The Hon. (Dr.) Janaka Senarathna

¶ 01 Thank you, Hon. Deputy Chairperson. We live in an information technology era where data-driven decision-making is reshaping governance. Data can be used for wealth and power, but also can be distorted and abused.

¶ 02 The previous Hon. Member asked about timelines. The Bill brings 13 amendments. Under Clause 2(6) (commencement), except for Section 1, other provisions will commence on dates appointed by the Minister by Gazette. Full implementation requires readiness across public and private sectors; therefore, commencement can be extended, but not less than six months beyond 18 March 2025, to allow readiness.

¶ 03 Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, has been in force since 19 March 2022—the first in South Asia, developed since June 2019 under the Digital Infrastructure Ministry. It aims to protect data subjects in transactions and communications and to foster digital innovation, drawing from the EU’s GDPR.

¶ 04 Section 3(1) of the Act provides that where any other written law conflicts with the Act regarding protection of personal data, the PDP Act prevails. Thus, for example, RTI cannot override the PDP Act’s protections.

¶ 05 By Gazette 2341/59 of 21 July 2023, Part V (the Authority) commenced on 17 July 2023, enabling appointment of the Chair and Board, and full implementation was initially set for 18 March 2025 by Gazette 2366/08 of 08 January 2024. Recognizing implementation challenges across sectors, Cabinet on 19 February 2025 approved targeted amendments (now before the House) to phase implementation and strengthen the Authority.

¶ 06 As of 27 May 2025, the Sectoral Oversight Committee on Science, Technology and Digital Transformation noted: though enacted in 2022, practical implementation faced hurdles; the 13 amendments address these; phased implementation is provided; and the Authority is being staffed (42 positions) with public awareness identified as the first priority.

¶ 07 Some areas still lack basic connectivity; digitalization requires time and infrastructure. Our policy declaration “A Prosperous Country – A Beautiful Life” sets out digital state, legal reforms (including privacy and data protection), and expansion of the IT workforce to 200,000 by 2030.

¶ 08 I also note concerns about irresponsible exposure of personal data and images by some social media pages and even mainstream media without due inquiry, which can inflame communal or religious tensions. Responsible data practices are essential.

¶ 09 Thank you.