Digital rights: Agenda for change

Nepal recently elected a new House of Representatives and a government through a general election. The previous parliament was unable to accomplish much in terms of policy making, with several sessions ending without passing any bill. Previous governments were preoccupied with dissolving the parliament or securing a vote of confidence, making policymaking a low priority. As a result, the law and policy making process was hindered, leading to several digital rights initiatives being neglected. The newly-installed coalition government faces its own set of challenges. Early indications are not promising, as much of its energy appears to be channelized on keeping the coalition intact. To regain the trust of the public, media, and civil society, who are closely monitoring its performance, it is crucial for the government to redirect its focus and priorities. Failure to prioritize policy making will not only hinder the development of the ICT sector and compromise digital security, but also negatively impact the digital rights of citizens. This write-up aims to highlight the significant issues regarding digital rights and security in Nepal, and to encourage the legislative and government bodies to prioritize these issues to safeguard, enhance, and fortify the digital rights and security of its citizens.

IT bill

In Nepal, the Electronic Transaction Act 2063 (ETA 2063) is the only existing law to regulate and monitor cyberspace. The act has been amended once, solely to address online gender-based violence. Despite various issues and shortcomings in the ETA 2063, no timely update has been made to keep up with advancements in the digital world. Additionally, stakeholders such as the Federation of Nepali Journalists and other civil society organizations have reported that authorities have misused provisions of the act to restrict the freedom of expression. A case challenging the legality of Section 47 of the act is pending at the Supreme Court. The prior administration created the Information Technology Bill 2075 to regulate the IT sector, replacing ETA 2063. The bill was presented to the lower house of Parliament in Falgun 2075 and has been scrutinized by stakeholders, who have called for the removal of overly strict and unclear provisions that could limit freedom of speech. It's crucial for the government to hasten the introduction of this bill through an open and transparent consultation with stakeholders. Comprehensive data protection law The Constitution of Nepal guarantees the Right to Privacy as a fundamental right under Article 28. To further reinforce this right, Nepal passed the Individual Right to Privacy Act in 2075. However, the Act lacks comprehensive coverage of all data protection aspects. With the growing use of the internet and increase in datafication, the government has been collecting a large amount of citizens' data, including personal information and biometric data, for purposes such as national ID cards, voter cards, smart driving licenses, passports, etc. The government must safeguard these data from potential attacks and misuse. Currently, Nepali laws do not clearly define the government's responsibility for managing and storing this information. A comprehensive data protection law must also specify the obligations of private entities. In recent data breaches at private companies, there has been no accountability, and the questions of due diligence, security assessments, and potential neglect have gone unaddressed. The new law must address these issues. Furthermore, as Nepal seeks to draw foreign investment through liberal foreign investment policies and a conducive investment atmosphere, having a robust set of data protection laws and regulations is essential. Thus, the new legislative body and the government must make the adoption of a comprehensive data protection law a top priority. Regulatory policy Nepal lacks a comprehensive data governance policy. The Constitution (Schedule 8) designates the local government with the responsibility of managing data and records. As part of delivering public services, each local government collects and maintains citizens' data. State and federal governments also collect and manage data in accordance with Schedules 5 and 6 of the Constitution. For efficient operations, the three levels of government must coordinate with each other and share data among them. However, there is currently no policy or law in place to facilitate data sharing between different governments. Agencies within the same tier even struggle to access data maintained by other agencies. The Statistics Act 2079 has recently been implemented in Nepal with the aim of updating and integrating laws on statistics to enhance policymaking, policy implementation, resource management, and service delivery at the federal, provincial, and local levels. The act aims to make data production, processing, storage, publication, and distribution more reliable, systematic, and timely. Despite this, the act contains unclear provisions that regulations are supposed to clarify. Even five months after materialization of the act, necessary regulations pertaining to the act are yet to be introduced. To address this problem, the government needs to promptly adopt a data management policy to establish a uniform process for data sharing within government departments or between different tiers of government. Cybersecurity in focus Cybersecurity is now a crucial aspect of national security policy, but Nepal has yet to fully recognize its significance. The recent increase in cyberattacks on the country's digital infrastructure highlights the need for a strong cybersecurity policy. The Ministry of Communication and Information Technology drafted a National Cybersecurity Policy in 2021, but it failed to address human rights and rights-based approaches. The government must restart the process, involve stakeholders, address any shortcomings, finalize the draft, and implement it. Moreover, the United Nations Office of Counter-Terrorism (UNOCT) has established a cybersecurity program aimed at improving the capacities of member-states and private organizations to prevent cyberattacks. The Council of Europe is providing support to countries globally to strengthen their criminal justice capacities in addressing cybercrime