The newly-adopted 2021 Electronic Transactions Law Amendment seriously threatens the right to freedom of expression and the right to privacy in Myanmar.

The “adoption” of the Electronic Transactions Law (ETL) “Amendment” was announced on State television on 15 February 2021. The repressive ETL was created in 2004 under the previous military government to regulate devices and control phone and internet users. It was amended in 2014 to remove some problematic provisions. 

There was no forewarning of the 2021 ETL Amendment and no opportunity to consult. It came just days after the State Administration Council circulated a draft Cyber Security “Law” (CSL) to telecommunications businesses, the content of which received widespread condemnation from 250 civil society organisations, FEM, digital associations, business associations, and international sources. 

If the CSL is later adopted, it will repeal the ETL in its entirety (CSL Art. 89). Therefore, the purpose of amending the ETL is unclear. Perhaps the State Administration Council has delayed the CSL due to the widespread condemnation, or perhaps the ETL Amendment is intended to serve in the immediate-term before the CSL is brought into force at a later date.

FEM has analysed the 2021 ETL Amendment based on international standards on freedom of expression. Previous analyses of the 2004 ETL and the 2014 ETL amendment can be found on the FEM website. Much of the content of the 2021 ETL Amendment has been copied from the draft CSL, and this copied text has been marked in blue in FEM’s unofficial translation of the document.

Increase in criminalisation

The 2021 ETL Amendment includes several of the problematic criminal provisions proposed in the CSL. It copies five of the draft CSL crimes (Art. 9 / 38): failure to manage personal data (Art. 38a); various forms of sharing or modifying personal data (Art. 38b); spreading false information (Art. 38c); various forms of hacking or interfering with data (Art. 38d); and damaging foreign relations (Art. 38e). The sanctions have been copied across, with new minimum prison terms of one year and maximums of between three and seven years.

Each of these criminal provisions would fail to pass the three-part test in international law. They have not been written in sufficient precision for people to understand what is lawful and what is not. They are too vague and overly-broad to achieve one of the legitimate aims for restricting freedom of expression. Several of them include clearly disproportionate prison terms and would create significant harm to the right to freedom of expression as well as to digital rights more broadly. 

There is a significant risk that these new crimes will be arbitrarily and punitively used to restrict civic space. Given past experiences of how vague legal provisions have been misused in Myanmar, the risk is that long prison terms will be handed down, for example, to political activists for sharing information (Art. 38b), to journalists for writing news critical of the State Administration Council (Art. 38c), to internet users for using VPNs or encryption (Art. 38d), and to human rights defenders for raising human rights violations to the attention of the international community (Art. 38e).

Problematic data protection rules

The 2021 ETL Amendment adds a new chapter to the law titled, “Protection of Personal Information” which includes just one solitary article (Art. 7 / 27) with 11 subsections copied from the draft CSL (CSL Art. 13-15). It establishes a very basic system of data protection and assigns duties to data controllers (Art. 7 /27a). These duties are substantive but are noticeably ill-defined. What little protection they may provide is substantially undermined by the list of vague exceptions, which give the authorities broad interception powers (Art. 7 / 27c).  These include, for example, to prevent the extremely vague act of “cyber misuse” (Art. 7 / 27c1). 

Chapter 10 represents a significant risk to civic space. It provides the State Administration Council with broad powers of interception without even the most basic safeguards for misuse. There are no requirements for court warrants or for adequate legal grounds for interception. There are no limitations to the types, scale, or private nature of the data that can be intercepted. There is no clarity on how intercepted data should be handled, or for how long. There is also an opposing risk that the vague subsections could also be misused to further facilitate State secrecy under guise of data protection. These risks are likely to have a chilling effect on freedom of expression too. 

The new Chapter 10 is glaringly insufficient to tackle Myanmar’s genuinely pressing need for proper regulation of privacy in the digital space. The exceptions are so vague as to render the protections largely meaningless. Furthermore, the 2021 ETL Amendment, with its broad exceptions to limited data protections, has been adopted in parallel to the State Administration Council suspending the limited privacy protections in the Law Protecting the Privacy and Security of Citizens.

Differences with the draft Cyber Security Law

The 2021 ETL Amendment has not included all of the problematic aspects of the CSL. It does not give the military’s State Administration Council the same absolute control over Myanmar’s internet or give the same direct control over data. It does not explicitly regulate internationally nor regulate intermediaries like Facebook, Google, and Telenor to the same extent. However, while it does not include those provisions, the vague and broad nature of the new crimes and their long prison sentences will serve as a significant threat to the right to freedom of expression, to digital rights generally, and to civic space as a whole.

Recommendations

The only institution in Myanmar with the constitutional mandate to adopt laws and amendments is the Union Parliament. Therefore, FEM rejects the ETL Amendment in its entirety. Nevertheless, FEM calls on all national and international stakeholders to remind the State Administration Council of their obligations under international law and Myanmar’s Constitution, and to significantly revise any such “law” or “amendment” to reflect those obligations.