The Need for data protection law in Nepal: Securing Citizen's Rights in the Digital Age

Abstract

Nepal is undergoing rapid digitization of services across sectors like education, commerce, finance and healthcare. However, this digital transformation has enabled mass collection of citizens' personal data by both government and private companies without sufficient consent, transparency or protection around data use. Vast troves of Nepali citizens' information ranging from names and biometrics to browsing history, purchases and location data are being harvested through digital platforms and systems. This article analyzes the policy gaps around safeguarding citizens' data privacy rights in Nepal. It highlights real-world cases of harms arising from lack of governance around citizens' data, including electoral manipulation, data breaches, unregulated cross-border data transfers and privacy violations during the pandemic under the guise of public health response. For instance, the Cambridge Analytica scandal revealed how private firms can covertly harvest citizens' Facebook data to psychologically profile voters and target them with customized disinformation to influence their behavior. The article argues that forward-looking and rights-based data protection legislation on par with global benchmarks has become an urgent democratic imperative if Nepal is to secure its citizens' privacy, autonomy and choice in the digital age. Comprehensive governance setting clear consent requirements, purpose limitations and penalties around collection and use of citizens' data can no longer be delayed, as Nepal lags behind many of its regional peers in enacting such safeguards. The article makes the case for recognizing data protection as a 21st century freedom struggle to reclaim citizens' rights in virtual spaces in the age of surveillance capitalism.¹ Enacting strong data privacy law is positioned as essential for equitable digital development in Nepal.