Every day, we hand over our names, telephone numbers, and addresses when filling out forms, share personal details when visiting hospitals, and provide information to businesses when making purchases or using their services. Closed-Circuit Television (CCTV) cameras record our movements in public and private premises, with digital systems storing details of our activities. 

Most of the time, we do this without giving much thought to where that information goes, how long it is kept, or who might eventually gain access to it. We trust that the people and institutions collecting our information will use it for the purpose for which it was obtained and keep it safe.

But what happens when that trust is broken? What happens when information collected for one purpose is used for another, or when details that were never meant for public consumption find their way onto social media?

These questions came into focus recently when a group of Buddhist monks engaged in a protest campaign against the Government visited a star-class establishment in Colombo, allegedly for a meeting or discussion. Within a short time, photographs showing the group entering the premises and proceeding towards a room began circulating on social media. 

Some appeared to have been taken by individuals using mobile phones, while others seemed to have been extracted from the establishment’s CCTV recordings. The circulation of the images created a public discussion about privacy and the handling of personal information, particularly the circumstances in which footage collected for security purposes could be accessed, disclosed, and shared with others.

Attorney Thishya Weragoda addressed the issue in a post on his Facebook account, emphasising that privacy should not be treated as a privilege granted at the discretion of those holding personal information.

“Privacy is not a favour; it is a right,” he wrote.

He said people entering private premises had a reasonable expectation that those responsible for the premises would respect their privacy. This expectation was particularly relevant to places such as hotels, where people visited on the understanding that their privacy would be respected.

Institutions that collected and retained personal data had a responsibility to protect it, he said, referring to the Personal Data Protection Act (PDPA) No.9 of 2022. CCTV footage can fall within the scope of personal data covered by the act, and the fact that images are collected for security purposes does not give an institution unrestricted freedom to disclose them. 

“Such data is collected for security, not to hand it over to anyone simply because of pressure from the Government,” he wrote.

He identified an exception in the case of a lawful criminal investigation, in which information could be provided to the relevant authorities in accordance with the procedures prescribed by law. Handing over footage to some other party without satisfying those conditions, he charged, would constitute a serious intrusion into privacy.

“This is not a question concerning only the people in that video. It is a question concerning all of us who visit that hotel. If one person’s data is used today for political advantage, tomorrow it could be our information,” he wrote, warning that the use of personal information against people because of their political differences presented a serious problem.

What does the law require?

The PDPA was enacted in 2022 to establish a legal framework governing the processing of personal data. Its provisions cover the collection, use, disclosure, and retention of information that can identify an individual, directly or indirectly. The act’s definition of biometric data also refers to facial images, while its definition of processing includes activities such as disclosing and transmitting data.

The law is therefore relevant to much more than CCTV recordings. Information supplied when registering for a service, details held by a hospital, contact information retained by a business, and images captured by surveillance systems can all raise questions about how personal data is handled.

The purpose for which information is collected is central to how it should be handled. An organisation that collects information to provide a service should not use it for an unrelated purpose without an appropriate legal basis. Similarly, an organisation collecting CCTV footage to protect its premises should not treat the recordings as information that can be freely shared or used for other purposes.

The act also addresses the period for which information may be retained and the safeguards needed to prevent unauthorised access or use. Organisations should collect only the information they need, use it for the relevant purpose, and protect it against loss, misuse, and unauthorised disclosure.

The law provides for the disclosure of information in connection with criminal investigations, subject to applicable legal requirements and safeguards. It does not mean, however, that every request for personal data can be treated as lawful simply because it comes from a public authority. Any exemption from the usual requirements must have a legal basis and satisfy the applicable standards of necessity and proportionality.

When contacted by The Sunday Morning, Data Protection Authority Director General (DG) Dimuth Bhashitha Atapattu explained that the PDPA, although introduced in 2022, had not yet come fully into operation. Under the timetable announced for the law, key provisions governing the processing of personal data and the obligations of data controllers and processors are due to take effect on 1 January 2027.

Until then, organisations have been given time to prepare their internal systems and compliance arrangements. “If an organisation, whether a data controller or a data processor, collects data, we have given it until 1 January to prepare all its internal compliance arrangements,” he said.

He also stressed that organisations should collect only the information necessary for the purpose for which it is required. 

“Holding unnecessary information creates additional risks, particularly if a data breach occurs. For instance, when a patient visits a hospital, the institution collects information to connect the patient with a doctor and provide the necessary treatment. It should not collect information that is unnecessary for that purpose. Only the information that is necessary should be collected, and the data collected should be used only for the relevant purpose. If a hospital were to provide a patient’s information to a pharmaceutical company for an unrelated purpose, that would be improper.”  