and electronic evidence through the Budapest Convention on Cybercrime. Given the rising threats of cybercrime, cyberattacks on crucial infrastructure, and interception of data in cyberspace, Nepal requires prompt international collaboration to address these challenges. E-commerce legislation In Nepal, there are thousands of registered commercial websites and the e-commerce sector is growing, albeit in an unstructured manner. The use of social media platforms, such as Facebook and Twitter, for business promotion and advertising has also increased. However, there are no specific laws or policies in place to regulate these services. This has led to complaints from customers about receiving damaged products, being charged different prices, and a lack of return and refund policies. To protect consumers, the government needs to regulate these services and establish a regulatory mechanism. In 2019, Nepal proposed an e-commerce bill that came under fire as it was formulated without proper public consultations and lacked a rights-based approach. Without proper regulation, this potentially huge sector may not be able to live up to its full potential; in fact it could even decline. It's imperative for the new government to prioritize the regulation of e-commerce. National ID card The Nepali government has introduced a National ID Card as part of plans for a "Digital Nepal" and improved e-governance. The ID card contains personal information and biometric data, which is supposed to be kept confidential according to the National ID Card and Registration Act. However, the implementation of the card system has faced challenges like privacy and security concerns, digital inequality, and a lack of transparency. The government has yet to provide adequate security measures to protect citizens' information and prevent misuse. Additionally, there is a risk of further digital exclusion for marginalized and vulnerable populations if digital initiatives are not implemented with consideration for those lacking access to the internet. The government must implement adequate security measures to prevent the misuse of citizens' information. Additionally, if digital initiatives are implemented without consideration for a large population, which lacks access to the internet, it could deepen the digital divide further, exacerbating the marginalization of vulnerable citizens. E-governance The integration of ICTs in public service delivery has ushered in a new era of e-governance. The government has placed high priority on e-governance and has drafted a master plan with the aim of improving governance and socioeconomic development through the implementation of effective, efficient, and productive e-government services. The government has rolled out several ICT-based services and initiatives, such as the Nagarik App and the National Identity Card system. However, a legal framework to regulate e-governance in the country is lacking. Recognizing this, the new government should consider adopting e-governance law as a top priority. The Digital Nepal Framework was introduced in 2076 by the government as a blueprint for contributing to economic growth and addressing major challenges  through digital initiatives. The lack of universal internet access and relevant policies have hindered the implementation of this important move toward a digital future. The government must focus on improving information and communication technologies, internet quality, and digital literacy for effective implementation. The project also needs more stakeholder feedback and consultation. Monitoring social media titans According to a report from the Nepal Telecommunications Authority, there are 27.76 million individuals in Nepal with internet access. Also, there were 13.70 million social media users in January 2022 as reported by Reportal. The growth in social media users has resulted in an increased influence of social media on almost every sector of the country, including politics, such as elections. However, this growth has also led to a rise in cybercrimes, including social media-based offenses, and the spread of misinformation and disinformation. Thus, it is imperative that regulations are introduced and enforced to address the activities of social media companies. Nepal has yet to establish regulations or guidelines for monitoring the behavior and activities of large social media companies such as Facebook, Twitter, and Instagram, which have millions of Nepali users. The IT Bill contained provisions to regulate social media, but these provisions lacked clarity and did not impose clear responsibilities on social media platforms to protect the rights of citizens. The previous government also created a ‘Social Media Management Directive’ to regulate the use and registration of social media in Nepal, but this draft faced criticism from several stakeholders. They argued that if implemented, it would grant the government immense power to request user data from these companies without a court order. In order to address the current challenges surrounding social media, the government needs to establish a comprehensive policy that outlines the responsibilities of these platforms. This policy should address key issues such as data protection, user accountability, and the obligation to respect human rights. This includes matters such as storage and processing of personal data, and requirements for transparency and cross-border data transfers. The challenges in prioritizing digital initiatives and digital rights in Nepal require immediate attention from the government and the parliament. A transparent policymaking process that involves experts, stakeholders, and civil society must be adopted to drive development, uphold citizens' rights, and foster a sense of ownership. Policies must be formulated with a comprehensive understanding of the issues, considering the views of all relevant parties and ensuring equity and inclusiveness. Without proper policy understanding and implementation, digital initiatives may not have the intended impact on the nation and its people. It is crucial for the government and the parliament to prioritize this issue and take swift action to make sure that digital initiatives are inclusive and beneficial for all members of society.  The author is Chairperson at Digital Rights Nepal