Don't rush DPA enactment as new version too misses key concerns

Transparency International Bangladesh (TIB) has reiterated its apprehension regarding the proposed Data Protection Act (DPA), citing that many of its recommendations aimed at addressing human rights violations remain unaddressed in the latest iteration of the draft legislation.
Highlighting numerous risk factors, ambiguities, complexities, redundancies and potential loopholes within certain provisions of the draft, TIB has called upon the government to exercise caution and avoid hastily enacting the law, as it still contains some "restrictive" elements.
At a press conference at its office in the capital on Wednesday, TIB also called for bringing required amendments to the draft law in line with suggestions by stakeholders.
While presenting TIB's review of the law, Dr Md Toriqul Islam, data protection officer at TIB, said the draft DPA should be renamed the 'Personal Data Protection Act, 2023' instead of the 'Data Protection Act, 2023' as it aims to ensure the fair, transparent and secure processing of individuals' personal data.
The draft law should incorporate the age of majority for children's consent as between 13-16 years, aligning with prevailing international best practices, he said, adding that such recommendation is still unheeded.
The unclear rationale for proposing the government as the appeal authority in sections 59 and 60(3) of the previous DPA version raises concerns, as international best practices advise against the government's involvement due to its dual role as a data subject and controller, potentially leading to conflicts of interest, Islam added.
At the press conference, TIB acknowledged that some of their recommendations had been accepted in ongoing discussions, but maintained that significant areas of concern remained in this latest draft.
The Bangladeshi branch of the Berlin-based anti-graft watchdog also suggested revisiting and amending section 60, which is rooted in the principles of fairness, due process and the prevention of arbitrary misuse of power.
It recommended that the draft law include provisions to ease the burden on small businesses due to record-keeping rules in section 27.
TIB also expressed concerns about the appointment of a data protection officer for all types of businesses or organisations in Bangladesh, as stipulated by section 31 of the previous draft of the DPA.
In its previous submission, TIB also reiterated that the draft DPA should clarify whether foreign residents will have the same rights as Bangladeshi citizens.
Besides, it added, the legislation should outline any obligatory conditions for foreign nationals to access services under the DPA. This should include specific regulations for data collection, retention, transfer and processing principles applicable to refugees hosted in Bangladesh, among other aspects.
Speaking at the function, Dr Iftekharuzzaman, the executive director (ED) of TIB, said, "Certain provisions pertaining to human rights violations in the law still remain restrictive."
He urged the government not to rush the enactment of the legislation while keeping these concerning elements unchanged.
"The concerning issue is that human rights concerns in the preamble of the draft law are only partially emphasised," Dr Zaman remarked. "The preamble of the law should align with both our constitution and international best practices."
In response to a media query, he added, "The current draft law still contains significant contradictions and conflicts with international best practices."

sajibur@gmail.com