The Hon. Anura Karunathilaka - Minister of Urban Development, Construction and Housing

¶ 01 Mr. Speaker, on behalf of the Minister of Digital Economy, I move that “the Bill now be read a Second time.”

¶ 02 We live in an era of a revolution in information. Among various types of information, personal data has become central. A person’s conduct, opinions, commercial activity, health information, exercise, phone usage, social media use—these are all now data, personal data. The world has recognized the value of data; it is becoming an asset. Some believe data may become more valuable than traditional commodities. Hence concepts such as data mining, and concerns about the risks that accompany personal data.

¶ 03 Global approaches include the EU’s GDPR, which requires explicit consent to collect personal data, provides the right to be forgotten, and mandates breach notifications. Brazil’s LGPD mirrors GDPR elements.

¶ 04 Sri Lanka was the first in South Asia to legislate for personal data protection, in 2022. India followed with the Digital Personal Data Protection Act in 2023. Around the world, deliberations continue on regulatory frameworks, institutions, enforcement, and technical safeguards.

¶ 05 Best practice spans three pillars: - Legal: robust law, mandatory compliance by public and private sectors, and strong penalties for violations. - Institutional: a Data Protection Authority with effective oversight and public awareness of data subject rights. - Technical: secure collection, end-to-end encryption, access controls, and Privacy by Design.

¶ 06 The principal Act envisioned full operation by 18 March 2025. Given implementation realities across public and private sectors—and to ensure data subject rights are meaningfully protected with a fully capable regulator—the President, as Minister of Digital Economy, sent two Cabinet communications proposing targeted amendments before full commencement. Those amendments are now before this House.

¶ 07 Key amendments: - Clause 5 amends Section 18 of the principal Act to allow data subjects to seek review of decisions based on automated processing that significantly affect their rights and freedoms. - Clause 6 amends Section 19 to provide appeal mechanisms to the Authority regarding refusals of access and to allow withdrawal of consent under Section 14(1), aligning with GDPR’s international framework including erasure requests. - Clause 10 replaces Section 26 to establish clear rules for cross-border data flows. Data increasingly reside in cloud platforms which may be offshore. Clear conditions for cross-border processing are essential, including adequacy determinations to avoid barriers in international commercial and technical engagements. The amendment facilitates building a fair, standards-aligned regime, while allowing stakeholders time to strengthen human resources, technical capacity, and security controls. It underscores parity between public bodies and private implementers serving public functions.

¶ 08 We aim to create an innovation-friendly, investment-friendly environment—with necessary regulations, rules, and standards—to ensure legal certainty, competitiveness, and international trust. The amendments align Sri Lanka’s framework with international standards while strengthening personal privacy.

¶ 09 I commend the Bill.

¶ 10 Question proposed.