Published: 17 April 2023
Bangladesh’s Data Protection Act, 2023 (Draft) was meant to safeguard the privacy of its citizens, but it could end up doing more harm than good. The government’s decision to retain certain sections in the draft has raised concerns that it could impinge on constitutional rights to privacy, freedom of expression, harm business revenues, and enable arbitrary misuse to target dissent.
At a press conference held on Monday at the TIB head office, observations on the fourth draft of the Act were discussed. TIB submitted a 41-point recommendation on the draft on March 28, 2023, following the government’s call for stakeholder recommendations. Although the government incorporated some of TIB’s recommendations, there are still concerns over the sections it has chosen to retain.
One major issue is the overly broad definition of “person” in the draft law, which includes natural as well as legal persons, i.e., organisations, stakeholders, companies, associations, corporations, cooperative societies, institutions, and statutory bodies. This could mean that everyone, including protection agencies, could be considered data subjects, processors, and controllers in different contexts. TIB sees this as an attempt to ensure government supervision and surveillance of personal data.
Dr. Iftekharuzzaman, Executive Director of TIB, expressed concern over retaining certain sections in the Data Protection Act, stating, “Rather than safeguarding fundamental rights, the government’s decision to keep certain provisions puts individual privacy at risk. The lack of clear definitions and classification of personal data increases the likelihood of arbitrary misuse of the law. Additionally, the proposed agency for data protection is compromised by conflicts of interest and fails to meet global standards.
Data localisation threatens businesses, intensifies state surveillance
Another issue is data localisation, which requires companies to store sensitive data, user-generated data, and classified data inside state borders in locally operated servers. This could deter global companies from operating in Bangladesh as server hosting costs would skyrocket. Small and medium businesses would be deterred from competitive business, and excess business costs would mean higher consumer expenditure. Relevant research shows that data localisation could decrease Bangladesh’s digital exports by 45%, and annual growth might drop by 0.58%. Foreign investments might also decline due to data localisation laws.
Data localisation would also give the government ultimate authority over data surveillance and control. The unchecked power of the government-appointed Data Protection Agency and the lack of authority to ensure checks and balances could be used to suppress constitutional rights to freedom of speech and privacy.
Guilty until proven innocent
Additionally, the draft law has drafted sections that make an “individual” guilty until they prove their innocence, which goes against the fundamental principle of criminal law. The draft law states that if any company commits any crime under this Act, then all owners, chief executives, directors, managers, secretaries, stakeholders, or any other officials will be considered perpetrators until they prove that the crime was committed without their knowledge and they took steps to stop the crime.
Sheikh Manjur-E-Alam, Director of Outreach & Communication at TIB, emphasised the legal risks associated with the proposed law, stating, “The draft law’s provision that considers individuals guilty until they prove their innocence poses serious legal risks for civil society organisations, media, and both local and foreign companies. This provision and the government’s broad powers under the law threaten to silence and disable human rights defenders and media organisations.”
TIB urges the government to continue discussing the draft with stakeholders and make necessary amendments in line with global standards to better protect citizens’ rights to privacy and free speech.
