The time for data protection is nigh: a robust data protection framework to assist in legitimately curbing the Covid-19 pandemic

Abstract

The Covid-19 pandemic took the world by storm, leaving countries with little to no ability to have anticipated the measures they would have to resort to, to combat this pandemic. Amidst the chaos, there has been a worldwide surge of concern over how data of individuals would be used to curb the pandemic. Various measures have been adopted to collect, store and act on data pertaining to individuals to which Sri Lanka has been no exception. The right to privacy is not a recognized fundamental right in Sri Lanka. While several statutes refer to privacy and cases have alluded to the right this has not been crystallized in law. This study draws a comparison between the data protection regulations of the European Union — General Data Protection Regulations — which have provided an effective regulatory framework for authorities to carry out data-related emergency measures in order to curb the pandemic, while countries in which ad hoc measures have been adopted in the name of emergency laws, have failed to remain accountable to the people. This paper analyses the Data Protection Draft of Sri Lanka which is largely in line with European Union regulations and argues that it is time for Sri Lanka to adopt the requisite laws in tracking and tracing infection during the pandemic. It argues that this would provide a more robust system for gathering information, all the while respecting people's right to privacy, especially in an emergency situation such as Covid-19.