Myanmar
ARTICLE 19
State Administration Council governs the country.181 The suspended privacy protections
included prohibitions on telecommunications operators intercepting communications or
accessing personal data without a warrant or lawful permission.
•
The Electronic Transactions Law 2004 (amended in 2014 and 2021) (ETL): 182 The
military introduced amendments to the ETL requiring those managing personal data to
protect such information and imposing criminal penalties on those who obtain, disclose,
use, destroy, or disseminate personal data without consent. These obligations are
described only briefly and in very vague terms, posing serious compliance challenges for
the private sector.183 They also contain broad exceptions for government authorities, such
as allowing it to gather information about cybersecurity issues of concern in relation to
peace, stability, or national security, offering a legal excuse for the government access to
personal data.
•
Draft Cybersecurity Law (2021; 2022): The military circulated a draft Cybersecurity Law
just days after the 2021 coup. IT dropped this draft after substantial backlash from the
business community and civil society, although a few provisions were integrated into
subsequent amendments to the ETL.184 In 2022, a revised draft was proposed.185 It is
unclear whether the military still intends to introduce this law, which raises serious
freedom of expression and privacy concerns. The draft law would impose registration
requirements and other onerous obligations on digital service providers, create new
intrusive regulatory powers over such providers, and impose local data storage
requirements. It would also criminalise the use of VPNs without government permission.
Myanmar law enables surveillance and lacks a proper personal data protection regime. It
empowers authorities to interfere with internet services and order restrictions on information.
Particularly in the current context, where Myanmar’s military has issued martial law orders
and claims an ongoing emergency, this legal framework enables extensive violations of the
rights to freedom of expression and privacy. With the collapse of the rule of law in post-coup
Myanmar, military de facto actions may be more important than the letter of the law, but the
____________________________________________
181
Myanmar News Agency, Amendment of Law Protecting the Privacy and Security of the Citizens, 13
February 2021, English translation, 14 February 2021.
182 Electronic Transactions Law (Consolidated Version) based on State Peace and Development Council Law
No. 5/2004, 30 April 2004, English translation incorporating 2014 amendments and 2021 post-coup changes.
183 Allen & Overy, Update from On the Ground: Changes to the Electronic Transactions Law and the Impact
on Financial Institutions operating in Myanmar, 15 March 2021, 2.
184 See description of developments at Myanmar Centre for Responsible Business, Update on Draft
Cybersecurity Law and its Impacts on Digital Rights and the Digital Economy, 15 February 2022; ARTICLE
19, Myanmar: Scrap Cyber Security Draft Law and Restore Full Internet Connectivity, 12 February 2021.
185 Free Expression Myanmar, Cyber Security Law (Draft), State Administration Council Law No.-/2022,
English translation with annotated changes from the earlier draft. For analysis and commentary on this draft,
see Centre for Law and Democracy, Myanmar: Note on New Draft Cyber Security Law, April 2022; Access
Now, Analysis: The Myanmar Junta’s Cybersecurity Law Would Be a Disaster for Human Rights, 27 January
2022; Free Expression Myanmar, Military’s Cyber Security Bill Worse Than Their Previous Draft, 27 January
2022.
44