Repeal of Online Safety Act vital for economic salvation of Sri Lanka

The Online Safety Act stands as a monument to illiberalism and as an anchor of State apparatus infringing the substance of civil liberty

Imminent danger

While the economy of Sri Lanka has achieved some degree of stabilisation after the most dire crisis in history, progress along a growth trajectory remains a clear imperative. Fragility of the current situation has been massively increased by the devastating tariffs imposed by the Trump administration, making our country’s exports to the United States – especially apparel and rubber products – starkly vulnerable.

Against this backdrop the GSP+ facility, affording preferential access to the vast markets of the European Union, becomes a lifeline for our exports. Exemption from import duty for a wide array of products involves an advantage of immense value.

This is, however, neither a right nor an entitlement, and its availability is by no means assured in perpetuity. Its continued enjoyment is conditional upon compliance with provisions contained in 27 treaties, principally the International Convention on Civil and Political Rights. Aspects of this have been incorporated into the domestic legal system of Sri Lanka, by legislation in the drafting of which, as Minister of Export Development and International Trade, I played a key role in 2007.

GSP+ privileges for Sri Lanka are now coming up for review, with a delegation from Brussels expected to arrive very shortly.

One of Sri Lanka’s abiding commitments is a fundamental modification of the Online Safety Act, No. 9 of 2024, an unforgiving onslaught on media freedom, which was vehemently opposed by political parties across the spectrum, and representatives of the media and civil society. Despite the outrageous contents of the Act, no action whatever has been taken up to now, to amend this legislation. There is no doubt that this situation, if it is allowed to continue, will gravely impede vital interests in respect of our international trade. Certainly, the Government’s professed intention of enhancing the value of exports to the European Union to the threshold of $ 3.6 billion in the short term, will be reduced to a fanciful expectation. It is, therefore, a matter of urgent practical importance to identify the most obnoxious features of the law and to set in motion the legislative procedures necessary to effect their repeal or radical reform.

Overbroad definition of offences

A defect going to the very root of the legislation is a definition which is strikingly vague and overbroad: “Any person, whether in or outside Sri Lanka, who poses a threat to national security, public health or public order or promotes feelings of ill-will and hostility between different classes of people, by communicating a false statement, commits an offence” (Section 12).

The central criterion itself is an attack on basic democratic values. There has been judicial recognition of the reality that “Erroneous statement is inevitable in free debate” (New York Times vs. Sullivan 376 U.S. 254 at p. 270 – 1 (1964). The solution, in a democratic culture, is not suppression but refutation of falsehood through enhanced engagement and challenge.

The central objection is to the use of subjective language like “ill-will” and “hostility” as elements of the definition of a penal offence carrying condign penalties, including long periods of rigorous imprisonment. Inherent vagueness leads to unpredictability of consequences.

Equally compelling considerations apply to the use of “national security” as a lever for restraint on expression and publication. Public policy, as set out in the Johannesburg Principles on National Security, Freedom of Expression and Access to Information (Preamble to UN Document E/CN 4/1996/39), adopted on 1 October 1995, emphasises the need “to discourage governments from using the pretext of national security to place unjustified restrictions on the exercise of freedom of speech and expression”.

It is the absence of necessary qualification that violates the basic ethos of a democratic society. A “threat” to national security, public health or public order as the basis of restriction on free speech and communication is unacceptable without essential limitation. The internationally accepted test of “clear and present danger” (Schenk vs. U.S. 249 U.S. 247 at p.52 (1919)) is in no way reflected as a qualifying element in the Sri Lankan legislation.

Overarching authority of the commission

The crux of the pivotal offence is a “false statement”. The truth or falsity of the statement complained of, is a matter to be determined at the untrammelled discretion of the Online Safety Commission, the central authority created by the law. It is composed of 5 members appointed by the President, with the concurrence of the Constitutional Council.

A vital circumstance is that members of the Online Safety Commission, unlike the membership of other independent Commissions established under the Constitution, are not recommended for appointment by the Constitutional Council. The initiative is that of the President, not the Constitutional Council, the function of the latter being confined to “approval” (Section 5 (1)). This is a marked, and in principle unacceptable, departure from the pattern of constitutional provisions governing the appointment of independent Commissions.

