New legislation underway for data privacy, localisation

The government is planning to introduce new legislation to ensure privacy and data localisation for locally produced data.

State Minister for ICT Zunaid Ahmed Palak said a draft of the new law is already underway, speaking at a webinar hosted by Internet Governance Forum on November 6.

Palak informed that data being a national asset needs to be properly categorised to ensure security and privacy during interoperability, due to personal and institutional needs. He also reiterated the importance of a proper legal guideline to govern access and exchange of data.

According to industry experts, cross-border data flow can be of three categories. The first is data residency, where an organisation specifies in which location their data is stored. This is done due to policy, tax or regulatory reasons. The second is data sovereignty, where the stored data will also be subject to law of the land it is stored in. And last is data localisation, which means any data collected, created, or processed inside a country needs to be stored within the country as well. Out of the three, from a regulatory standpoint, data localisation is deemed to be stringent in nature. Right now, Bangladesh does not any specific regulations governing these flows of data.

Currently, the data privacy domain is governed by the Data Privacy and Security Rule, 2019. Although there is no central law dictating data localisation, there are several industry-specific requirements that require storing of data locally such as for telecom, finance, ridesharing, medical etc.

Md Tarique M Barkatullah, the Director of Data Centre operations, has been involved with the upcoming legislation since its inception. According to him, this new legislation is being formulated by a group of experts in coherence with the existing law and by studying existing legislations of other countries. "Policymakers consider now to be the high time to address the issue regarding privacy and security of our national digital asset. This new legislation will cover the shortcomings that we have seen in other countries and we will make it available public to further the discussion soon." He, however, refused to divulge specifics until they are approved, as it might impact foreign investment in the country.

An official within the ministry, requesting anonymity, confirmed that the first draft is almost ready, which will be sent to the highest echelon of the government for review. He also stated that the new legalisation will cover not just privacy and localisation of personal data, but also institutional data.

Former BASIS President and CEO of Bdjobs, AKM Fahim Mashroor welcomed this move.  He said, "Our data is our national asset. We are seeing these data being commercially used by many tech giants and sometimes it can create a monopolistic environment in the market. Many other countries have taken similar move. It's time we did too."