Collection and processing in Sri Lanka
Similar to the GDPR, the PDPA enshrines certain principles governing the collection and processing of personal data. Each controller must ensure that personal data is processed in compliance with such principles, which are as follows.
- process lawfully;
- process for specified, explicit and legitimate purposes and not further process in a manner that is incompatible with those purposes;
- process personal data which is adequate, relevant and limited to the purpose;
- ensure that personal data is accurate and where necessary kept up to date;
- keep personal data in a form which permits identification of data subjects for no longer than is necessary, for the purpose(s) for which the data are processed;
- process in a manner that ensures appropriate security of the personal data, using appropriate technical and organizational measures;
- process in a transparent manner, providing information on such processing to data subjects; and
- ensure accountability in processing by the implementation of internal controls and procedures that are able to demonstrate compliance with the PDPA, identified as the "Data Protection Management Programme" (“DPMP”). The Data Protection Authority has published the draft outline of the Data Protection Management Programme intended to be issued as guidelines by the Authority ("DPMP Guidelines") as a baseline for controllers to follow. It may be noted that the DPMP Guidelines are still at the draft stage and thus may be subject to change.
The DPMP Guidelines provide guidance on the controls and procedures that controllers may adopt in their DPMP and also provide certain illustrations and examples in order to clarify the relevant requirements. A brief outline of the main segments enumerated in the DPMP Guidelines is as follows.
- Duly Catalogued Records: maintenance of records, including the lawful basis for processing, purpose of processing, data minimization efforts, accuracy of data, storage limitation, data security, and transparency of processing, in order to comply with obligations set forth in the PDPA.
- Design Based on Processing Activities: tailoring of the DPMP to suit the structure, scale, volume, and sensitivity of the controller's processing activities, which includes mapping data flows and using a record of processing activities to understand how personal data flows through the controller’s organization in order to manage and protect such data effectively.
- Safeguards and Impact Assessments: planning and carrying out of personal data protection impact assessments (“DPIA”) where necessary, taking mitigatory measures in relation to identified risks and managing the documentation and reporting mechanisms in relation thereto.
- Updates Based on Monitoring and Assessments: regular monitoring and assessment of systems to ensure continuous improvement and compliance with data protection obligations.
- Governance and Oversight: integration of the DPMP into the organization's governance structures, with internal oversight mechanisms to monitor compliance with data protection policies and procedures, together with examples of governance and monitoring tools that controllers may use to achieve this.
- Complaints and Breach Management: mechanisms to be implemented in order to receive complaints, conduct inquiries, and identify personal data breaches, including having an incident response plan.
- Facilitation of Data Subject Rights: mechanisms for facilitation of the exercise of data subjects’ rights through clear and accessible procedures.
Legal Basis
In order to ensure that processing is ‘lawful’ whenever personal data is processed, such processing should be based on the most appropriate legal basis out of the following grounds provided under the PDPA:
- consent of the data subject (consent should be freely given, specific, informed and unambiguous indication in writing or by affirmative action and capable of being withdrawn at any time);
- necessary for the performance of a contract with the data subject in order to take steps at the request of a data subject to enter into a contract with such data subject;
- necessary for compliance with a legal obligation to which the controller / processor is subject to under Sri Lanka law;
- necessary to respond to an emergency that threatens the life, health or safety of the data subject or another natural person;
- necessary for the performance of a task carried out in the public interest or in the exercise of powers, functions or duties imposed under Sri Lanka law; or
- necessary for the purposes of legitimate interests of the controller or a third party (subject to an assessment where the interests of the controller should be balanced against the rights of the data subjects and accordingly, must not override the interests of the data subject, especially when the data subject is a child).
Special Categories of Personal Data
In addition to the aforesaid lawful grounds, if processing special categories of personal data, a controller is required to satisfy one of the following additional conditions, on the objective basis of being most appropriate:
- consent of the data subject, which in the case of a child will mean the consent of the parent or legal guardian;
- processing is necessary for the purposes of carrying out the obligations of the controller and exercising of the rights of the data subject, in the field of employment, social security including pension and for public health purposes in so far as it is provided for in Sri Lanka Law, providing for appropriate safeguards for rights of the data subject;
- processing is necessary to respond to an emergency that threatens the life, health or safety of the data subject or another natural person who is incapable of giving consent;
- relates to personal data which is manifestly made public by the data subject;
- processing is necessary for the establishment, exercise or defence of legal claims;
- processing is necessary for any purpose as provided for under any written law in Sri Lanka or public interest;
- processing is necessary for medical purposes and where such data is processed by a health professional licensed under or authorized by any written law in Sri Lanka; or
- processing is necessary for archiving purposes in the public interest, scientific, historical research or statistical purposes in accordance with law.
Criminal Investigations
The PDPA provides for the processing of personal data in relation to criminal investigations, only where such processing is carried out in accordance with written laws in Sri Lanka, whilst providing for appropriate safeguards for the rights and freedoms of data subjects, which may be prescribed in the future upon the PDPA becoming operative.