Atapattu further stated that organisations must take the necessary precautions to protect the information they held against cyberattacks and other security breaches. Although a cyberattack may occur without an organisation’s knowledge or intention, institutions were responsible for putting appropriate safeguards in place to reduce the risk of such incidents, he said.

There are also practical circumstances that must be considered when applying data protection requirements. The DG noted that during an emergency or disaster, there might not be sufficient time to obtain consent from every individual before taking necessary action. The law therefore provides exemptions for certain circumstances. 

“Under ordinary circumstances, however, organisations cannot simply pass people’s information to other parties without an appropriate legal basis.”

The act also provides for data subject rights. These include rights relating to access to personal information, the correction of inaccurate information, and, in specified circumstances, the erasure of information processed unlawfully. Individuals should also be able to understand why their information is being collected and how it will be used. Where consent is the applicable legal basis for processing, they should be able to withdraw that consent. 

“A person who visits a restaurant might continue receiving marketing messages long after the visit. People should be able to go to such a place and say, ‘Please do not send me these text messages,’” he noted. 

The DG said that once the relevant provisions came into operation, data controllers and processors would not be free to use personal information as they pleased. “Once the act is operationalised, we can initiate an inquiry following a complaint or on our own initiative. After hearing the organisation concerned, we can issue a binding directive requiring it to stop the relevant conduct, take corrective action, or pay compensation to a person who has suffered harm, loss, or damage.”

The act also sets out penalties for organisations that fail to comply with such directives. Under Section 38(1), the authority can impose a penalty of up to Rs. 10 million for each instance of non-compliance. An organisation that has already been penalised and subsequently fails to comply again can face an additional penalty of twice the amount imposed, under Section 38(2), for the second and every later instance of non-compliance.

The consequences can also extend to those managing an organisation. Under Section 38(6), directors and officers responsible for management may be held personally liable for the penalty in the case of a company, while partners may be liable in the case of a firm. They can avoid such liability if they prove that they were unaware of the failure or exercised all due care to prevent it.

The 2025 amendment to the act removed the original fixed commencement deadlines and allowed the minister to appoint dates by gazette notification. Under the dates announced so far, key provisions governing the processing of personal data and the obligations of controllers and processors are due to take effect on 1 January 2027. The Data Protection Authority has also clarified that the data subject rights and penalties provisions are not yet in force under the current commencement arrangements.

Information in a digital world

The legal requirements are only one part of the issue. Organisations must also consider how information is stored, who can access it, and what safeguards are in place to prevent it from being disclosed or misused.

Speaking to The Sunday Morning, cybersecurity adviser Lahiru Livera noted that the PDPA sent a clear message to organisations: personal data is a responsibility, not a resource that can be used freely. Companies should collect only the information they genuinely need for a clear and lawful purpose. 

“There is also a need for organisations to explain how they collect, use, store, share, and retain personal information. Clear privacy notices, straightforward consent procedures, and accessible channels through which people can question the handling of their data are very important.”

He further stated that weak passwords, outdated software, excessive access privileges, poor management of third-party service providers, and inadequate staff awareness could all expose personal information to unauthorised access. 

“Cybersecurity should therefore be treated as an essential part of protecting personal data. A data breach can have consequences beyond the immediate technical problem. It can damage customer trust, create regulatory difficulties, and disrupt the organisation’s operations. Organisations should treat privacy and cybersecurity as responsibilities for their senior management and boards, rather than leaving them solely to their IT departments.”

Speaking further, Livera said that public awareness also mattered, as people needed to understand how their personal information could be misused and take care when sharing details online. 

“Individuals should read privacy notices before using digital platforms. They should also be cautious about online quizzes, competitions, and applications that request unnecessary personal details or permissions. If personal information appears to have been misused, keeping evidence such as screenshots and messages can help when reporting the incident.”

A telephone number supplied to a business, a medical record held by a hospital, or footage captured by a security camera may appear to be different kinds of information. However, each of them can reveal something about an individual, and each can cause harm if it is disclosed or used improperly. 

Surveillance can serve a legitimate purpose. So can the collection of information to provide medical treatment, deliver a service, or carry out an essential public function. But each of these activities comes with a responsibility to handle personal information carefully and respect the rights of the people to whom it belongs. 

Privacy should not depend on a person’s position, political views, or ability to challenge those holding their information. It is a right that must be respected long after the information has been collected.