ANALYSIS OF THE PROVISIONS OF THE DRAFT CYBER SECURITY LAW i) Electronic information and infrastructure that are not related to the public. Conclusion The entire mechanism of what constitutes ‘Critical Information Infrastructure’ Section 17: and the government’s free role in its determination and control may be The Central Committee shall: considered as restrictive of the fundamental freedom of privacy. a) May amend the list of the Critical Information Infrastructure as necessary with approval from the State Administration Additionally, Section 58 also seems like a very strict penalizing provision Council; including imprisonment: “If a person responsible to manage critical information b) Shall direct the Ministry to inform about any stipulation and infrastructure is convicted of failure to perform his or her duties under Section amendment of the list of the Critical Information 20, he or she shall be punishable by an imprisonment for a term not exceeding Infrastructure, that is prescribed according to the relevant 3 years or a fine not exceeding MMK 100 lakhs or both. sector, to the person who is responsible for processing and maintaining of the Critical Information Infrastructure of the Related Ministries and government organization; and c) Shall set out the policies for the storage and maintenance of the facts and information that are related to the Critical Information Infrastructure. Section 20: The person responsible for the processing and maintaining of the Critical Information Infrastructure: a) Shall keep the facts and information, that are related to the Critical Information Infrastructure, at the place determined and approved by the Ministry; b) Shall distribute, issue, send, receive and keep the facts and information that are related to the Critical Information Infrastructure in accordance with the stipulations; and c) Shall submit the Cybersecurity report to the Related Ministries at least once a year. Chapter IX Definitions: A. The definition of Online Services (any activity where service is provided online using the cyber/internet space) under the Draft Cyber Security Law Section 28 Online Service Provider “means a person or business which is broad enough to capture many forms of general online services. provides Online Services used in Myanmar.” Chapter X B. Online Service Providers, will need to register as a company under the Online Services means “any activity which provides a service online Myanmar Companies Law as per Section 28 (b) and also pay relevant taxes Section 34 using Cyber-Resources or similar systems or materials. 4 12 February 2021