Myanmar: The introduction of requirements for digital platform service providers

In brief

The revised draft Cyber Security Law released by the Ministry of Transport and Communications (MOTC) on 13 January 2022 ("Draft Law 2.0") sets out certain requirements on a digital platform service provider (DPSP). Failure to comply with the requirements could result in a fine, suspension of the relevant digital platform service (DPS) or revocation of any existing license held by the DPSP. Additionally, the MOTC may act in the public interest and shut down any DPS in Myanmar. These provisions under the Draft Law 2.0, if enacted, may have a material impact on international digital platform operators with a substantial user base in Myanmar.


Recommended actions

Under the state of emergency, new regulations can be issued by the current administration within a short timeframe without a parliamentary review process. It is important for businesses which are providing a DPS, whether based in or outside of Myanmar, to monitor developments in respect of the Draft Law 2.0 and assess how such changes could impact their existing operations and local user base. Additionally, businesses should also look out for any subsequent release of guidelines that may provide details for the application of licenses from the MOTC.

In more detail 

Classification of a DPSP under the Draft Law 2.0

  • Under the Draft Law 2.0, a DPSP means any individual or entity providing DPS in Myanmar. DPS covers any over-the-top (known as OTT) service providing data, information, image, voice, text and video etc. by using cyber source and similar system or materials. It is likely that social media platforms and instant messaging services would be classified as a DPS.
  • Any person who intends to provide a DPS in Myanmar must apply for a license with the Information Technology and Cyber Security Department (ITCSD), a department under the purview of the MOTC, No specific guidelines have been provided for the application process.

Obligations of the DPSP

  • A DPSP is required to retain user data for three years from the commencement of services to the user. Such data must be handed over to the relevant authorities upon request. The DPSP is also required to prevent, remove, destroy or suspend certain information on its platform upon notification from the ITCSD.  
  • Further, a DPSP with more than 100,000 users in Myanmar would need to comply with additional obligations such as the following:

(a) maintaining the storage device holding user data in accordance with regulations (it is noteworthy that no relevant regulations have been issued and it is unclear whether there will be data localization requirements)

(b) registering as an entity under the Myanmar Companies Law

(c) paying its tax obligations under applicable laws

Wide powers of the relevant authorities under the Draft Law 2.0

  • In the event of a failure to comply with the above mentioned requirements, a DPSP found guilty of the offence could be punishable by imprisonment for a minimum of one year up to a maximum of three years or with a fine not exceeding MMK 10 million (approximately USD 5,000) or both. There are no separate provisions for offences committed by corporations.
  • The ITCSD could take enforcement action against an offending DPSP by imposing a fine, suspending the relevant DPS or revoking any previously granted licenses.
  • Separately (and without the need for any antecedent breach of the Draft Law 2.0 by the DPSP), the MOTC may act in the public interest by temporarily/permanently shutting down the DPS and/or temporarily taking control of the devices used in relation to the DPS.

Conclusion 

These provisions under the Draft Law 2.0 would likely affect DPSPs under two different categories. First, with regard to any DPSP with an existing corporate presence in Myanmar, the DPSP would fall within the ambit of the regulators once the Draft Law 2.0 comes into force and be exposed to any direct enforcement proceedings taken domestically. Secondly, with regard to any DPSP which is based outside of Myanmar and has no registered domestic presence, while the Draft Law 2.0 has no extraterritorial jurisdiction over the DPSPs in this category, the authorities may still act to shut down the relevant DPS and prevent these services from being offered to users in Myanmar. This could pose a significant impact on the DPSP's revenue streams from the country.

______

© 2022 Wong & Partners. All rights reserved. Wong & Partners, member of Baker & McKenzie International. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.

© 2022 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.

LOGO_Wong & Partners_KualaLumpur_1340x737 LOGO Singapore Baker McKenzie Wong & Leow image


 

Contact Information

Copyright © 2024 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.