Introduction
The draft amendments to the Cyber Protection Act, 2026 (the “Act”) come in the wake of the repeal of the Cyber Security Act, 2023, while section 50(4) of the Act itself provides for the annulment of proceedings under several speech-related provisions of the repealed law. Despite this legislative shift, the proposed amendments appear to revive several of the concerns associated with the previous regime, including expanded takedown powers, the introduction of a new offence relating to “rumours,” the treatment of defamation within a cognizable framework, and increased penalties. This blog examines these proposed changes against the constitutional guarantees under Articles 27, 31, 32, 33, 35, 39, 40 and 43 of the Constitution of Bangladesh.
1.Freedom of speech and press (Article 39 of the Constitution)
Article 39(2) permits only “reasonable restrictions” on specified grounds: state security, friendly relations with foreign states, public order, decency or morality, contempt of court, defamation, and incitement to an offence.
Section 8(2)
Blocking power now extends beyond law-enforcement agencies to the Ministry of Information and Broadcasting and any authority the government empowers. The trigger widens from information that harms integrity or order to “information, disinformation or rumour” that merely creates an apprehension (আশংকা) of harm. New clause (ঘ) covers content that is defamatory of any person or institution or “insulting to the State.” However, insult to the State is not an Article 39(2) ground at all. Apprehension-based standards also collapse the distinction that was made by the Indian Supreme Court in Shreya Singhal v. Union of India (2015) 5 SCC 1 that only incitement, not mere discussion or advocacy, can justify restriction. Kedar Nath Singh v. State of Bihar (AIR 1962 SC 955) likewise requires a tendency to create disorder or disturbance of public order by resort to violence.
Section 26ক
This new offence carries 10 years’ imprisonment and a 40 lakh taka fine. “Rumour” (গুজব) is defined as “unsubstantiated or unverified” information likely to cause confusion, panic or agitation. It requires neither falsity nor intent. So, truthful yet unverified reporting, including investigative journalism, is caught under this section. Only “disinformation” (অপতথ্য) carries an intent element. The provision resembles the vague “annoying, inconvenient” language struck down in Shreya Singhal. The penalty is also disproportionate because under the Penal Code, 1860, defamation (sections 499–500) carries at most two years’ simple imprisonment.
Section 25 and defamation
The amendment doubles penalties for sexual harassment and blackmail, which is defensible given their gravity. But it bundles defamation and “bullying” into the same section. Defamation is a permissible Article 39(2) ground, yet the Explanation adds “insulting” and “harmful” material that need not be false in the section 499 sense.
2.Liberty, arrest and criminal procedure (Articles 31, 32, 33, 35)
Under the Second Schedule to the Code of Criminal Procedure, 1898 (CrPC), defamation is non-cognizable and bailable. It is prosecuted on complaint by the aggrieved person (section 198 of CrPC), and police need a Magistrate’s order to investigate (section 155 of CrPC). The draft alters this in two ways.
First, section 46(1) of the Act keeps section 25 of the Act offences cognizable, so police may arrest without warrant under section 54 of CrPC. The High Court Division’s directions in BLAST v. Bangladesh (2003) 55 DLR (HCD) 363 on sections 54 and 167 of CrPC were prompted by exactly this kind of abuse: arrests on suspicion followed by remand. Indian courts responded similarly in Arnesh Kumar v. State of Bihar (2014) 8 SCC 273, requiring reasons before arrest for offences punishable up to seven years.
Second, section 40(1) of the Act allows a member of a law-enforcement agency, not only the aggrieved person, to institute a case. This departs from the policy of CrPC section 198, under which only the person defamed sets the law in motion. The State can therefore prosecute “insult” on its own initiative, with the chilling effect familiar from section 57 of the ICT Act and the Digital Security Act, 2018.
3.Equality and remedies: the immunity clause (Articles 27, 31, 44, 102)
The new section 52 of the Act deems Council members and officers “public servants” and bars any civil or criminal case for acts done in good faith. This goes further than CrPC section 197, which merely requires government sanction to prosecute public servants. A blanket bar undermines equality before the law (Article 27 of the Constitution of Bangladesh) and the citizen’s remedy for unlawful state action (Articles 31, 44 of the Constitution of Bangladesh). While Article 102 writ jurisdiction cannot be ousted by statute, as Anwar Hossain Chowdhury v. Bangladesh 1989 BLD (Spl) 1; 41 D.L.R. (AD) 165 (1989) confirmed judicial review as a basic structure feature, such clauses still deter victims and shift the burden to them to prove bad faith after the fact.
Conclusion:
The proposed amendments to the Cyber Protection Act, 2026 revive many of the concerns that led to the repeal of the Cyber Security Act, 2023. Apprehension-based blocking powers, the “insult to the State” ground, the rumour offence under section 26ক (which requires neither falsity nor intent), cognizable defamation, police-initiated prosecution, and the blanket immunity in section 52 of the Act each strain against Articles 27, 31, 32, 33, 35, 39, 40 and 43 of the Constitution. Regulating genuine disinformation and gender-based online harms remains legitimate. But the draft should be revised to remove “insult to the State” and “rumour,” adopt an incitement-based standard, restore the ordinary non-cognizable treatment of defamation, and confine the immunity clause. A cyber law is judged not by how widely it reaches, but by how carefully it separates harmful conduct from lawful speech.
Written By: Barrister Md Shafiuddin Jihad, Associate, Vertex Chambers.
AstuteHorse