Sri Lanka’s Proposed Online Safety Bill: Regulation, but at What Cost?

By Namashya Ratnayake and Taahira Lafir

Sri Lanka’s fundamental rights jurisprudence has been generally progressive in the interpretation and appreciation of the freedom of speech and expression, including publication. Yet, the tabling of the controversial Online Safety Bill in Parliament on 3rd October 2023 seeks to undo much of this. 

While the beginnings of the Bill can be traced back to 2016, many raised concerns about it being presented for Parliamentary approval now, especially in light of the island-wide protests (“Aragalaya”) the country saw last year. These protests were in fact largely fueled by online discourse and finally led to the ousting of the sitting President.  

In addition to condemnation by several international organizations (including the Asia Internet Coalition, the International Federation of Journalists and the UN Human Rights Office), a staggering 45 or so petitions challenging the constitutionality of the Bill were filed before the country’s Supreme Court. The central allegation was that, despite the Bill’s purported main objective of making online spaces safe, it in actuality deviously curtails the rights and freedoms of online users. In its special determination delivered on 7th November 2023, the Court however held that the Bill could be passed with a 50 percent majority in Parliament, but with the suggested amendments, and did not require a 75 percent majority and a referendum. 

The proponents of the Bill justify it on the basis that it primarily protects women and children online. Yet, the total of only two provisions specifically dedicated for this purpose, the duplication of offences and the Bill taken in its entirety, suggests otherwise. The Bill does seek to protect women or any other targeted persons whose “private information” has been published online to cause harassment. “Harassment” has been widely defined to include the mere causing of  “alarm”, “distress” or “offense”. This provision in essence reintroduces criminal defamation, which was repealed from the Penal Code in 2002 in the interest of promoting and protecting freedom of expression, and furthermore places it at a lower threshold.  Although there is a clause in the Bill which specifically protects children, the protections available are not materially different from those under existing legislation, besides the enhanced punishment. While protection of vulnerable groups such as women and children in a constantly evolving digital sphere is crucial, closer and more specifically tailored protection is necessary.  

The enforcement of the Bill would be the responsibility of a 5-member “Online Safety Commission”. This Commission would be appointed at the sole discretion of the President, calling into question the issue of its political independence. Yet, the Court was satisfied that as the relevant clause set out a criterion for appointments, arbitrary appointments would be guarded against and the political neutrality of the Commission would be ensured. 

The Commission exercises overreaching powers over individuals, internet intermediaries and service providers online.

Individuals are prohibited from making statements which may potentially fall under one or more of twelve categories. At least three pressing concerns about these categories of prohibited statements are that they will in effect suppress legitimate dissent and may lead to self-censorship. 

First, ten out of the listed twelve, relate to “false statements”. A false statement is defined as one known or believed by the maker to be incorrect and untrue and one made with intent to deceive or mislead. It expressly excludes caution, opinion or imputations made in good faith. The Bill imagines what is incorrect and untrue to be straightforward concepts, when in public discourse, this rarely is the case. In any event, if the maker believes that the statement was a “caution”, “opinion” or was made in “good-faith”, the burden is on him or her to establish this.  

Second, these false statements relate to offences which are broadly worded, thus allowing a politically appointed Commission to use a multitude of excuses to arbitrarily target an individual. The Supreme Court deemed unconstitutional two such categories, namely, wounding religious feelings and provoking a breach of peace, due to overbroad wording. However, other vague provisions remain. For instance, “any statement causing a threat to national security, public health or public order or promoting ill-will and hostility between different classes of people” is still prohibited. The nature and magnitude of such a threat and whether it should carry any real and present danger to these broader interests is unclear. Neither is there guidance on what is meant by  “national security”, “public health” or “public order”. This easily permits statements far removed of any actual danger to be criminalised. The Bill also criminalises statements which “outrage religious feelings” or “insult religion or religious beliefs” of any class of persons. These terms are highly subjective. Broadly worded offences relating to highly sensitive subjects like national security and religion are particularly concerning. This is because existing legislation dealing with these matters, including the Public Securities Ordinance and the ICCPR Act No. 56 of 2007, have a notorious reputation for being misused to target minorities and those who are critical of the Government.

Third, many offences under the Bill are duplicated, with there being identical or similarly worded offences in other laws such as the Penal Code. These laws set out different regimes of penalties, all of which are less harsh and do not include doubling of punishment in the event of a second or subsequent conviction. When duplicative offences exist in the law, apart from creating uncertainties, it allows enforcers to pick and choose between regimes based on the accused party. 

Apart from legal action being directly instituted by an aggrieved party, a complaint regarding a prohibited statement may be made to the Commission. In the investigation of such complaint, the Commission may enlist the services of the police. Thereafter, notices may be issued to stop the communication of said statement. The Commission may also refer communications prejudicial to the judiciary to the appropriate Court. Furthermore, in the event of three or more Magisterially confirmed prohibited statements on an online location, the Commission may declare such location to be a “declared online location”, to which separate liabilities apply. 

The Bill also authorises the Commission to proceed against intermediaries (those acting as middlemen) and service providers (those providing advisory or other services relating to the communication of content) – a first in Sri Lanka. Notices may be sent to such entities to disable access to or remove “prohibited statements” where the accused party has not removed the content after being notified to do so. The Commission may also issue, with the Parliament’s approval, “codes of practice” for such entities for which damages are payable in the event of wrongful loss pursuant to their non-compliance. Further, websites providing social media platforms must register with the Commission in accordance with the rules formulated by the Commission itself. In the case of online accounts deemed to be “inauthentic”, the Commission may issue a notice on service providers to restrain access to such accounts. The Bill thus imposes onerous obligations on these entities, even potentially requiring a large-scale change of their operations. This could force these entities to take down content out of fear of being held liable or even cause them to withdraw their services from Sri Lanka altogether. 

Furthermore, while the above mentioned notices only involve an order of a Magistrate in the event of non-compliance, until then, once a complaint is made, these individuals and entities are at the mercy of what the Commission deems should be removed. The same may be said regarding the referral by the Commission of communications prejudicial to the judiciary.   

In a welcome amendment proposed before the Court, the State agreed that the Bill would be amended to allow the accused party an opportunity to be heard when investigations are being carried out into an alleged prohibited statement. However, the Bill does not provide for appeals where a notice is issued pursuant to an investigation, making the 24-hour compliance requirement imposed on individuals and thereafter the relevant entity all the more impractical. 

The Bill further permits the designated Minister to appoint experts, who may even be private actors, to assist in investigations of the Commission. It is concerning that private persons may be given broad powers, including the power to access any information system or computer, question any person or obtain any information from a service provider, though upon a warrant issued by a Magistrate or a direction of the stipulated police officer. In its determination however, the Court only held that the appointment of experts must be streamlined by a set of guidelines as to competency or otherwise.     

While it remains to be seen whether this Bill will pass muster in Parliament, what is evident is that the Bill, as it currently stands, seeks to excessively regulate discourse and debate in the digital public sphere, thereby having a chilling effect on the freedom of speech and expression online. In a political climate where there is a concerted effort by the government to clamp down on dissent, the Bill, which was not preceded by any meaningful stakeholder consultation, presents itself as a potential weapon capable of jeopardizing freedom of speech and expression; the very foundation of a free and democratic society.