This difference of approach undeniably impacts public perceptions regarding performance of the Commission’s functions in a spirit of total independence – a result much to be regretted, in view of the awesome sweep of powers conferred on the Commission. These include the prohibition, by mere fiat of the Commission, of statements pertaining to a diversity of matters such as physical security, ethnic and religious harmony, disaffection to the State, personal wellbeing and privacy, and interference with the right of association.

In any event, given the invasion of seminal rights and freedoms as the direct consequence of exercise of the Commission’s powers, it is reasonable to assume the desirability of a process of consultation which would include, among others, internet service providers, internet intermediaries, and representatives of media organisations, as well as the professional, business and academic communities.

A prominent feature of the Online Safety Act is the indiscriminate use of criminal sanctions to attain its objectives. A wide range of offences is created by Part III of the legislation. Many of these are of amorphous scope, lacking in precise definition of constituent elements – for example, “wantonly” giving provocation by a false statement to cause riot (section 14), “voluntarily” causing disturbance to a religious assembly (section 15) and “malicious” communication of a false statement to outrage religious feelings (section 16). The ambit of the offence against “public tranquillity” (section 19) is equally unclear. These are all offences which carry deterrent sentences of imprisonment, in one case for up to three years and in the other for a maximum of seven years, in addition to, or as an alternative to, a substantial fine

Incompatibility of scope and objectives of this Act with the irreducible norms of a functioning democracy is clear from judicial pronouncements of impeccable authority: “The freedom of speech and expression is one which cannot be denied without violating those principles of liberty and justice which lie at the base of all civil and political institutions” (Mark Fernando J. in Amaratunga v. Sirimal, The Jana Ghose Case, S.C. Application No. 468/92).

The reality of this danger is reinforced by implications of the definition of a “false statement”, the anchor of criminal liability in terms of the Act: “A ‘false statement’ means a statement that is known or believed by the maker to be incorrect or untrue and is made especially with the intent to deceive or mislead but does not include a caution, an opinion or imputation made in good faith” (section 52). The manner of formulation suggests that the concluding phrase is in the nature of an exception from criminal liability, the burden of proof in this regard falling on the shoulders of the accused. In practice, this is an intolerably onerous burden. 

In sum, the behemoth of the Commission is destructive of the foundations of civil liberty.

Remoteness of causal nexus

One of the reasons why the law is indefensibly wide in its operation is the imposition of criminal liability for consequences which are not proximately linked to the conduct of the accused. It is declared to be an offence to communicate “a false statement which gives provocation to any person or incites any person, intending or knowing it to be likely that such provocation or incitement will cause the offence of rioting to be committed” (section 14).

In the envisaged situation, rioting is committed by a third party. Criminal liability on the part of the person communicating through an online account or online location, is grounded solely in assumed knowledge of likely behaviour of the third party. Indeed, criminal liability of the communicator is established, even when the consequence of rioting does not take place at all, the only difference being reduction of sentence (section 14 (f)). Similarly, the communicator of the statement is held criminally responsible for disturbance of a religious assembly, with no clear nexus being insisted upon between the act of the accused and the rioting which takes place (section 15)).

The net of criminal liability is cast far too wide by this approach, the lack of a sufficiently clear causal nexus being the underlying defect.

Expanding frontiers of criminalisation

A prominent feature of the Online Safety Act is the indiscriminate use of criminal sanctions to attain its objectives. A wide range of offences is created by Part III of the legislation. Many of these are of amorphous scope, lacking in precise definition of constituent elements – for example, “wantonly” giving provocation by a false statement to cause riot (section 14), “voluntarily” causing disturbance to a religious assembly (section 15) and “malicious” communication of a false statement to outrage religious feelings (section 16). The ambit of the offence against “public tranquillity” (section 19) is equally unclear. These are all offences which carry deterrent sentences of imprisonment, in one case for up to three years and in the other for a maximum of seven years, in addition to, or as an alternative to, a substantial fine.

The Commission, on satisfaction that an offence has been committed under the Act, is empowered to “take steps to initiate criminal proceedings in terms of s. 136 of the Code of Criminal Procedure Act, No. 15 of 1979” (section 38(2)). Moreover, every offence established by the Act is characterised as a non-cognisable offence within the meaning of the laws governing criminal procedure (section 43(a)).

