Guardrails or Gags: Why the Online Safety Act fails us
By Amra Ismail
Sri Lanka’s Online Safety Act (OSA) is now part of a series of laws that result in a chilling effect on civic space. Around the world, increasingly, authoritarian and illiberal regimes have resorted to weaponizing fear, using the guise of regulating online content to stifle and trample upon free speech.
Sri Lanka is one such country that passed a law in January 2024 titled the Online Safety Act, No. 09 of 2024, purportedly to address cybercrime. The UN High Commissioner for Human Rights, Volker Türk, in his recent report to the Human Rights Council after a visit to Sri Lanka, noted the “vague definition of offences, broad enforcement powers, disproportionate penalties, and lack of judicial oversight” in the OSA. He further noted how the “combined effect” of the OSA and the Prevention of Terrorism Act (PTA) creates a “powerfully constricting legal framework” which restricts the rights to freedom of opinion and expression in both online and offline spaces. Thus, the enactment of the OSA in Sri Lanka must be understood within two key contexts: first, Sri Lanka’s long history of using repressive laws to suppress dissent; and second, the OSA’s vague provisions and offences, which fall short of international human rights standards. Seen through this lens, the case for its repeal cannot be clearer.
Tech companies have been complicit in amplifying and failing to adequately moderate content, including that which amounts to incitement to violence, disinformation, and technology-facilitated sexual and gender-based violence on online platforms. For example, Facebook was found responsible for failing to remove content that constituted hate speech that fuelled the anti-Muslim riots in Digana in 2018. Similarly, in Myanmar, Facebook’s algorithm amplified military propaganda against the Rohingya population.
The perpetuation of such online harms and abuses necessitates regulation. Self-regulation by tech companies includes content moderation policies and initiatives such as Facebook’s Oversight Board. Prior to the enactment of the OSA, a Code of Practice for Online Safety was reportedly under discussion for tech companies to self-regulate content related to disinformation, hate speech, cyberbullying and online harassment. However, content moderation by tech companies is limited, and it has failed to moderate harmful content. This necessitates state involvement to protect people from their rights being infringed upon by third parties. In the European Union, the Digital Services Act aims to end an era of self-regulation by requiring tech companies to remove flagged hate speech. Allowing states to regulate online speech, however, has the detrimental effect of content censorship and criminalization of expression.
Since the enactment of the OSA, there have been multiple attempts to amend the Act. In February 2024, the Cabinet approved certain amendments. In August 2024, an Amendment Bill was presented in Parliament, reportedly reducing powers enjoyed by the president over the Online Safety Commission. In April 2025, a private members’ Bill was presented to repeal the Act. In recent times, following a cabinet decision, the present government set up a committee to amend the OSA, which called for public input on amendments.
Criminalization of expression
Sri Lanka has a history of misusing legislation introduced to address seemingly legitimate causes. For instance, the ICCPR Act, introduced in 2007, criminalizes the propagation of war or advocacy of “national, racial or religious hatred that constitutes incitement to discrimination, hostility, or violence.” However, it has not resulted in a single conviction of such incitement, especially when there has been actual violence resulting from hate speech directed at ethnic and religious minorities. Instead, it has been used against activists, poets and dissenters. For example, it was used to arrest Shakthika Sathkumara, a writer, and Nathasha Edirisooriya, a comedian, on the basis of insulting Buddhism. Similarly, the Prevention of Terrorism Act has been used to silence dissent, such as through the arrest of Ahnaf Jazeem, a poet, and the conviction of J.S. Tissainayagam, a journalist, for their exercise of free expression. Before the passing of the OSA, there were attempts to introduce laws against “fake news” online. During the COVID-19 pandemic, people were arrested for social media posts online on similar grounds. This entrenched culture of weaponizing laws to stifle dissent raises serious doubts about whether the state will act in good faith to apply the OSA solely to protect and promote our human rights.
The circumstances surrounding the introduction of the OSA also demonstrate that it was not introduced to promote human rights and make the internet a safe space. Although the law was purportedly introduced with the aim of protecting children and women online, it fails to include specific offences that deal with gendered online harms. The law was also enacted against the backdrop of the aragalaya protest movement, which used social media to mobilize people. Activists have raised concerns about how the Act is aimed at instilling fear, causing people to self-censor and preventing a repetition of mass mobilization similar to the aragalaya movement. Further, the Act was passed with a simple majority although it did not fully incorporate the recommendations made by the Supreme Court determination and without procuring the special majority that the passing of the Act required, given its inconsistencies with the Constitution that the Supreme Court flagged.
