Proposed Personal Data Protection Act could be turned into tool to control, surveil: TIB, ARTICLE 19

The Transparency International Bangladesh (TIB) and ARTICLE 19 have jointly urged the government to make some changes in the proposed Personal Data Protection Act 2024, arguing that some sections of the law could potentially be misused to exert control and surveillance over citizens.

The two organisations also placed some recommendations for a robust protection law at an event, titled "Personal Data Protection Act, 2024 (draft): Better than Earlier, Still a Tool for Control and Surveillance," today (28 April). 

Sheikh Manjur-E-Alam, regional director (Bangladesh and South Asia) of ARTICLE 19, in his keynote speech, said Section 51 of the proposed law mandates storing all classified data within Bangladesh's territory. 

"Such data localisation is a security risk with human rights concerns," he said. "Data localisation can limit free speech and human rights, may increase data security risks and hinder government accountability."

He also said the government has arbitrary authority to determine what data is classified. 

Manjur-E-Alam welcomed the selection of the independent data protection authority to oversee personal data privacy. However, he expressed doubts about the board's ability to remain independent, given its government affiliation.

"Will the board be able to oversee the activities being a body of the government? According to our assessment, they won't be able to work independently."

He proposed an independent data protection commission be formed under the act to ensure proper enforcement of data protection principles.

Manjur-E-Alam also pointed out that millions of birth registration data were leaked or hacked from the national server recently. He questioned whether it's feasible for the government and its affiliates, who handled this information, to scrutinise themselves according to the law. 

He said such self-regulation is unrealistic, not just in Bangladesh but also worldwide.

Section 10 (2-d) allows access to personal data without judicial oversight, he added. "This weakens the Personal Data Protection Act and risks unnecessary intrusion into personal privacy. Judicial oversight ensures legitimate data access requests and protects individual rights." 

Iftekharuzzaman, the Executive Director of Transparency International Bangladesh (TIB), also speaking at the event, said some provisions and sections of the proposed act are contradictory with the basic principles of the constitution. 

"This may hamper any person's privacy or may lead to their personal information being leaked to the public domain. Even the definition of the persona and personal data are also confusing the act," he added.  

The two organisations also recommended strengthening the act's foundation in fundamental rights, narrowing the scope to focus on personal data, and limiting exemptions for activities in the name of "public interest" and implementing a staggered enforcement timeline.