Introduction
The expansion in the issuance of legislation related to telecommunications and information technology has produced a legal framework characterized by a predominantly punitive approach, relying, in many instances, on broad, open-ended provisions that permit expansive interpretation and leave the scope of legal application insufficiently defined. Rather than encouraging the enactment of additional legislation in this field, this paper advocates restraining the impulse to legislate, slowing the production of new laws, and, where possible, halting it altogether except in exceptional circumstances where evidence and measurable assessment demonstrate that the existing legal framework is inadequate to address a specific deficiency.
This approach is based on the fact that frequent and hasty legislation—especially when drafted in loose terms or based on a punitive rationale—may create a confusing legal environment riddled with loopholes and contradictions, thereby undermining rights and trust in the legal system. Therefore, this paper presents to the policymaker a set of analytical tests that should precede any new legislative proposal and must be satisfied before proceeding. These tests can be summarized as follows: Is there a real and identifiable harm that cannot be adequately addressed under the existing legal framework? Have available non-legislative measures been pursued? Have less rights-restrictive and more adaptable regulatory alternatives been considered?
Under this approach, legislation becomes a measure of last resort rather than a first response and should be pursued only when the legislator has satisfied these conditions and tests. The paper aims to emphasize that excessive lawmaking may become an obstacle to sustainable digital transformation and the protection of fundamental rights. That sound legislative policy in this field is based on refraining from legislation except within the narrowest scope and under strict conditions, rather than treating every technological phenomenon as sufficient justification for issuing a new law.
This paper provides detailed policies and legislative guidance for legislators and policymakers in Egypt on drafting and enacting telecommunications and information technology laws. Rather than offering model legislative provisions, it focuses on policies and practical guidance to support the legislator in making informed decisions about the necessity of legislation, ensuring that no new law in this field is enacted unless it is necessary, specific, and balanced.
First: Constitutional Requirements for Drafting Telecommunications and Information Technology Laws
Laws governing the telecommunications and information technology sector directly affect fundamental rights and freedoms as well as the credibility of the legal system. Respect for the Constitution, both in its text and spirit or underlying principles, is therefore the primary prerequisite for any legislative initiative in this field. The Constitution establishes binding principles, including the protection of freedom of expression, the right to privacy, and the guarantee of a fair trial. These principles constrain the authority of the legislator and oblige it to draft laws that protect rights and limit restrictions on them.
When enacting new laws, compliance with the Constitution requires subjecting the proposed texts to rigorous tests. Legislation may be resorted to only in the presence of a genuine deficiency for which existing laws are insufficient, and on the condition that the drafting be specific and clear to prevent ambiguity and limit expansive interpretations. Disregarding these requirements risks producing legislation that conflicts with constitutional provisions, rendering it vulnerable to constitutional challenge, and undermining both its legitimacy and the confidence of those subject to it.
Constitutional compliance does not stop at the level of general principles; rather, it extends to the incorporation of concrete procedural safeguards into the laws that regulate the digital space. Constitutional protections for privacy and freedom of the press must be translated into enforceable legal rules that constrain executive authority. Accordingly, website blocking or surveillance should be permitted only pursuant to a reasoned judicial order that is limited in both duration and scope, accompanied by effective and timely avenues for appeal. Implementing authorities should also be required to provide reasons for their decisions and publish periodic reports on their activities. Any law that lacks these safeguards does not meet the minimum threshold of constitutional obligations, even if it appears to be consistent with the general provisions.
Drafting legislation related to the digital space also requires a progressive reading of constitutional texts. These texts were written at a specific historical moment, but they were designed to remain adaptable to social and technological developments. Thus, if the Constitution has provided for the protection of printed newspapers from censorship or suspension, the substance of that protection must extend to digital newspapers, news websites, and digital platforms that have become primary tools for practicing journalistic work. Similarly, provisions that guarantee the confidentiality of correspondence and calls must encompass email, instant messaging applications, and cloud storage services.
Such progressive reading of the constitutional texts preserves the substance of rights and prevents discrimination between traditional and modern media. It also helps to strike a balance between respecting the underlying principles of the constitutional text and adapting it to a digital reality that impacts the lives of individuals, communities, and nations.
Second: Legislative Necessity and Assessment of Available Alternatives
Before enacting any new telecommunications and information technology legislation, an analytical approach based on data and evidence must be followed to demonstrate the existence of a problem with a tangible impact that requires intervention. It is also necessary, first and foremost, to verify the extent to which existing legal and regulatory instruments can address it.
