Two Years Since the Enactment of the Online Safety Act in Sri Lanka

On 2 February 2024, the Online Safety Act, No. 9 of 2024 (hereinafter referred to as the “OSA”) was officially published in Sri Lanka. The OSA is a significant and controversial element of information security regulation in Sri Lanka. It establishes provisions prohibiting the communication of prohibited statements online and aims to prevent the use of online accounts and inauthentic online accounts for prohibited purposes.

Offences in the realm of information security

For the purposes of the OSA, new offences are introduced, including:

The last offence is accompanied by an illustration in the OSA, according to which posting a photograph of a former partner can constitute an offence if the person whose photograph is posted experiences any moral discomfort as a result of such publication.

Definitions

The OSA provides a number of important definitions, such as:

• “Private information” means personal information, including any image, audio or video details, that any person may reasonably expect to remain private, but does not include any information that may be evidence of the commission of any other offence;

• “Bot” means a computer program made or altered for the purpose of running automated tasks;

• “Inauthentic online account” means an online account that is controlled by a person other than the person represented as its holder, and the representation is made for the purpose of misleading the end users;

• “Online account” means an account created with an internet intermediary for the use of an internet intermediary service;

• “Internet intermediary” means a person who provides any internet intermediary service.

Online safety commission

The OSA provides for the establishment of the Online Safety Commission (hereinafter referred to as the “Commission”) – a committee of five members appointed by the President to handle complaints from citizens regarding potential offences. Upon receiving a complaint, the Commission may order an investigation. If the Commission, upon consideration of material collected in the course of investigations conducted under the OSA, is satisfied that any person has committed an offence under the provisions of OSA, it may take steps to institute criminal proceedings in terms of section 136 of the Code of Criminal Procedure Act, No. 15 of 1979 of Sri Lanka.

A comparative perspective on internet regulation

The OSA has been regulating the internet space in Sri Lanka for two years now. However, its application has faced criticism due to potential human rights violations. Critics argue that the OSA upsets the balance between cybersecurity and freedom of speech and view it as an instrument for suppressing dissent.

Given the controversial nature of the OSA, the practice of its application is limited. One of the most recent examples of the OSA’s application is the dispute between the media companies Hiru (hereinafter referred to as the “Plaintiff”) and NewsCenter (hereinafter referred to as the “Defendant”) regarding the dissemination of false statements. The lawsuit alleged that the Plaintiff’s reputation was damaged when the Defendant published a video of a speech by Nalin Hewage. In his speech, Hewage mentioned a media outlet created with “drug money” and commented on the situation regarding Duminda Silva, who has been sentenced to death. Although Hewage did not directly name the Plaintiff in his speech, the lawsuit claimed that the Defendant’s mention of the name “Hiru” in the news coverage damaged the Plaintiff’s reputation and could have incited rioting.

The initial court ruling prohibited the broadcast of this particular speech by Nalin Hewage, as well as any further dissemination of false information about the Plaintiff. However, later, according to media reports¹, the court sided with the Defendant, overturning the initial ruling.

This case demonstrates that the OSA remains a controversial element in the regulatory framework and that even enforcement authorities face difficulties in interpreting its provisions. Currently, possible amendments to the OSA are being actively discussed² in Sri Lanka. We believe that changes can be expected as early as 2026.

***

Lidings, through its Indian Desk, manages legal projects across South Asian countries (India, Sri Lanka, Bangladesh, Pakistan, Maldives, Nepal, Bhutan, Afghanistan). We are ready to discuss supporting your business if there is interest.