The Hon. Ajith P. Perera

¶ 01 Hon. Presiding Member, after the 52-day conspiratorial Government in 2018, I had the opportunity to serve as Minister of Information Technology. I met experts from the public and private sectors and, knowing I would have about one year, I asked what must be done for IT sector development in that short time. They requested leadership to bring a cyber security law and a data protection law. Within days I convened trained legislative drafters, legal scholars, and private-sector stakeholders and, on 4 January 2019, appointed two committees — one to draft the data protection law and another for cyber security. Within about five months we completed the work because experts had studied this field for years, with strong familiarity with GDPR and related standards. By the 2019 presidential election, both drafts and translations were ready.

¶ 02 Unfortunately, the President changed. The experts worked with the new President too, but tabling both Bills was delayed. Fortunately, Act No. 9 of 2022 — the Personal Data Protection Act — was enacted. Having seen practical issues after more than two years of use, I thank and appreciate the effort to update it through this Amendment. However, I cannot understand why the Cyber Security Bill has not been presented to Parliament. Since the Hon. Minister is present, I wish to know why. Cyber security is not only about security; it is essential for economic development, for the IT sector’s growth, particularly the private sector, and for national security. I understand drafting is largely complete. Please bring it urgently, updated to current standards.

¶ 03 I have a concern with this Amendment. Under Clause 13, the requirement to appoint Data Protection Officers excludes public corporations and companies incorporated under the Companies Act, No. 7 of 2007. If we are to make data protection effective, it is essential to have a responsible officer within state entities. If appointment is difficult, the responsibility can be assigned to another officer — but do not exclude public corporations and state-owned companies.