The Hon. Eranga Weeraratne - Deputy Minister of Digital Economy

¶ 01 Hon. Presiding Member, the whole world is rapidly advancing through digitalization. Government processes, payments in banking systems, personal health data, digital IDs, e-passports, and communications are accelerating into digital form. Social media carries vast amounts of individuals’ information—knowledge, identity, and relationships. With emerging agentic AI, people can create AI agents to accomplish tasks based on their own behavior and knowledge. Digitalization is now very close to our personal lives, and our data reside in digital systems.

¶ 02 Therefore, securing those data is essential. If systems are insecure, or if data collected for one purpose are reused without permission for another, privacy is harmed. We are bringing a Cybersecurity Bill to protect the national cyberspace. Cybersecurity now matters not only for personal data but also for national security. With both defence-linked and civil cybersecurity measures, we will harden systems and respond quickly to threats.

¶ 03 We also need proper processes for collecting and using data. Public or private entities collecting data must do so with the individual’s consent and only for the consented purpose. A Personal Data Protection Act is necessary to enforce this. The amendments before us will enable effective implementation, so we can mitigate risks and protect data in Sri Lanka.

¶ 04 State data collection is spread across many systems—NIC, e-passport, birth certificates, etc. These systems are often unconnected, resulting in repetitive data collection. Dispersed data are not ideal for protection. We need secure, integrated storage with strong assurances of security. That is why we are working on a National Data Exchange and a national digitalization plan. We must also adhere to principles like purpose limitation and data minimization. Some services collect excessive data; under this law, only the minimum necessary data may be collected.

¶ 05 Previously, when data breaches occurred, there was no clear legal pathway or responsible institution. This law establishes the Data Protection Authority to ensure personal data protection. If a person suffers harm, they can complain to the Authority, which can direct rectification, impose penalties, and order compensation. If unsatisfied, they can go to court for relief under this Act.

¶ 06 We also introduce mandatory breach notification: if a breach occurs, it must be reported to the Authority within 72 hours, and, where serious, also to affected data subjects. This is standard international practice.

¶ 07 Our Constitution guarantees freedom of expression. Implementation via the Authority will safeguard freedoms; where infringed, people can challenge and continue their lawful activities.

¶ 08 For state digitalization—digital ID, e-driving licence, e-motoring, e-lands, digital payments, e-invoicing—public trust is vital. Citizens must be assured that the Government stores data systematically and uses them only for necessary functions. Passing these amendments will help build that trust.

¶ 09 Implementation must not stifle creativity and innovation. AI offers significant opportunities, though we have underutilized it. We must allow platforms to process data where appropriate with robust anonymization parameters, so innovation proceeds while privacy is preserved. AI is essential to speed up state services in the digital era.

¶ 10 We expect, once passed, to staff and prepare the Authority promptly and bring the Act into force within six months via Gazette, covering both public and private sectors.

¶ 11 Question put, and agreed to. Bill accordingly read a Second time.

¶ 12 Resolved: “That the Bill be referred to a Committee of the whole Parliament.” - The Hon. Anura Karunathilaka