-accepted). pp.00-00.
Van Dijk, N. and et.al., 2018. Right engineering? The redesign of privacy and personal data
protection. International Review of Law. Computers & Technology. pp.1-27.
Yeh, C. L., 2018. Pursuing consumer empowerment in the age of big data: A comprehensive
regulatory framework for data brokers. Telecommunications Policy. 42(4). pp.282-292.
Online
COMPUTER CRIME ACT. 2018. [Online]. Available through :<http:// Sri Lankalaw.lk/Volume-
II/computer-crime-act.html>.