The Hon. Kanthasamy Prabu

¶ 01 Hon. Deputy Chairperson of Committees, thank you for the opportunity to speak in the debate on the Personal Data Protection (Amendment) Bill to the Act No. 9 of 2022.

¶ 02 The Personal Data Protection Act, No. 9 of 2022, is a milestone in Sri Lanka’s legal history — the first such law in South Asia on personal data protection, heavily inspired by the EU’s GDPR with similar principles and standards. From June 2019 onwards, under the then Ministry responsible for Digital Infrastructure, multi-stakeholder consultations and public input led to a transparent process. The Act came into operation on 19 March 2022. It establishes a regulatory framework to protect personal data of data subjects engaged in transactions and communications, while facilitating innovation and development in the digital economy, as emphasized in its preamble.

¶ 03 The Act regulates processing of personal data — any information by which a “data subject” can be identified directly or indirectly — and protects the privacy of data subjects against harmful impacts from both public authorities and private entities. The Act protects the personal data of both citizens and non-citizens alike, and was expected to be fully operational by 18 March 2025.

¶ 04 However, recognizing the importance of a future governance framework that supports both public and private sectors in adopting digital strategies, and the need to establish a capable regulator to meaningfully protect the rights of data subjects, the Cabinet on 19 February 2025 approved a memorandum by the Minister for Digital Presidency to propose amendments before full implementation. Many public sector entities indicated the need for more time to fully comply with the implementation provisions, especially to develop human, financial, and technical capacities. The proposed amendments create an opportunity to prepare more fully, including for AI systems adoption, and to offer the public sector greater flexibility similar to the private sector.

¶ 05 As the law applies to central ministries and departments, provincial councils, local authorities, district and divisional secretariats, and up to Grama Niladhari level, the Government recognizes the need to extend implementation dates to ensure all stakeholders are properly restructured and prepared.

¶ 06 In recent years, individuals’ data have been misused oppressively in many ways, and individual freedoms were severely affected, with fake campaigns spread via social media, leading to inter-ethnic tensions. We expect these amendments to help curb such abuses and control harmful propaganda, strengthening communal harmony.

¶ 07 The Government is proceeding to pass this Bill with amendments to create a strong law to legally control individuals and groups who release fake personal data for profit and create confusion among ethnic and religious communities. In the past, large-scale frauds and abuses used falsified data to seize state funds and resources. Public institutions and associated service providers faced severe criticism and loss of trust due to failures to protect data. This Bill with amendments seeks to reverse that state. Information is more valuable than gold or diamonds. As a Government, we must protect it without infringing individual freedoms. We must enact and implement this law to prevent data from being leaked or altered abroad. We know of many frauds committed via online data transfers; this law is needed to prevent them.

¶ 08 This Bill will strongly support the country’s digitalization drive. We must swiftly pass and implement it to transform Sri Lanka into a digital nation. To become a developed nation, we must modernize technologically, as pledged in the Hon. President’s policy statement.

¶ 09 We also expect these amendments to curb fraudulent births and marriage registrations, NICs and passports, land documents, and other records altered for abuse through fake personal data, thereby building future credibility in government services.

¶ 10 In the past, for Middle East employment, personal data were altered to create false documents, facilitating human trafficking and child labour abuses. Sri Lankan migrant workers have suffered harassment. We intend, through these amendments, to end the bad reputation caused to government agencies and to elevate the reputation of the Government’s ICT sector.

¶ 11 This Amendment Bill must not impair individual freedoms, but facilitate digitalization. With that, I conclude. Thank you.