A Myanmar resident, on behalf of 18 million Telenor subscribers in Myanmar, has filed a complaint to the Norwegian Data Protection Authority against Telenor, accusing the firm of violating the privacy of its Myanmar users. The complaint comes seven months after Telenor said it will sell its Myanmar business to Lebanese investment firm M1 Group, which has formed a partnership with Shwe Byain Phyu, a Myanmar enterprise with ties to the military government.
The complaint was filed by Norway-based law firm SANDS on behalf of Telenor’s customers in Myanmar. SANDS claims that Telenor’s sale will involve the transfer of data harvested from customers in Myanmar and breaches the European Union’s General Data Protection Regulation (GDPR), a data privacy law that came into effect in 2018.
“The complaint argues that the GDPR applies to the sale of Telenor’s Myanmar subsidiary. We ask the Norwegian Data Protection Authority to investigate the case urgently and use its powers to ensure that the rights of Telenor’s customers in Myanmar are not violated, as this could have very serious consequences,” Ketil Sellæg Ramberg, SANDS’ privacy and data security law specialist, said in a public statement.
While GDPR mandates businesses to protect data that belongs to citizens and residents of the EU, it also applies to EU-based companies that control and process personal data outside of EU borders.
But the Fornebu-headquartered Telenor Group argues that even though it is the holding company of Telenor Myanmar, user data generated by customer activity in the Southeast Asian country isn’t “handled” within the EU. Telenor Group also claimed it does not control how the data is processed.
Local rights groups oppose the sale of Telenor Myanmar
On July 8, 2021, Telenor agreed to sell its telecom business in Myanmar to M1 Group for USD 105 million. Since then, rights groups have opposed the planned sale. Nearly 500 local civil groups have accused the firm of failing to “prevent or mitigate adverse human rights impacts.”
Then, on February 1, nearly 170 local rights groups sent an open letter to Norwegian Prime Minister Jonas Gahr Støre, requesting the Norwegian government to halt the deal. The groups said in a statement that the sale could give the Myanmar junta direct access to sensitive user data, which could be used to persecute, arrest, and torture individuals who oppose military rule.
“One interesting aspect of the case is that many times, in these kinds of telecom deals in mergers and acquisitions, you will have a sale of the assets. Different elements of the business are sold separately or as a package. If data is sold as an asset in this way, GDPR will automatically be triggered,” Joseph Wilde-Ramsing, senior researcher at Amsterdam-based rights group Stichting Onderzoek Multinationale Ondernemingen (SOMO), told KrASIA.
“Telenor has structured the deal in a way that is less clear. It is a sale of shares of Telenor Myanmar, rather than a sale of the assets,” he said. Because Telenor argues that a sale of shares does not fall under GDPR, Wilde-Ramsing suggests that the deal’s structure may have been designed to specifically avoid GDPR applicability.
Telenor’s spokesperson said that it is “impossible” for the company to remain in Myanmar, as the company is caught between adhering to local laws, upholding company values, and following international law and human rights principles.
“In such a severe and volatile security situation, there are no simple solutions. We have to balance several difficult considerations and have come to the conclusion that a sale is the least detrimental solution for our employees, customers, and the community. In the sale process, assessments of human rights, privacy, and the safety of our employees have been key considerations,” the spokesperson said.
The transfer of ownership is expected to be completed by February 15, with military-linked gemstone and petrol conglomerate Shwe Byain Phyu set to become the major shareholder with a 70% to 80% stake in Telenor Myanmar, per a local report by Myanmar Now on February 4, citing a source with knowledge of the deal.
In January, Reuters reported that the Myanmar junta had “privately” approved the partnership between M1 Group and Shwe Byain Phyu, citing three sources close to the matter. The junta rejected the sale of Telenor Myanmar in 2021 when M1 Group was the sole buyer, but has endorsed a partnership between M1 Group and Shwe Byain Phyu, one source told Reuters, saying that the military government preferred the involvement of a local buyer.
However, Telenor’s spokesperson emphasized that the company is still awaiting regulatory approval for the sale of Telenor Myanmar to M1 Group.