Amidst public protests, Sri Lanka passed the Online Safety Act (‘OSA’) on 24 January 2024. The passing of the Act drew much criticism for having the potential to stifle freedom of speech and expression guaranteed by the Constitution (Article 14), as well as the right to privacy (Article 17 of the International Covenant on Civil and Political Rights (ICCPR)).  It hinders LGBTQIA+ groups from accessing cyberspace by requiring them to disclose their identities.

In contemporary Sri Lanka, the legal and social status of LGBTQIA+ individuals are topics of ongoing controversy. The Penal Code Ordinance, No. 2 of 1883 (Sections 365 and 365A) criminalises same-sex relations between (consenting) adults, while discrimination and social stigma against LGBTQIA+ people are systematic and widespread. Therefore, the LGBTQIA+ community often seeks refuge by expressing themselves in the cyber sphere, which plays an important role in connecting them with the wider community across the world to create a sense of belonging. 

The passing of the OSA is therefore particularly concerning as it could be weaponised against the LGBTQIA+ community. Two sections in particular seem to be dangerous in this regard, forcing LGBTQIA+ groups to reveal their identities. 

Firstly, although seeming like an attempt to do away with ‘fake accounts’ by criminalising the act of pretending to be someone else online, Section 18 (Online cheating by personation) forces persons to use their legal names for their online presence thereby revealing their identities. This is a particular concern for LGBTQIA+ persons because it prevents individuals from using pseudonyms instead of their real names undermining their right to privacy. It also stifles their freedom of expression by making it difficult and dangerous for them to express themselves. There are also many other reasons why genuine users may not be able to use their real names to identify themselves online. For instance, human rights defenders, journalists, government critics etc. who work on sensitive matters face the risk of being exposed for their work. Although the purported objectives of the legislation include ‘protecting’ and ‘safeguarding’ (Section 3), the Act endangers already vulnerable groups.

Section 18 (c) which states that ‘representing that such person or any other person is a person other than the person really is…’ is a criminal offence is particularly problematic as the phrase is open to broad interpretation. For instance, transgender and gender-nonconforming persons could be accused of misrepresenting their identity instead of identifying with the sex assigned at birth and traditional gender norms. More importantly, it also mirrors Section 399 of the Penal Code dealing with ‘cheating by personation’ with the exception that Section 18 would apply to acts carried out online. Section 399 has been continuously used by law enforcement authorities to harass transgender persons accusing them of cheating by pretending to be another person (i.e., a man pretending to be a woman for criminal purposes and vice versa). The OSA would therefore enable the arrest of transgender persons  merely for their online presence using non-real names for their safety or their self-identified gender markers.

Secondly, Section 32 (Counteracting inauthentic online accounts and coordinated inauthentic behaviour) is also a threat to the people who identify as part of the LGBTQIA+ community. Here, an ‘inauthentic online account’ is defined as ‘an online account that is controlled by a person other than the person represented (whether by its user, unique identifier or other information) as its holder, and the representation is made for the purpose of misleading the end users […] as to the holder’s identity’.

Therefore, both Sections could be used for targeting the LGBTQIA+ community who maintain anonymity on online platforms to avoid stigma, cyber-bullying and harassment. Further, the vagueness in the terminology used throughout the Bill has the potential to enable authorities to specifically target and identify persons, coalitions and organisations belonging to the LGBTQIA+ community for ‘inauthentic’ behaviour, ‘misleading’ the public, using ‘inauthentic’ accounts, posting statements deemed as ‘prohibited’ or ‘false’ by the Commission (Sections 12 -17, 19 and 20), etc. 

Thirdly, although the Government justified the Bill by arguing that it aims to combat ‘online fraud, abuse and false statements that threaten national security’,  it makes no reference to Sexual and Gender-Based Violence committed against women and gender-nonconforming persons, thereby failing to protect and promote the safety of the most vulnerable groups.

Thus, not only is the Act inconsistent with the Constitution, but it also falls short of meeting international standards and Sri Lanka’s obligations under the likes of the ICCPR guaranteeing the right to privacy and freedom of expression (Articles 17 and 19). This Act has the potential to be used as a tool to identify and oppress LGBTQIA+ persons. In a country where their lives are already at risk, forcing LGBTQIA+ persons to expose themselves online makes them vulnerable to cyberbullying and harassment.