ANALYSIS OF THE PROVISIONS OF THE DRAFT CYBER SECURITY LAW Chapter VI Section 13 A Personal Data Holder: Sections a) Shall systematically maintain, protect, and manage the 13, 14 and data concerned subject to the type of data and 15 confidentiality level in accordance with the law; b) Shall not carry out the following other than with the permit under any provisions of any existing laws or approval of the owner of such personal data: allow any persons or organizations to scrutinize the personal data that are under his or her administration; disclose, notify, distribute and send such data to any persons or organizations; alter, delete, copy, and submit any personal data as evidence; c) Shall not use any personal data for administrative purposes that are not consistent with the objective; and d) Shall systematically delete personal data, which are collected with the aim to use them within the limited period, when a valid period for using them is over. A. Personal Data under the Draft Cyber Security Law means any information which has been or could be used to identify a person. B. Personal Data Holders need to protect all personal data and manage such data maintaining a high level of confidentiality. Transfers/distribution of personal data is barred without receiving consent/approval from the owner of the data under Section 13. C. However, upon a reading of Section 14, it may be interpreted that the investigation team (governmental authority) can receive the personal data in accordance with law without any need for a consent or a warrant/sanction from a judicial body of competent jurisdiction. D. Therefore, the provision fail to stipulate or provide for any conditions under which personal data may be transferred to the investigation team. This may be considered to be a loss of privacy in so far as distribution/transfer of personal data to the investigation team is concerned. Section 14: An investigation team that receives the information including personal data under any existing law or a person assigned by this team or under a direction thereof shall keep such information as confidential other than needing to disclose them subject to the law. E. There is not enough statutory data protection given to personal data. However, there is a wide carve-out given under Section 15 with provisions to government activities on search, investigation, evidence, and other law enforcement sector activities where the management of personal data shall vest entirely with the governmental authorities. Section 15: The following activities shall not be applicable to the management of the personal information: a) Submission of any evidence to the court, prevention, investigations, and detection by the government departments, investigation teams or regulatory bodies Conclusion This provision may be considered as restrictive of the citizen’s privacy rights under the Privacy Law 2017 which states that “every citizen has the right to enjoy the protection of his/her privacy” and the Constitution of Myanmar (“Constitution”) states that the Union shall be responsible to protect the privacy of its citizens. 2 12 February 2021