Human rights of data subjects: Does Personal Data Protection Act safeguard digital privacy?

ON 1 April 2025, Twitter/X user Dinidu de Alwis posted a thread on what he labelled “Sri Lanka’s biggest cybersecurity incident”.

- By Nida Admani

Cargills Bank PLC had experienced a cybersecurity incident and hackers reportedly posted thousands of internal files held by the banks on to the internet. Among others, these include personal data of their customers, staff and board of directors, and information on internal processes and human resource systems of the bank.

Although Cargills Bank had issued notice of an “unauthorised access to a peripheral system” via the Colombo Stock Exchange, no reported steps had been taken to inform the data subjects i.e. the persons whose personal data had been released online, of the breach of the bank’s system and the resulting breach of privacy of its clients.

The timing of this event is extraordinary, as on 27 March 2025, the Government issued a bill to amend the Personal Data Protection Act (PDPA). The Act, which was passed in 2022, is yet to fully come into force, as public and private institutions require time to expand their capacity and employ requisite expertise to fully comply with their obligations under the Act.

The UN Special Rapporteur on privacy, in a 2024 report stated: “Data subjects find themselves in a position of defencelessness owing to their limited knowledge of the use that third parties make of information concerning them, since in practice they are unable to follow up on or monitor this use. This has repercussions for their ability to control their data - the essence of the fundamental right to personal data protection.” To clarify, personal data is any identifying information of a person (a data subject). A data controller refers to an individual or entity that “determines the purposes for which and the means by which personal data is processed” this can include both State and non-State entities, such as commercial corporations and non-governmental organisations.