Myanmar: Note on New Draft Cyber Security Law The rest of this Note focuses on new concerns based on revised provisions in the current, January 2022 version of the draft Cyber Security Law. Institutional Structures As noted above, we already had very significant concerns with the institutional structures and the powers they wield based on the original draft version of this Law. These concerns have become even more problematical with the current proposed amendments. The powers of the Central Committee, firmly under the control of the military regime, have been expanded in two key areas, both of which relate to other concerns which are noted below. The first, set out in Article 6(j) of the draft Law, gives the Central Committee the power to establish the National Digital Laboratory which will play a key role in approving electronic evidence for court consideration. The second, set out in Article 6(k), grants the Central Committee the power to set out policy, rules, regulations and directives, in coordination with the Central Bank of Myanmar, for online financial services. Another concern is the significantly expanded provisions on electronic certification and licensing of bodies to “operate as an authorised electronic certification issuer” (i.e. to act as a trusted issuer of digital certificates so that third parties may rely on those certificates when used by their subjects or owners, a key foundation of trustworthy electronic commerce). These rules are to be undertaken by a body variously described in English as the “Electronic Communications Supervision Committee”, the “Electronic Communications Supervision Working Committee” and the “Electronic Certification Authority”.5 Article 3(u) defines the latter as “an authorised person to validate the authenticity and integrity of an electronic or digital certificate”, but how this body would be created is not defined in the draft Law (although the Steering Committee, with the approval of the Central Committee, creates the Electronic Communications Supervision Committee). Previously, this area of regulation was conducted by the “Department” which, in turn, was the secretariat of the Central Committee. Thus, while this area of regulation would already have been under the control of the military regime according to the original version of the Cyber Security Law, the rules and institutional structures governing it have been significantly expanded in the current version. Virtual Private Networks 5 It is not entirely clear to us whether these are two or three different bodies or just one body. The Centre for Law and Democracy is a non-profit human rights organisation working internationally to provide legal expertise on foundational rights for democracy. 3