Embarking on a digital journey: Exploring Sri Lanka’s readiness

The new normal requires new approaches and solutions, an imperative change that must be embraced by all sections of the economy to survive and to stay relevant.

The outbreak of the pandemic saw the country grappling to keep up with day to day activities, both on a personal and corporate level. One of the key challenges observed was in the areas of transacting for goods and services in what can be called an increasingly contactless word.

Although relevant authorities have pushed for Sri Lanka to move towards a cashless economy, it was during the initial outbreak of COVID-19 that people actively looked to use the digital payment infrastructure that is in place.

Across the world, including Sri Lanka, the digital modes of communications including payments are continuing to boom, thanks to the introduction of new technologies coupled with other developments to encourage the emergence of innovative ways of doing things, which leads to the creation of new business opportunities.

Information Communications Technology Agency (ICTA) has been in the forefront in driving the adoption of digital technologies and legal frameworks in the country especially within the Government. However, despite efforts to deploy platforms and technologies through by many stakeholders, the uptake has been slow largely due to the lack of awareness.

SL’s readiness to embrace the digital journey

Even before the crisis hit, Sri Lanka had all the necessary framework to embark on the digital journey, and the ability of consumers to make an immediate transition from manual to electronic transactions provide clear evidence that a strong foundation has already been laid.

Silent yet hard at work, the technology community has been well prepared and geared to address the challenges that arose from the ongoing pandemic situation to enable that day-to-day life to go on. From children being able to have their classes online to basic home delivery of consumer goods and services, Sri Lanka is seen making a mega transition towards this digital journey.

In order to enable this transition from a policy perspective, ICTA Director/Legal Advisor and Sri Lanka CERT Director Jayantha Fernando affirmed that Sri Lanka has the enabling legal framework to transform every form of physical activity that is carried out, into the digital medium, except for certain classes of instruments where notarisation is needed. 

“I believe and can firmly say that we have sufficient legal grounds to embrace this transition,” said Fernando. 

For instance, the Colombo Stock Exchange (CSE) going completely digital is an example of efforts being stepped up to ensure the available technology is used to its fullest potential, leaving no room for any inefficiencies to creep in.

The upgraded digital experience of the CSE allows digital onboarding of customers, identity verification via digital means through the Department of Registration of Persons, and allows market participants to engage in the capital market with no hindrance.

The Electronic Transaction Act

Paving the way towards this digital journey is the Electronic Transactions Act, which is based on the standards established by United Nations Commission on International Trade Law (UNCITRAL), Model Law on Electronic Commerce (1996) and the UN Electronic Communications Convention (2005), the only international treaty on Digital Transactions. Sri Lanka became the first country in South Asia to adopt this convention, based on the initiatives taken by ICTA.

The Electronic Transactions Act No. 19 of 2006 was established to fulfil a number of objectives; to facilitate domestic and international electronic commerce by eliminating legal barriers and establishing legal certainty; to encourage the use of reliable forms of electronic commerce; to facilitate electronic filing of documents with Government and to promote efficient delivery of Government services by means of reliable forms of electronic communications, and to promote public confidence in the authenticity, integrity and reliability of data messages and electronic communications. 

The Act has ensured that electronic communication is officially and legally accepted as a proper means of communication. It applies to all business and commercial transactions, which are electronic in nature, other than wills or other testamentary dispositions, powers-of-attorney, sale or conveyance of immovable property, trusts, Bills of Exchange, and telecommunication licenses amongst a few others. The amendments introduced to the said act via the Act No. 25 of 2017, made this legislation fully in line with the UN Electronic Communication Convention (UN ECC), which was a further boost for cross-border digital transactions.

Digital signatures

Making the digital journey even more convenient to embark on is the ability to use digital signatures. Digital signatures essentially work by proving that a digital message or document was not modified, intentionally or unintentionally, from the time it was signed. This is done by generating a unique hash of the message or document and encrypting it using the sender’s private key. In addition, the sender is bound to the communication if a digital signature is affixed, thus, providing non-repudiation. 

