"Withdraw DPA (amendment) Bill placed on Gazette in March"

Following is a letter sent by CSOs to President Anura Kumara Disanayake on the proposed amendment to the Personal Data Protection Act 2022

- 

Your Excellency, Re: Data Protection Act No. 9 of 2022

WE write to you in your capacity as the Minister of Digital Economy regarding the proposed amendment to the Personal Data Protection Act, No. 9 of 2022, which was placed on the Gazette on 27 March 2025.

It is noteworthy that Sri Lanka is leading by example in South Asia as the first country to enact digital privacy legislation for the protection of its citizens. However, we would like to bring to your attention that the enactment of the Personal Data Protection Act (PDPA) in 2022 was met with criticism by media associations, civil society and members of the opposition, including members of your own party, due to its inability to fulfil the stated aim of safeguarding digital privacy. Regrettably, the proposed amendments to the PDPA do not rectify the concerns raised in 2022.

A crucial shortcoming of the Act is the power of the President to appoint members to lead the Data Protection Authority (DPA). The appointment process is not independent and hence does not guarantee that the DPA will function without political interference by successive governments. In this context, there is risk of the DPA being deliberately under-resourced or the staff lacking subject-domain expertise, which will adversely impact its ability to conduct investigations, develop robust guidelines, handle complaints efficiently, or effectively supervise complex data processing activities, especially when related to AI.

With the mandate to oversee the implementation of the Act, the DPA can carry out executive, administrative and quasi-judicial functions, including conducting investigations, issuing instructions to data controllers/processors and citizens for compliance and imposing hefty fines for non-compliance. With such a broad range of functions, it is imperative that the governing body is appointed with the approval of the Constitutional Council and does not function at the whim of the government in power.