Transparency of Data Processing
Transparency is an important principle enshrined in the PDPA and as stated above, it aims to ensure that data subjects are aware of how their personal data is processed and understand their rights pertaining to such data.
Accordingly, the PDPA requires controllers to provide detailed information to data subjects in a concise, transparent, intelligible and easily accessible form. Therefore, providing the following information to data subjects at the point of collection of their personal data is imperative, which can be fulfilled by the provision of a privacy notice:
- identity and contact details of the controller;
- contact details of the data protection officer (where there is a DPO);
- intended purpose for collecting personal data and the legal basis for the processing;
- legitimate interest pursued by the controller (where applicable);
- categories of personal data collected;
- right of data subjects to withdraw consent for processing and method of withdrawing such consent (if processing is based on consent);
- recipients and third parties with whom personal data will be shared;
- details of cross border data transfer;
- period of data retention;
- rights of data subjects with regard to their personal data and how such rights may be exercised;
- right to file a complaint with the Authority;
- whether the provision of personal data is a statutory or contractual requirement and the consequences of failing to provide such personal data;
- the existence of automated individual decision-making including profiling and the consequences for the data subject.
In addition, when a controller intends to process personal data for a new purpose, a data subject must be informed of such further processing, providing them with the information set out above.
If in any event personal data is collected via means other than direct collection from the data subject, the above information should be provided to the data subject within one month or at the time of the first communication to that data subject or when the personal data is first disclosed to another recipient, whichever event occurs first.
The DPMP Guidelines (which are still in draft form), also recommends that the controllers ought to carefully consider the information they must provide, prepare the content in a manner that will be easily understood by data subjects, ensure that it is delivered to them in a way and at a time that allows them to consider it and keep a record of having done so. The controllers must check from time to time with data subjects that the information is readily understood.
Rights of Data Subjects
The PDPA provides a series of rights for data subjects, largely similar to that of the GDPR. A controller must respond to any written request made by a data subject pertaining to his rights within 21 working days of receiving the request.
Right to access personal data: data subjects have the right to access their personal data, be provided with confirmation as to whether such personal data has been processed and be provided a copy of such personal data by submitting a written request.
Right to withdraw consent: if processing is based on consent, the data subject has the right to withdraw such consent at any time and the right to request a controller to refrain from further processing of the data subject’s personal data, provided the processing was based on the data subject’s consent.
Right to object to processing: data subjects have the right to object to further processing beyond the original purpose for which it was collected where such processing is based on the grounds of legitimate interests or public interest.
Right to rectification or completion: data subjects have the right to request a controller to rectify or complete any personal data that is inaccurate or incomplete.
Right to restriction of processing: In certain limited circumstances data subjects have the right to request for restriction on processing of personal data, such as where controllers are required to maintain such personal data for evidentiary purposes under Sri Lanka law or on an order of a competent court, without rectifying, despite the request for correction by data subjects.
Right to request a review of automated decisions: a data subject has the right to request for a review of a decision made by a controller based solely on automated processing which is likely to create “an irreversible and continuous impact on the rights and freedoms of the data subject” under Sri Lankan law, unless such automated processing is:
- authorized by Sri Lanka law;
- authorized in a manner determined by the Authority;
- based on the data subject’s consent; or
- necessary for entering into a performance of a contract between the data subject and the controller.
Right to erasure: the data subject may, under a limited set of circumstances, request the controller to erase their personal data. This includes when a controller is in contravention of its obligations and when the erasure is mandated by a written law of Sri Lanka or order of a competent court.
A controller is permitted to refuse to a request of a data subject based on the above rights only in limited instances, having regard to the following:
- national security;
- public order;
- any inquiry, investigation or procedure carried out under Sri Lanka law;
- the prevention, investigation and prosecution of criminal offences;
- the execution of criminal penalties;
- the protection of the rights and fundamental freedoms of persons under Sri Lanka law;
- where the controller is unable to establish the identity of a data subject;
- the requirement to process personal data under any other law in Sri Lanka.
The draft Personal Data Protection (Exercise of Data Subjects’ Rights and Appeals) Regulations (“Rights and Appeals Regulations”) published by the Authority provides further guidance in this regard. However, the said Rights and Appeals Regulations are still at the draft stage and thus may be subject to change.
In terms of the Rights and Appeals Regulations, every right conferred on a data subject under the PDPA may be exercised:
- in the case of a minor, upon the submission of a certified copy of the birth certificate of the data subject or, any other document to prove the legal guardianship;
- in the case of a mentally unfit data subject, upon the submission of the certified copy of the order issued by a competent court relating to the appointment of the legal guardian or manager for such data subject;
- in the case of a physically unfit data subject, upon the submission of the letter of authorisation issued by such data subject; and
- in the case of an heir, upon the submission of a certified copy of the death certificate of the data subject and a valid document proving the heirship of the data subject.
The Rights and Appeals Regulations also stipulate that any person who is aggrieved by the decision of the controller may, within three months from the date of such decision, prefer an appeal in writing to the Data Protection Authority substantially in the form set out therein through registered post or any electronic communication provided by the Authority.
