Myanmar ARTICLE 19 State Administration Council governs the country.181 The suspended privacy protections included prohibitions on telecommunications operators intercepting communications or accessing personal data without a warrant or lawful permission. • The Electronic Transactions Law 2004 (amended in 2014 and 2021) (ETL): 182 The military introduced amendments to the ETL requiring those managing personal data to protect such information and imposing criminal penalties on those who obtain, disclose, use, destroy, or disseminate personal data without consent. These obligations are described only briefly and in very vague terms, posing serious compliance challenges for the private sector.183 They also contain broad exceptions for government authorities, such as allowing it to gather information about cybersecurity issues of concern in relation to peace, stability, or national security, offering a legal excuse for the government access to personal data. • Draft Cybersecurity Law (2021; 2022): The military circulated a draft Cybersecurity Law just days after the 2021 coup. IT dropped this draft after substantial backlash from the business community and civil society, although a few provisions were integrated into subsequent amendments to the ETL.184 In 2022, a revised draft was proposed.185 It is unclear whether the military still intends to introduce this law, which raises serious freedom of expression and privacy concerns. The draft law would impose registration requirements and other onerous obligations on digital service providers, create new intrusive regulatory powers over such providers, and impose local data storage requirements. It would also criminalise the use of VPNs without government permission. Myanmar law enables surveillance and lacks a proper personal data protection regime. It empowers authorities to interfere with internet services and order restrictions on information. Particularly in the current context, where Myanmar’s military has issued martial law orders and claims an ongoing emergency, this legal framework enables extensive violations of the rights to freedom of expression and privacy. With the collapse of the rule of law in post-coup Myanmar, military de facto actions may be more important than the letter of the law, but the ____________________________________________ 181 Myanmar News Agency, Amendment of Law Protecting the Privacy and Security of the Citizens, 13 February 2021, English translation, 14 February 2021. 182 Electronic Transactions Law (Consolidated Version) based on State Peace and Development Council Law No. 5/2004, 30 April 2004, English translation incorporating 2014 amendments and 2021 post-coup changes. 183 Allen & Overy, Update from On the Ground: Changes to the Electronic Transactions Law and the Impact on Financial Institutions operating in Myanmar, 15 March 2021, 2. 184 See description of developments at Myanmar Centre for Responsible Business, Update on Draft Cybersecurity Law and its Impacts on Digital Rights and the Digital Economy, 15 February 2022; ARTICLE 19, Myanmar: Scrap Cyber Security Draft Law and Restore Full Internet Connectivity, 12 February 2021. 185 Free Expression Myanmar, Cyber Security Law (Draft), State Administration Council Law No.-/2022, English translation with annotated changes from the earlier draft. For analysis and commentary on this draft, see Centre for Law and Democracy, Myanmar: Note on New Draft Cyber Security Law, April 2022; Access Now, Analysis: The Myanmar Junta’s Cybersecurity Law Would Be a Disaster for Human Rights, 27 January 2022; Free Expression Myanmar, Military’s Cyber Security Bill Worse Than Their Previous Draft, 27 January 2022. 44