'In Nepal, new laws, policies and mechanisms relating to privacy are proposed but without adequate public discourse'

Santosh Sigdel

Executive Director, Digital Rights Nepal  

Santosh Sigdel is the Executive Director of Digital Rights Nepal. He is a lawyer by profession and completed his Master’s in Commercial Law and International Human Rights Law. Keen to explore the interrelation between technology, business, and human rights, he has been involved in different areas of human rights over the years. 

In 2007, Nepal had just gone through a political transformation and an international organisation called Article19 which works on areas related to freedom of expression across the world had started work in Nepal and Sigdel was appointed as its Country Representative. “Due to political transformation, human rights, freedom of speech, and freedom of expression were pressing issues then and it was necessary for us to identify our agenda for change,” he says.

In order to identify the scope and solutions to those policy issues, Sigdel shares that they had a series of exercises with the political leaders, media organisations, civil society and other concerned stakeholders and in about a year came up with a document titled ‘Agenda for change’. “This document primarily focused on freedom of expression, right to information, press freedom, among others. This led me to become more interested in human rights,” he recalls. He then did another Master’s degree in International Human Rights Law from the Central European University. 

Later, with the aim to amplify information rights in Nepal, Sigdel joined hands with like-minded people to set up Citizen’s Campaign for Right to Information. “I was the founding General Secretary of CCRI and my journey has continued with a few changes, and as of today, I am focused on digital rights,” he says.

In this issue of Business 360, we spoke to Sigdel about the various facets of digital rights and what it actually means in the present context. Excerpts: 

How would you define digital rights and what is their importance in the present context? 

We have many rights enshrined in our constitution and there are international laws and standards that we have to abide by as Nepal is a signatory to a number of international human rights treaties and conventions. These days, rights are not limited to the physical realm and offline processes. At present, freedom of speech is not just about freedom to express your ideas and opinions in physical space. Likewise, the right to privacy is not just about not letting someone enter your personal space, or not letting someone search you and your belongings without your consent. Today, it has expanded to the online sphere as well. 

If a person is disappointed with the current system, government actions or any political party, then before going to Maitighar to protest that person usually posts their feelings on their social media like Facebook or Instagram, to name just a few. People express their opinions and use their freedom of expression through these online platforms. This clearly shows how freedom of expression has extended from the offline world to the online world. Similarly, just the way no one can enter your house without your permission, no one can check your SMS or mails without your permission. The extension of human rights to the online space is exactly what digital rights are all about.

In the context of digital rights, the first thing we require is access to internet and appropriate gadgets. Access to the web and gadgets that are reliable and affordable is also digital rights. And it is not limited to that only, even availability of preferred content falls under digital rights. If you have access to reliable and affordable internet and gadgets but don’t have the content in your preferred language, then how useful will the internet be for you? In recent times, internet has been utilised in various fields like education, health, banking, among others but does everyone have access to internet? For instance, during the Covid 19 pandemic, those who had reliable internet and gadgets could study but others could not. So, digital rights are directly connected to right to education. Similarly, reliable internet infrastructure is the basis of telemedicine, thus connecting digital rights to right to health. At present, if you don’t have good knowledge and access to information technology, it becomes difficult to get a job, thus digital right is now connected to the right to employment too. In this way, digital rights are very extensive and touch upon all aspects of our lives. 

To safeguard digital rights, one crucial element is digital security. Imagine if someone had access to the websites you visit or could intercept the SMS messages you send – how would that make you feel? Therefore, digital security is indispensable for upholding digital rights. A few years ago, there were fewer internet users, resulting in less online activity. However, the number of users and their online engagement has been steadily rising, along with increased internet penetration. This surge also brings about new threats. To effectively protect digital rights, digital literacy is imperative.

How would you rate cybersecurity in Nepal?

Over the years, cyber incidents and cyber-attacks have been rising along with data breaches. In fact, many government systems and services have faced data-breach issues several times. Even private sector service providers have been a victim of this issue in recent days with the data of Foodmandu and Vianet being breached some time back. So, as the usage of the internet increases so does our vulnerability and this leads to various forms of risks. Phishing, spam and ransomware are alarming nowadays. News about people being scammed and losing their money have become quite common. People even in this age and time believe in emails stating they have won millions in some scheme. This makes us question the level of digital literacy. 

How do you find cybersecurity mechanism in Nepal? 

There is no dedicated and functional cyber emergency response unit in Nepal. The existing legal framework is limited to the Electronic Transaction Act, 2008 and a by-law on cybersecurity developed by the Nepal Telecommunications Authority, which applies only to the licensees of the NTA. The Cabinet recently endorsed the National Cyber Security Policy in August this year, and it is expected that the government will prioritise the enactment of laws and mechanisms proposed under this policy. 

