ANALYSIS OF THE PROVISIONS OF THE DRAFT CYBER SECURITY LAW This analysis of the draft CyberSecurity Law (Myanmar draft dated 6 February 2021, Unofficial EN Translation MCRB 12 Feb) identifies a number of serious problems with the draft including, but not limited to, its impact on the right to privacy (Section 357 of Myanmar’s Constitution), and well as vague/wideranging provisions which impact on the right to Freedom of Expression (Section 354). Other organisations are welcome – and indeed encouraged - to make use of the analysis in their advocacy on the draft law. This analysis is for general informational purposes only and is not intended to constitute legal advice. Reference Chapter V Section 10 (k) read with Chapter X Section 33 and 34 Provision Analysis and Conclusion Section 10 (k) A. Cybersecurity Services Provider means any “online service provider or The responsibilities of the Steering Committee shall be as follows: any cybersecurity service provider using systems or materials similar to To approve or decline to issue the license to service providers prescribed cyber resources related to information technology systems.” in this Law and take any necessary actions in accordance with the B. Online Service Provider “means a person or business which provides policies, strategies, work plans, and frameworks. Online Services used in Myanmar.” C. The definitions of both cybersecurity service provider and online Section 33: service provider have broad interpretation and includes a host of Any person wishing to render Cybersecurity services within the Union services as may be construed from the definitions. of Myanmar shall apply to the Department in accordance with the D. The present version of the Draft Cyber Security Law provides for a stipulations in order to secure the license. separate licensing framework for issuance of licenses for such kinds of services. Section 34: Any person wising to render online services within the Union of Conclusion Myanmar shall register with the Department in accordance with the The law appears to require the licensing and governmental approval of stipulations. cybersecurity service providers and online service providers. This may generally be unprecedented in a Draft Cyber Security Law and be coined as particularly regulated. Especially since, internet service providers as defined under the Telecommunications Law are approved in any case by the Posts and Telecommunications Department. However, the Draft Cyber Security Law, has a very broad definition of Online Service Provider which may extend to beyond what is contemplated under the Telecommunication Laws. Thus, if general online services also need licensing, it may be deemed to be restrictive/timeconsuming and regulative. 1 12 February 2021