Further, Sri Lanka’s Supreme Court jurisprudence has long recognized that free speech includes not just the right to express generally accepted ideas, but also “dangerous, aggravating and deviant ideas which the community hated and from which it recoiled” (Channa Pieris v. Attorney General, [1994] 1 SLR 1, 134). The increasing authoritarian trend to stifle dissent through legislation like the OSA and unjust criminalization is not in line with such protections afforded to the exercise of free speech and expression.
OSA inconsistent with international human rights standards
Under international human rights law, everyone has the right to opinion and expression without interference and the freedom to seek, receive and impart information and ideas of all kinds through any media (UDHR, ICCPR, Art. 19). Further, the ICCPR Convention prohibits any “advocacy of national, racial or religious hatred that constitutes incitement to discrimination, hostility or violence.” However, whether it is restricting freedom of expression or prohibiting incitement, any such restriction should fulfil the cumulative tests of legality, legitimacy and necessity and proportionality.
The OSA fails this cumulative three-part test. First, in terms of legality, there should be sufficient precision between lawful and unlawful expressions. However, the OSA uses overbroad language when laying down its intention and does not precisely define what a “prohibited statement” is. The preamble states that the Act provides “safety from prohibited statements made online”, prevents the use of online accounts for “prohibited purposes”, and suppresses the support, including financing, for the “communication of prohibited statements.” Instead of precisely defining what a “prohibited statement” is, the law points to the offences created, which amount to a “prohibited statement.” By failing to define what a prohibited statement is the law leaves it imprecise and ambiguous, thus prone to abuse.
Second, according to the test for legitimacy, restrictions imposed on the freedom of expression should be in pursuit of a legitimate aim to respect the rights or reputations of others and for the protection of national security, public order or public health or morals. According to Article 19, an international human rights organization, states cannot impose restrictions “for the purposes of ensuring respect for “recognised religious text or protecting religions from ridicule”. Section 16 of the OSA restricts with criminal sanctions “outraging the religious feelings of any class of persons” and insulting the religion or religious beliefs by communicating a false statement. These offences cannot fulfil the test of legitimacy, given how Sri Lanka has a history of using similar ambiguous wording against critics on the grounds of insulting Buddhism, the religion to which the constitution accords “foremost place”.
Third, the necessity and proportionality test requires that restrictions have a direct and immediate connection between the expression and the threat, and that the less restrictive measure be applied. According to the Rabat six-part threshold test, determining expressions that can be subject to criminal offences includes considering the context, the speaker, intent to incite, content, extent of its dissemination and likelihood of harm, including imminence. In contrast, the OSA merely creates overbroad offences that impose criminal sanctions, which is a disproportionate restriction on freedom of expression. For example, section 12 uses overbroad vague language such as posing “a threat” to national security, public health or public order or promoting “feelings of ill-will and hostility” which fail to identify the threat clearly. The offence includes criminal sanctions, i.e., Imprisonment for a maximum of five years or a fine up to Rs 500,000 or both. Under human rights law, criminal sanctions can be imposed on the exercise of speech only when such speech amounts to incitement to violence. Thus, the penalty is disproportionate.
The OSA should also be viewed against the global trend of digital authoritarianism, where states use tech companies to surveil, repress, control and censor, and where tech companies resort to the swift removal of even lawful content in response to take-down orders to avoid liability. This would result in tech companies being the enforcers of state repression.
We live in a country that is already mired with experiences of crushing dissent through arbitrary arrests, detentions and convictions. If the government were genuinely concerned about online harms, it would have consulted impacted groups during the law-making process. It could have recognized the varying dimensions and degrees of hate speech on social media that could have warranted civil law remedies, apologies, administrative sanctions and remedies, corrections and right of reply instead of disproportionate criminal sanctions. Instead, given Sri Lanka’s long history of weaponizing laws, the sweeping and overbroad scope of this Act appears to be yet another tool designed to silence dissent.
While online abuses such as technology-facilitated sexual and gender-based violence and incitement to violence are problems that should be addressed, the OSA fails to address these issues through offences that are precise, necessary and proportionate with a direct and immediate connection to these threats. The extent to which amendments can remedy these defects is questionable, as the law is fundamentally flawed at its core.
-This article was originally featured on groundviews.org
Comments are closed, but trackbacks and pingbacks are open.