While talking about cybersecurity we do have some concerns with the National Cyber Security Policy 2023. Digital Rights Nepal has conducted a preliminary assessment of the policy which incorporates all our concerns and curiosities. Our primary concern is that there are topics included in the policy which had not been discussed in the earlier draft. The one related to national internet gateway was completely new in the policy. With the national internet gateway, it seems like Nepal is trying to enter a controlled internet era. The objective, aim and purpose of this provision was never discussed. The government needs to clarify this. The other important aspect is a clarification regarding for whom or what is this cybersecurity for – it could be the government, private sector or citizens. So, its emphasis needs to be clarified. 

What I would say is that the emphasis of the policy should be on citizens. If the policy fails to protect the rights of the citizens, then there will be no value in having such policies. If this policy is for the citizens, then the policy must be centred around the citizens. 

How do you find the situation of digital rights in Nepal?

There are no explicit mentions of digital rights in the constitution or laws in Nepal. However, relevant provisions can be found scattered in the Constitution and other legal instruments. Nepal has yet to recognise access to the internet as a fundamental right but other legal provisions such as the right to freedom of expression and right to privacy have recognised the concept of ‘online’ or ‘digital space’.  

Apart from legal provisions, if we look at the practice, meaningful access to internet is still a major concern in Nepal. Quality of internet, affordability issues, and availability of local and relevant content are other major issues. We have no segregated data on the access of different groups and communities to the internet. 

Freedom of expression online is another important aspect of digital rights. We have observed a number of cases in recent times, which provides not so encouraging picture of digital rights in Nepal. Some examples include the order by the Election Commission to remove the Facebook page ‘Enough is enough’ from the internet during elections, prosecution of rap artist Samir Ghising aka Vten and stand-up comedian Apporva Kshitiz and use of Section 47 of the Electronic Transaction Act to persecute journalists.  

I am also concerned about the lack of public awareness and discourse on the scope of digital rights. I will give you an example. A few years ago, Nepal decided to ban online ‘pornography’ which also resulted in the ban of websites with domain names that had words like porn or sex. Many sites related to reproductive health of several universities and also helpline websites also could not be accessed. So much so, even the website of a musical band called Sex Pistols was not accessible. However, there was no public discourse on whether the entire focus on preventive mechanism, without any intervention to promote digital literacy was a useful approach. 

When people in power use their authority to silence voices or when minority voices are suppressed, digital rights are violated. Formulating preventive mechanisms alone is not enough, the government should create an environment conducive to promoting these rights. 

We could dive deeper and question, “Are all government websites user-friendly for people with disabilities?” If a person with disability is unable to access such websites, then it is clearly a violation of digital rights. The government should ensure its websites have colour correction mechanisms for a visually impaired person. Moreover, the content availability and preferences of people need to be catered to as well. Will a person be able to access a government website in their preferred language? It is the government’s responsibility to make websites inclusive. Also, many government sites aren’t secure. This is also a violation of digital rights. 

To protect individual privacy rights, how can we organise data and data privacy rights?

This is a very pertinent question in the current context. One important aspect of digital rights is to ensure control of individuals over their personal data. However, the concept of privacy as well as digital privacy is new to us. In today’s world both the government and the private sector have access to our personal data. The government collects and manages all our personal data right from our birth to death. Similarly, the private sector, in both the offline and online spaces, has access to our personal and sensitive data. 

In Nepal, the government hasn’t been taking the issue of digital privacy seriously. Various government bodies are violating individual data privacy. For instance, the Election Commission has made various data about the voters public in its portal which is considered to be sensitive. Similarly, other government agencies such as Transport Management Department, Credit Information Bureau have made public sensitive private information. 

Likewise, we receive calls from different political parties to vote for their parties during the elections. In the private sector, too, many organisations use our personal data; they call us either to sell their service or goods or for any other reason. What we have to understand is a phone number in many cases is our digital ID. In many digital spaces, people don’t know you by your name, they know you by your phone number. It is the same with email addresses. If anyone leaks your phone number, email address, citizenship number, or date of birth then your various other digital data will be at risk right now. 

To implement the fundamental right to privacy guaranteed under Article 28 of the constitution, Nepal has adopted the Individual Privacy Act, 2018, which does help in some ways to protect individual privacy but not much with data protection. Thus, to ensure control of data subjects over the personal and sensitive data, privacy and data protection mechanism should ensure the rights of the data subject, responsibility of both the government and the private sector and make arrangement for ensuring accountability when violation of data privacy occurs. 

How do you find the regulation of digital space by the government? 

