In this age of intelligent machines, journalists often keep information that is sensitive, confidential and self-evidentiary in their laptops or mobile phones, or in cloud storage facilities. That is why the threshold of privacy of such data is much higher than of personal data. One can recall the Panama Papers scandal, which shook the whole world with revelations of confidential documents regarding corruption and offshore wealth. Therefore, access to the digital devices of a journalist cannot be given without due process and judicial scrutiny, and without maintaining checks and balances in order to protect the right to privacy and freedom of the press in a democratic society.

In April 2021, the European Court of Human Rights (ECHR) ruled in favour of Natalia Sedletska, host of the award-winning investigative TV programme "Schemes". She was accused of leaking state secrets nearly four years ago by Ukrainian prosecutors, and a Ukrainian court ruling in 2018 gave authorities unlimited access to 17 months' data from her smartphone. The ECHR concluded that Sedletska should be protected from the data search under Article 10 of the European Convention on Human Rights, which is essential for free press and privacy in a democratic society. The ECHR verdict says "[T]he court is not convinced that the data access authorisation given by the domestic courts was justified by an 'overriding requirement in the public interest' and, therefore, necessary in a democratic society".

So, the higher threshold of privacy and protection of journalistic sources can be justified, especially when it involves public interest. The UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank Law Rue, recommended in his report that, "Journalists should never be forced to reveal their sources except for certain exceptional cases where the interests of investigating a serious crime or protecting the life of other individuals prevail over the possible risk to the source. Such pressing needs must be clearly demonstrated and ordered by an independent court." Another report by the UN High Commissioner for Human Rights emphasises that, "no interference could take place except in cases envisaged by the law. Interference authorised by States can only take place on the basis of law, which itself must comply with the provisions, aims and objectives of the Covenant". As per the UNESCO Resolution on internet-related issues published on November 2013, "…privacy is essential to protect journalistic sources, which enable a society to benefit from investigative journalism, to strengthen good governance and the rule of law, and such privacy should not be subject to arbitrary or unlawful interference…".

Now the question is, where does Bangladesh stand in terms of data protection of journalistic sources? It is to be noted that there is no dedicated Data Protection Act enacted in Bangladesh yet that expressly talks about digital safety or data protection of journalistic sources. Article 43 (b) of our Constitution ensures privacy of correspondence and other means of communication, subject to reasonable restrictions imposed by law in the interests of the security of the State, public order, public morality or public health. Different ICT-related laws, such as the Bangladesh Telecommunication Act 2001, The Information and Communication Technologies Act 2006, and Digital Security Act 2018 do not contain any provision on privacy of "journalistic sources". Instead, Section 43 of the Digital Security Act 2018 gives free rein to law enforcement agencies to confiscate any computer or computer systems (smart phones can be included in this regard) and obtain data or information from anyone if the law enforcement official has reasons to believe that the evidence might be destroyed or compromised. Even a police officer can arrest a person or confiscate a computer if s/he believes that a crime (defined within the DSA) is about to happen. When I was in school, I watched the movie Minority Report, which showed people being criminalised for even thinking of a crime. I never thought that such fiction would one day be reflected through the DSA, which destroys the basic principles of defining a crime—that is, both actus reus (action done) and mens rea (guilty mind) have to be present to constitute a crime. But how can we establish that actus reus is fulfilled when a person is yet to commit a crime?

Also, if a journalist collects confidential information of a government office from a government employee who collected that information by misusing telecommunication apparatus, the Inspector assigned by the Bangladesh Telecommunication Regulatory Commission (BTRC) can look into such data or records under the Bangladesh Telecommunication Act 2001 (Section 68, 74 and 61). However, a journalist's smartphone might not contain data of the alleged crime only, but also other confidential journalistic sources and personal data. Accessing data for investigating alleged crimes is necessary and legitimate, but having to give access to digital devices also creates the scope for compromising other personal information that might not have any relation to the alleged crime. The nature of a digital space as a crime scene is not the same as that of a physical crime scene, but none of the Bangladeshi laws recognise this difference. Section 8 of the Official Secrets Act 1932 also says that it shall be the duty of every person to give information on demand relating to an offence or suspected offence. This leads to another grave concern for investigative journalists—self-incrimination. Can a journalist be compelled to give the password to their digital device, which might reveal data leading to criminalisation?

Article 35 (4) of the Constitution of Bangladesh clearly says that, "No person accused of any offence shall be compelled to be a witness against himself". The International Covenant on Civil and Political Rights, to which Bangladesh is a party, says in Article 17 that "no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation". It further states that "everyone has the right to the protection of the law against such interference or attacks." Also, in the case of Monzur Ahmed Bhuiyan and Ors. vs Adilur Rahman Khan and Ors., the Appellate Division of the Supreme Court of Bangladesh upheld the decision of the High Court Division that the Voluntary Disclosure of Information Ordinance 2008, through which the government formed the Truth and Accountability Commission for voluntary disclosure of corruption-accused, is unconstitutional and illegal. The High Court Division declared that the said impugned Ordinance is violative of Article 94 and 111 under part VI and also Articles 27, 31, 35(3), 35(4) and 58B-E of the Constitution. Also, in the recent judgement of State vs Oli, the High Court Division of the Supreme Court observed that "…it is our common experience that nowadays private communications between the citizens including their audios/videos are often leaked and published in social media for different purposes. We must not forget that the citizens' right to privacy in correspondence and other means of communication is guaranteed under Article 43 of the Constitution which cannot be easily violated at the instance of any interested quarter."

The BTRC and telecommunication companies operating in Bangladesh have a great responsibility towards proper compliance of the Constitutional mandate of maintaining privacy in communication. They cannot provide any information relating to the communication of/between their subscribers and the citizens of this country, unless it is permissible in law matched with the Constitution. Therefore, forcing a person, regardless of their profession, to give up access to their digital device which may lead to his/her being criminalised is a violation of the above mentioned constitutional rights. Which begs the question: should not the above mentioned provisions of the Official Secrets Act, Telecommunication Act, and Digital Security Act be declared unconstitutional? Is it not high time that we introduce higher thresholds within our local laws to protect the privacy and freedom of journalists, human rights defenders, and rights activists?

Md Saimum Reza Talukder teaches Cyber Law at the School of Law, BRAC University.