Penal consequences of daunting severity are visited upon bodies corporate. Every director or other principal officer is held criminally responsible (section 44(a)). If the offender is a firm, criminal liability is imposed on every partner of the firm (section 44(b)) and, in the case of an unincorporated body, “every individual who is a controlling member and every principal officer responsible for management and control” (section 44(c)) is exposed to criminal sanctions. Lack of knowledge or exercise of due diligence is recognised as an exculpatory circumstance but, in keeping with general evidentiary principles, the burden of proof in this regard is borne by the accused.

Chilling effect of the law

The core of the statute resides in the powers vested in the Commission, to apply an extensive range of measures to deal with “prohibited statements” (Part II). These include orders “to stop the communication of such statements” (section 11 (b)), “to disable access to an online location” (section 11 (c)) and to direct removal of prohibited statements (section 11 (e)). A worrying factor is the absence of a proper definition of “prohibited statements”, the purported definition consisting merely of a reference to the provisions which use the phrase (section 52).

When the Commission is satisfied that a “prohibited statement” has been made, its coercive powers which come into play, are of a drastic nature. These extend to the authority to issue a notice to the communicator of the statement, ordering the adoption of measures to prevent circulation (section 23 (f)). This renders applicable the draconian provision that the recipient of the notice “shall comply with such notice immediately but not later than 24 hours from such notice” (section 23 (b) and (f)). Failure results in criminal proceedings in a Magistrate’s Court (section 23 (g)).

The Commission has power to name an online location as a “declared online location” if three or more prohibited statements have been communicated on that location to end users in Sri Lanka (section 28 (i)). An internet service provider or an internet intermediary, on the making of such a declaration by the Commission, is obliged to cease communication instantly on pain of imprisonment for a term of up to seven years or a maximum fine of Rs. 10 million, the penalty being doubled in the event of a subsequent offence (section 29 (6)).

Especially in light of the broad definition of “inauthentic online account”, “internet service provider”, “internet intermediary” and “internet intermediary service” (section 52), the chilling effect of the law is evident.

It is hardly surprising, then, that prominent internet and technology companies active in Sri Lanka, in their response to the legislation, have sounded a strong note of caution, even indicating the risk of withdrawal from their operations in our country.

The Asian Internet Coalition (AIC) which consists of 13 companies of international stature, commenting on this legislation when it was in Bill form, declared: “Despite our commitment to constructive collaboration, the AIC has not been privy to proposed amendments to the Bill. We unequivocally stand by our position that the Online Safety Bill, in its current form, is unworkable and would undermine potential growth and direct foreign investment into Sri Lanka’s digital economy. We firmly believe that for the Bill to align with global best practices, extensive revisions are imperative” (Emergency Media Statement of 23 January 2024).

This can hardly be disregarded in cavalier fashion. As the Government has emphatically acknowledged, digitalisation and other technology innovations are central to current plans for economic development and, of equal importance, for ensuring equitable distribution of the benefits of progress. Swift and ready access to market information – be it for farmers, the fishing community, manufacturers of industrial products, providers of services and the small and medium sector in particular – is an indispensable requirement for the success of current strategies. If companies of the calibre of Facebook, Google, X, Apple, Amazon, Cloudflare and Yahoo, contemplate discontinuation of their services because of the oppressive character of the law, economic development, far from being advanced, is certain to be retarded.

The need for imperative change

Parliament debated the Online Safety Bill for two full days on 23 and 24 February 2024. Pervasive deficiencies of the law were convincingly identified during this rich and rewarding debate. No one was more forthright than the current Prime Minister, Dr. Harini Amarasuriya, at that time speaking from the ranks of the Opposition, in her unreserved condemnation of the Bill and her strident call for its withdrawal: “The intent of the Government is clear. It is about controlling dissent; it is about taking control of public discourse or public narrative at a crucial time in this country when democracy needs to be protected at all costs. That every instrument is going to be used to stifle dissent, is very clear” (Hansard of 24 January 2024, Column 224).

The Online Safety Act stands as a monument to illiberalism and as an anchor of State apparatus infringing the substance of civil liberty. Its removal from the statute laws of our country is a dire necessity, no longer to be delayed.

(The writer holds a D. Phil. (Oxford), Ph. D. (Sri Lanka); is a Rhodes Scholar, Quondam Visiting Fellow of the Universities of Oxford, Cambridge and London; former Vice-Chancellor and Emeritus Professor of Law of the University of Colombo.)