In this context, Sri Lanka has been successful in in terms of cross border transactions as well, since the root key from the island nation is recognised globally from the beginning of this year, after its launch on 14 February 2020.

In 2009, Sri Lanka saw the launch of the first Certification Authority under the brand name LankaSign in accordance with the Electronic Transaction Act. This was established by LankaClear based on a request of the Central Bank of Sri Lanka (CBSL).

In the first phase, digital certificates were provided to banks for use in financial transaction clearing systems, such as SLIPS and CITS. 

During the second phase of development in 2011, digital certificates were provided to all sectors including their enterprise applications; SSL certificates and end user certificates on both private and public networks. LankaSign provided an affordable option to the Sri Lanka’s financial as well as other sectors and allowed them to automate documentation work, which was previously done manually.

ICTA’s Legal Advisor pointed out that the required necessary legal framework to facilitate the acceptance of digital or e-signatures is already in place. He stated that the Electronic Transactions Act (Section 7) gives digital signatures the same legal validity as traditional hand-written signatures, with a few differences. 

With regard to verifying the validity of digital signatures, what is required is a valid certificate from the signatory, and the complete issuer chain of certificates up to the root certificate. In addition, the signatory’s public key, issuer Certificate Status Protocol (CSP) certificates and their Certificate Revocation List (CRL) are also required. 

A seamless Work from Home (WFH) arrangement: Is SL capitalising enough?

While most enterprises have been focusing on their digital transformation the last few years, many are still utilising processes that have manual, physical, or face-to-face components and document signing is probably the best example of this.

According to Fernando, digital signatures actually help in the current context since there is reluctance at the moment to work on premise due to the outbreak of the pandemic. 

“The digital signatures are electronic equivalent of hand written signatures. A digital certificate issued from a trusted party would have a higher degree of validity attached to them, which ensures integrity to the transactions. What should be ideally done is for governments, corporates and SMEs to consider the option of using digitally signed documents, so that they can communicate those in electronic form to all participants in a transaction,” he said.

However, due to lack of awareness, most private organisations are somewhat reluctant to use digital certificates or digital signatures for their day to day transactions, he shared.

Fernando stressed that companies should embrace digital signatures since they are convenient, versatile, legally binding, secure and adaptable.

The choice of digital signatures 

This again is a business choice. Customers opting for digital signatures under the Electronic Transaction Act have a number of options across various categories. 

“In law we have left it to the trading parties to decide the category of electronic signatures they would like to use. One important feature of the Act is that we have kept the law technology neutral so that it can adapt to developments in technology,” said Fernando.

He added that under the law it is said that any method that helps to identify a person and to indicate that person’s intention in relation to an electronic communication would fall within the framework of an electronic signature and depending on the type of transaction the parties can use various methods. 

“So basically, customers and businesses have choices, they must pick what is suitable to them. My suggestion is to make that choice wisely and use a method that is secure, ensures integrity to the transactions and guarantees digital transactions are not tampered with. Digital signatures achieves this objectives and there are no legal barriers to use them” he said.

Data protection and privacy 

A complete transformation from paper to digital transactions, be it in Government or private sector, is the need of the hour. As measures are taken to identify and verify the identity of a person, protecting that in the digital world is imperative. 

Fernando shared that Sri Lanka has been examining this area and plans are afoot to fast track the Data Protection Bill. He Chairs the drafting committee responsible for this area, and drafted the Legislation that went through a public consultation process, which has received policy level approval. 

Given the recent development in the country and the world since the emergence of an unforeseen crisis, the Data Protection bill is being further refined and amended, Fernando said.  The bill will be finalised in the next few months and the new Ministry of Technology, established on 20 November, is given the mandate to fast track the initiative and set up the institutional framework for the implementation of same.