New Legislation for Data Privacy Protection in Nepal

The Privacy Act, 2075 (2018) is personal privacy law that was recently passed in the country of Nepal in 2018. In contrast to many other forms of legislation geared towards personal privacy which focus largely on the protection of personal data, The Privacy Act, 2075 (2018) contains provisions covering various aspects of privacy, including family privacy, privacy relating to residence, and privacy relating to property, among a host of other relevant topics. However, the law does contain various provisions concerning the collection and process of personal data, as the Privacy Act, 2075 (2018) establishes the basis upon which personal data may be collected and processed with respect to Nepalese citizens.

Which provisions of the Privacy Act, 2075 (2018) apply to the protection of personal data?

As the Privacy Act, 2075 (2018) covers privacy in a more general scope than many other international data privacy laws, the law does not provide definitions for commonly used terms such as data controller, data processor, or data subject. However, the law does defines personal data to include details relating to “health examination, property and income generation, business or transactions, and family matter”, among others. To this point, the Privacy Act, 2075 (2018) does establish the following requirements as it pertains to the personal data of Nepalese citizens:

• Every person shall have the right to keep the personal data or details related to him or her confidential.”
• “While collecting personal or family data of any person, his or her consent shall be obtained.
• The data collected by a public body or body corporate upon obtaining the consent of the concerned person shall be used only for the purpose for which such data have been collected.
• Provided that if any data are demanded for the national security or peace and order, it shall not be deemed to bar to provide such data in accordance with the prevailing law.
• No person shall, without obtaining the consent of another person, provide the following data related to that person to anyone else or publish, or cause to be published, such data: Details relating to health examination, details relating to property and income generation, details relating to employment, etc.
• Notwithstanding anything contained in sub-section (4), in cases where it is necessary to provide any personal data or details to the court or the agency or official authorized under law in the course of investigation of any criminal offence, such data or details shall be provided.
• Notwithstanding anything contained in sub-section (4), if there arises a question as to the issues such as age, qualification, character, sexuality, disability of any person, and the authorized official so demands, the concerned person shall provide such details or documents.

What are the rights of Nepalese citizens under the Privacy Act, 2075 (2018)?

Under the Privacy Act, 2075 (2018), Nepalese citizens have the following rights as it pertains to data protection and personal privacy:

• The right to be informed.
• The right to access.
• The right to erasure.
• The right to rectification.
• The right not to have their sensitive personal data processed.
• The right to file a complaint and seek compensation.

In terms of penalties relating to violations of the law, the Privacy Act, 2075 (2018) does not establish a state or independent regulatory authority for the purposes of enforcing the provisions set forth by the law. Nevertheless, the law does contain provisions that allow for the following sanctions, penalties, and punishments to be levied against individuals and organizations within Nepal to fail to comply with the law:

• When any offense under this Act, other than that mentioned in sub-section (3) of Section 29, is committed, the concerned person may make a complaint to the concerned District Court.
• If any kind of damage, loss or injury is caused to any person due to the commission of any act deemed to be the offense or any other act under this Act, the concerned person or victim may make a complaint to the concerned District Court to get compensation paid for such damage, loss or pain, as well.
• Punishment of imprisonment for a term not exceeding three years or fine not exceeding thirty thousand rupees or both shall be imposed for the offense referred to in sub-section.

Although the Privacy Act, 2075 (2018) is not a comprehensive data protection law and contains broad provisions concerning the protection of personal data obtained from Nepalese citizens, the law does provide said citizens with a means to seek justice and compensation should they feel as though their personal privacy has been violated. As such, the passing of the Privacy Act, 2075 (2018) represents a clear step forward as it pertains to data protection within the country of Nepal, as they are one of many countries within Asia that have sought to enact legislation pertaining to data protection in recent years, including India’s Personal Data Protection Bill and Thailand’s Personal Data Protection Act.