There are very few legal instruments to regulate the digital space at the moment. However, a number of new policy initiatives are being discussed at this moment. The government has recently adopted the National Cyber Security Policy, and it has been working on bringing the Information Technology Bill, that could not be passed by the last parliament. The government is also working on the new Telecommunication Bill and Cyber Security Bill. At the programme level, Mobile Device Management Service (MDMS) and ‘Telecommunication Traffic Monitoring and Fraud Control System’ (TERAMOCS) have been proposed.  

We observed the strong stakeholder reaction against MDMS and the TERAMOCS, citing the possible impact on privacy and data protection of the citizens. Recently, the prime minister ordered not to implement TERAMOCS after stakeholders expressed concerns about its possible misuse and impact on right to privacy. This goes to show that the government brings new provisions without proper discussions with the public. Similarly, there is always a lack of public discourse whenever the government procures any technology. From the perspective of human rights, we believe that any technology should not violate human rights. 

The government shouldn’t violate citizens’ rights online and impose restrictions without safeguards. In Nepal, new laws, policies and mechanisms relating to privacy, digital data, cyber security, phone tapping are proposed but without adequate public discourse or consultation. A few years back, a bill had been brought into discussion whereby the Special Services Act, 1985 would be amended to provide the National Investigation Department authorities broad powers to wiretap and intercept individuals’ digital communications. Initially, a few members of parliament took a stand against it but later it was passed by the National Assembly. Then MDMS entered into the scene, which provides access to your call details, digital content and your location. Then TERAMOCS came and now NTA has proposed collecting e-KYC of the subscribers. It seems like we have too many laws and policies without proper public consultation and questions are being raised on whether the government is moving towards the control mechanism

Technology’s pervasive presence raises concerns about government profiling, dependent on the government’s nature and respect for human rights. Open public discussions are crucial to build trust and effectively implement policies. In a democracy, transparent policy formation, in line with constitutional rights and limitations, is essential for government credibility and stakeholder compliance.

Which section of society is more vulnerable to digital rights violation? 

In terms of security, we all are vulnerable as our data is not safe so our digital rights are not secure. Our society is still patriarchal and is not very inclusive towards women. We can observe a similar trend in the online space as well. Similarly, society isn’t very inclusive towards the LGBTQIA+ community and a similar extension can be observed in the online world as well. Basically, the online space is a reflection of the offline space because it is the same people in the offline world who have shifted to the online realm. When it comes to digital security, we all are vulnerable but in terms of social and cultural harassment, stalking and suppression of voices, women and LGBTQIA+ community are more vulnerable. Similarly, people from certain professions are also prone to vulnerability. For instance, journalists, human rights defenders face threats online.

In terms of digital literacy, our older generation is more vulnerable as they aren’t able to differentiate between actual content and spam. Even in developed countries like the United States, it is the older generation who is more prone to spam and phishing. And when we talk about risks, it is children who are at a greater risk from cybercrime and cyber violation. Digital exposure of children is increasing and so is the threat of early age infatuation. Similarly, luring through the online space is also very prevalent. Children and young people should be taught ways to stay safe online. Digital awareness is necessary. Another thing that concerns me is whether we are capable of digital parenting. Are parents themselves capable of guiding their child in online space? So, all these things point towards the necessity for digital awareness and digital literacy. 

How threatened is our national security in the digital space?

In recent times digital security has become an indispensable part of national security. We can take the example of the Russia-Ukraine war itself, where these two countries are also found involved in cyber warfare. Even during the blockade of our southern borders, we had witnessed a cyber-war between Nepali and Indian hackers. So, if our digital infrastructure is not secure, it hampers our national security as well. If our critical infrastructure is not secure then obviously, we and our system can be attacked, which means we are at risk. Another aspect is that our critical infrastructure, if not secured properly, can be weaponised against another country by some other country. So, we must be very careful and we should immediately start building our capacity.

On the policy front, National Security Policy 2016 has slightly touched on cybersecurity aspect and the recently adopted National Cybersecurity Policy, in principle, has considered cybersecurity as a part of the national defence system. However, the policy has failed to articulate the coordination between the cyber security mechanism and national defence mechanism.  

How can we minimise the digital divide?

The digital divide exists in different layers and levels in our country. There is a divide based on gender, geographical regions, physical abilities, language barriers, etc. We need to consider ways to address the divides while adopting any ICT-based programmes or policies, otherwise, there is a possibility of widening the access gap further. 

For example, in our country, we are progressing with digitisation efforts, such as the implementation of a national ID card with provisions for various services, including healthcare. However, the concern arises when individuals who previously couldn’t access these services offline find it even more challenging to access them online. In essence, digitisation excludes certain groups and widens the divide. If not executed properly, it poses a greater threat. Therefore, it is crucial for the government, private sector, civil society and other stakeholders to carefully consider and address this aspect.