Myanmar: Note on New Draft Cyber Security Law (Article 70). Articles 71-73 grant the Department, with the approval of the Steering Committee, the power warn, impose a fine, or suspend or revoke the service or licence of relevant bodies – namely digital, cyber security or telecommunications service providers – for breach of Articles 34, 36, 54 and 58 (which cover a range of issues such as meeting technical standards, being prepared for cyber attacks, paying taxes and collaborating with the various cybersecurity bodies), and also arguably Article 35 (on content restrictions). Given that the Department and Steering Committee, and presumably eventually the Electronic Communications Regulatory Committee (which is not directly provided for in the draft Law, as noted above), are all fully controlled by the military regime, and hence lack independence from the de facto governing authorities in the country, granting these bodies the power to sanction bodies the operations of which underpin expressive activity on the part of citizens and residents is simply not legitimate. Furthermore, appeals from these decisions go, in the case of a decision by a body which is authorised to issue electronic certificates (as provided for in Article 69), to the Electronic Communications Regulatory Committee (pursuant to Article 75), and in other cases (as provided for in Articles 70-73) to the Central Committee (pursuant to Articles 76-77). The decision of the Central Committee is then final (Article 78). As such, not only are important sanction decisions made at both the initial and appeal levels by bodies which are not independent, but the jurisdiction of the courts to review these decisions is ousted. Whereas Article 61 of the February 2021 version of the draft Law provided generally for criminal penalties for online service providers which failed “to comply with the provisions prescribed in this Law”, that general rule has been removed in the current draft Law and there is presently no specific criminal penalty for breach of Article 35, which contains the content restrictions. Some of the provisions under Article 35, such as spreading mis- or disinformation or spreading sexually explicit content, are the subject of specific sanctions (for these two provisions, respectively, through Articles 90 and 96). And, pursuant to Article 89(c), it is a crime to encourage or assist in giving access to a “cyber source” in violation of the rules, which could be used to enforce Article 35 as well. Article 71, providing for administrative penalties, does reference Article 35 although, at least in English translation, it does not clearly provide for penalties to be imposed for breach of this article. We assume that what is presumably an “oversight” (i.e. lack of a general enforcement provision for Article 35) will eventually be remedied if and when the draft Law is further considered by the military regime. The Centre for Law and Democracy is a non-profit human rights organisation working internationally to provide legal expertise on foundational rights for democracy. 7