Individual Privacy Act, 2018 (2075)

1. Introduction

The Individual Privacy Act, 2018 (2075) (the “Act“) came into force on September 18, 2018 (Ashwin 02, 2075) as the first specific legislation of Nepal governing the protection of individual privacy. The Government of Nepal (GON) has not issued implementing rules yet.

The Government has also drafted Information Technology Draft Bill and Cyber Crime Draft Bills and when these bills are enacted, provisions of these laws will also supplement the provisions of the Act.

2. Scope of the Act

The scope of the Act extends to ensure (a) the right to privacy of every individual such as his/her body, residence, property, documents, data, correspondence, personal information, character and information in online medium,  (b) management, protection and secured utilization of personal information[1] entrusted upon public authorities or entities, and (c) asserting restrictions on the infringement of individual privacy. The Act further classifies certain information as sensitive personal information[2] and specifically restricts public authorities from processing such information.

Currently, in view of the definition of the personal information and sensitive personal information, it is not clear if the term “person” refers to information of a natural person or legal person. However, the specifications made in the definition (such as, caste, ethnicity, education, passport etc.) indicate that it is referred to the natural person. The protection and management of information of legal person or entities currently seems uncertain.

3. Applicability of the Act

The Act is applicable to the collection or use of personal information. It intends to regulate data or information generally collected, retained, analyzed or processed by public authority or corporate entities incorporated under the laws of Nepal. The enforcement of the Act is uncertain in regards to the collection or use of personal information relating to a Nepalese resident- (a) from outside the territory of Nepal, or (b) is made by an offshore entity within Nepal.

4. Collection of Personal Information

The Act requires fulfillment of the following criteria to collect personal information of natural persons: (a) approval of the “Competent Authority”, (b) consent of the data subject, and (c) information to the data subject.

4.1.      Approval of the Competent Authority

Generally, the Act restricts collection, storage, retention, analysis, processing or publication of personal information of any individual except by the – (i) Competent Authority, or (ii) person authorized by such competent authority (the “Authorised Person“). However, the Act has not defined what would be the “Competent Authority” and it is still to be seen as to whether the implementing rules might provide for separate competent data protection office or authority.

4.2.      Notice to the Data Subject

The Authorised Person is required to comply with following requirement in respect of collection, storage, retention, analysis or publication of personal information:

1. The purpose of collection of the information and its intended use should be clearly disclosed to the concerned person.
2. In case, the information is to be collected for the purpose of study or research in any particular area or for collection of public-opinion, following matters should be clearly disclosed.

• Time of collection of information,
• Subject matter for which the information is collected,
• Nature of information,
• Purpose of collection of information,
• Methodology and process of information processing,
• Assurance that the privacy of individual information is not breached, and
• Matters related to the security of the collected information.

5. Use of Personal Information

The public authority or corporate bodies is restricted from using or disclosing personal information collected, stored or retained by them, without the consent of the concerned person. However, this restriction does not apply when it is used for the purpose it is collected during the course of criminal investigation or as per the order of court or as required by the competent official who is authorized to require/ask such information.

Similarly, the Act permits-(a) publication of personal correspondences or study, research, or verification of certain portion of such correspondence in situations where the person has consented; (b) document bearing personal information is necessary for the identification purpose for availing ‘public services’ or, (c) an order is issued by the court or competent authority in a pending case or during the course of investigation or prosecution of any criminal offense.

The personal information or data may be used or disclosed to others by the Officials, without obtaining consent of the data subject, under the following circumstances:

1. For the purpose for which it was collected,
2. Written request from the investigative or adjudicating authority in the course of investigation or adjudication of criminal cases,
3. Order from the court in course of proceedings of sub-judice cases,
4. To resolve any questions on qualification or other matters of a public official,
5. Written request from the competent authority to resolve any specific questions relating to a specific subject matter.

6. Measures for protection of Personal Information 

The Act imposes upon the public authority an obligation to protect the personal information collected or retained by them. Furthermore, the public authorities are required to arrange effective security measures against risks involving unauthorized access, use, alterations, disclosure, publication or broadcasting of such data.

7. Liability for non-compliance

The violation of the Act is a criminal offence where the case may be initiated by either an individual or the State as per the nature of the offense. The offender is liable for imprisonment up to 3 years or fine of up to NPR 30,000 (USD 300 approximately) or both. The aggrieved party is also entitled to compensation for the loss suffered due to the violation of the provisions of the Act.

Disclaimer: This Pioneer Law Briefing may not necessarily deal with every important aspect of the subject matter. This Briefing is intended for general information only and not to be construed as legal or other advice.