provisions to criminalise the use of unauthorised Virtual Private Networks (VPNs). This would severely impact millions of people in Myanmar who make use of VPNs. Although the use of VPNs has privacy benefits, users are primarily connecting via VPN to access Facebook, which together with a number of media and other sites, is currently blocked by the military regime. Given the dependence on Facebook by many small businesses, education and health providers, and social groups, any move to criminalise unauthorized VPN usage would have a widespread negative impact on many rights holders, including on their right to livelihood, right to health etc, particularly during the COVID pandemic, when Facebook was the main channel for public health information. MCRB compiled analyses of the impacts of the draft law, and shared these with businesses and other groups in support of advocacy against the proposed move, and then compiled and published statements from business associations.6 To date, it is unclear whether the draft law will be adopted in its current form, or amended to reflect the strong outcry against banning unauthorized VPNs. However, the experiences of encouraging business advocacy and collective action against damaging provisions in the draft cybersecurity law have shown that it is possible to align the defence of political rights, such as the right to freedom of expression, the right to information and the right to privacy, and advocacy on protecting economic, social and cultural rights, such as the rights to livelihood and health. By focussing on economic impacts, and amplifying the business voice, it may still be possible to have some impact on an authoritarian regime, at a time when advocacy based on political rights has no traction. 2. Low digital literacy and privacy awareness and practices amongst government and the public MCRB, working with local partners including through the Myanmar Digital Rights Forum, has sought to raise awareness of privacy and data protection.7 Privacy is not, however, a word which translates easily into Myanmar language, or culture.8 Lack of awareness of privacy and digital literacy and the absence of an effective legal framework for data protection can lead Myanmar people to place themselves and others at risk through the publication of personal data or a lack of attention to digital security. Although there is no data on the incidence of identity theft in Myanmar, it is a growing risk.9 Myanmar’s COVID-19 QR pass system was a victim of hacking, and open to identity theft and breaches of privacy.10 The Directorate of Investment and Companies Administration (DICA) and Myanmar Investment Commission were hacked shortly after the coup, leading to the publications of documents from 120,000 companies, including the scans of personal ID of company directors.11 Other Myanmar government sites have been regularly hacked, both pre and post-coup. 6 Update on Draft Cybersecurity Law and its Impacts on Digital Rights and the Digital Economy, MCRB 15 Feb 2022 Four meetings of the Myanmar Digital Rights Forum were held in 2016, 2018, 2019 and 2020. To celebrate Data Protection Day in January 2021, MCRB published a blog on Why Data Protection Matters! in English and Myanmar contextualising it for Myanmar audiences. 8 MCRB translates privacy as ပုဂ္ဂိုလ်ဆုင ဂ ရ ် ာလုခ ိုမှု po-go-sain-ya loun-kyoun-hmu which translates literally as security 7 of the person. but alternative translations include လ ဂို ျှို့ ဝှက် ျက် (secrecy), ကဂုယ်ရရေးကဂုယ်တာ (personal) or သေးသနတ ် ည်ရှဂမှု (being separate) 9 Myanmar Police Force helps investigate Facebook identity theft, Myanmar Digital Newspaper 24 June 2019 Cyberattacks hobble Myanmar’s COVID-19 QR pass system, expose massive security flaws, KrASIA, 1 October 2020 11 Massive data trove from 120,000 Myanmar companies, KrASIAa 21 February 2021 10 4