8/23/22, 12:15 AM Update on Draft Cybersecurity Law and its Impacts on Digital Rights and the Digital Economy - News Overbroad Authorities that could severely interrupt or block digital commerce without rule of law protections. Data localisation and retention GNI notes that ‘the draft law would require digital platform service providers with over 100,000 users in Myanmar to store user data “in a place designated by” the Ministry of Transport and Communications, in addition to registration requirements for internet service providers. These companies would also be obligated to retain the unique user-identifying information such as “telephone number, identification card number and address of the service users” and “any other information directed by [the authorities]” (Art. 37), and to provide such information to any “assigned person or authorized organization” that requests it “under any existing law”(Art 38). These provisions are out of line with regional and global standards and expectations and would create significant costs and burdens on covered companies. Taken together, they create a serious risk that these companies would be required to hand over sensitive user data to the government in violation of users’ privacy and expectations, without any due process or independent oversight. Prohibitions on VPNs. Like FEM, GNI draws attention to the prohibitions on VPNs and notes how important VPNs are for business and individuals. The GNI statement challenges the SAC assumption that disruptions to businesses using VPNs can be addressed through waivers: it notes that despite the possible waiver for business “given the fact that their use is being criminalized, it is unrealistic to expect any significant number of individuals or businesses to request or receive such waivers (Art. 62)” A joint statement on 28 January 2022 by the US, EU, Australian, British, French, German, Greek, and Italian Chambers of Commerce in Myanmar and the US ICT Council for Myanmar, and Myanmar Private Equity & Venture Capital Association (PEVCA) expressed deep concern about the draft law and focussed on the provisions concerning Virtual Private Networks (VPNs), nonsocial media digital platform services, and business use of social media, noting that access to information, technology and services is essential to operations and a healthy national digital economy, and that if adopted and enforced, this would disrupt the free flow of information and directly impact businesses’ abilities to operate legally and effectively in Myanmar. This statement is open to other chambers to align to (contact Eurocham). The Asia Internet Coalition an alliance of 16 leading internet companies in Asia issued a similar statement on 14 February noting that the draft law undermines user privacy, limiting freedom of expression and creating undue burdens on domestic and foreign businesses. Adoption of the draft law as written would make compliance by international companies impractical, and the coalition urges the Myanmar authorities to reconsider. The AIC comments that: "Digital economy ecosystems depend on cross-border exchange of knowledge, technical know-how, scientific and commercial information across transnational IT networks, as well as access to digital tools and global market opportunities that help sustain economies, expand literacy, and raise global living standards. The draft law is, therefore, contrary to the digital economy goals of Myanmar, and will disrupt business continuity, reduce opportunities for digital innovation, including various missed opportunities for inclusive development, thereby causing wider economic losses, less predictable investment climate, reduced foreign direct investment. The draft law, which is not aligned with international best practices, would deprive users and businesses of products and services that digital platforms offer". Individual companies such as Telenor have also issued public statements, and law firms have issued analyses. The Union of Myanmar Chambers of Commerce and Industry submitted comments which cover issues such as the impact of the VPN user ban, and encourage the Ministry to undertake wider consultation on a number of the problematic issues in the draft. The Myanmar Computer Federation is also believed to have provided a limited response. MCRB View MCRB shares the above analyses, and in particular, the view of UMFCCI and other organisations that the proposed ban on VPNs and similar technologies would pose a significant burden to the country and wider society, and that Articles 62 and 90 relating to VPN usage should be dropped. Taken with the current SAC-imposed blocks on many social media sites, particularly Facebook, these provisions would mainly criminalise those who use Facebook to communicate, since VPNs are needed to access Facebook and other blocked sites provided by the internet services which are obeying the Ministry’s instructions. https://www.myanmar-responsiblebusiness.org/news/draft-cybersecurity-law.html 3/5