ICT Policy, Law and Professional Ethics
ICT Policy, Law and Professional Ethics tests the boundary between what is legal, what is policy and what is right. Know the purpose of Sri Lanka's core ICT laws and apply them to realistic requests.
Core rules
- The Electronic Transactions Act No. 19 of 2006 supports electronic transactions and signatures; the Computer Crimes Act No. 24 of 2007 addresses unauthorised access and related offences; the Personal Data Protection Act No. 9 of 2022 regulates personal data processing.
- The Right to Information Act No. 12 of 2016 gives citizens access to public information, subject to exemptions; the Intellectual Property Act No. 36 of 2003 protects copyright, patents, trademarks and related rights.
- Professional ethics require competence, confidentiality, integrity, avoidance of conflicts of interest and respect for privacy.
Worked example
A colleague asks for a citizen's address from a government database. Reasoning: identify the legal basis and the requester's authority; collect only the minimum needed; check whether disclosure is permitted under the data protection and RTI frameworks; log the access; refuse or escalate if authority is unclear. Convenience is not a lawful basis.
Traps
Do not treat a policy circular as a statute; do not assume RTI requires disclosure of every personal record; do not copy licensed software because it is for official use; and do not confuse copyright with patent. Ethics continues where the law is silent.