Reviewing the Existing Legal Framework:
In many cases, existing general or sector-specific laws may be sufficient to address the problem, provided they are properly enforced or interpreted. For example, rather than enacting a new law to criminalize online fraud, it may be sufficient to amend the relevant provisions of the Penal Code governing fraud and deception to encompass digital means expressly. Therefore, current laws in force, such as the Penal Code, the Civil Code, and existing telecommunications laws, must be examined to determine whether they already include tools to address the issue in question.
Exploring Non‑Legislative Alternatives:
Where the existing legal framework proves insufficient, the potential of adopting non‑legislative measures or subordinate regulations should be considered. Issuing an executive regulation, a ministerial decision, or a binding code of conduct may be sufficient to address certain technical aspects without the need for a law.
For example, rather than immediately criminalizing certain forms of internet misuse, an administrative body—such as the National Telecommunications Regulatory Authority—could issue a code of conduct for digital content or technical standards for cybersecurity in consultation with stakeholders.
Administrative Sanctions before Criminal Penalties:
Where intervention becomes necessary to address a particular form of conduct, punitive measures should follow a graduated approach. The initial response should rely on administrative measures or proportionate financial penalties, such as notices and warnings, followed by fines proportionate to the violation, and, where necessary, temporary suspension of the relevant activity, before resorting to criminalization as a measure of last resort.
Criminal sanctions should be employed only where all less restrictive measures have proven ineffective in deterring harmful conduct and where the resulting social harm is sufficiently serious. In such cases, the specific criminal offense should be defined narrowly and precisely and reviewed periodically to verify its necessity.
Periodic Review:
Even after the enactment of new legislation, the law should be subject to mandatory review at specified intervals, such as every three or five years, to assess whether it remains necessary and effective. If, over time, the targeted harm has ceased to exist or has significantly diminished, the legislator should amend or repeal the law accordingly. Legislation in a rapidly changing field must remain open to review and amendment in response to technological developments and societal needs.
Third: Guiding Principles for Drafting Digital Legislation
Where the need for new legislation or an amendment to an existing law is established, the legislator should adhere to a set of principles that ensure the law’s consistency with the Constitution and the state’s human rights obligations. These principles include the following:
Principle of Necessity and Suitability:
No new legal provision may be enacted, particularly if it imposes restrictions on rights or criminal penalties, unless there is a proven urgent social need, and only where no less restrictive alternative can achieve the same objective. This principle reflects the three-part test of the international human rights law, which requires that restrictions on rights, such as freedom of expression, be justified by a pressing social need in pursuit of a legitimate aim. Accordingly, before resorting to criminalization, the legislator must demonstrate that administrative, regulatory, or technical measures are insufficient to address the problem at hand.
Proportionality and Scoping:
If the need for legislation is proven, its provisions should be proportional to the extent of the harm targeted, whether in the scope of criminalization, the severity of the penalty, or the duration of the restrictive measure. Any restriction imposed by law must be limited to the extent necessary to achieve the legitimate objective, and must not exceed what is necessary to address that objective. For example, criminal penalties must be proportional to the gravity of the criminal act and the damage resulting from it, and not reach the point of exaggeration that turns them into deterrent rather than corrective penalties.
Legality and Legal Certainty:
In accordance with the rule of law, legislation must be drafted in clear and specific language that does not permit loose or broad interpretation. Vague and open-ended terms such as “whatever undermines digital national security” or” “violations of family values” should not be used unless they are clearly and precisely defined within the legislation itself.
The absence of such definitions undermines individuals’ ability to foresee which conduct is prohibited and grants law enforcement authorities excessive interpretive discretion. International standards have stressed the need to avoid vague wording in the texts of technology‑related criminal offenses. Therefore, whenever the need arises to use a broad concept, the law must provide a precise and practical definition or refer to a specific definition in another legislation.
Protection of Fundamental Rights and Freedoms:
Any new technology-related law must proceed from the perspective of safeguarding digital rights and ensuring that they are not restricted except within the narrowest limits and in accordance with the requisite judicial safeguards. This includes respect for freedom of expression, the right to privacy, the protection of personal data, and the right to communication and access to information without discrimination. Legal texts should explicitly state that they do not infringe upon lawful activities guaranteed by the Constitution, such as journalistic and media activities, scientific research, peaceful political criticism, and other protected practices.
Accountability and Transparency:
Laws should include effective mechanisms for oversight and accountability in the implementation of their provisions, thereby enhancing their legitimacy and public trust. This requires the inclusion of provisions that oblige administrative bodies, such as telecommunications regulatory bodies and security agencies, to publish periodic reports on their exercise of powers under the law, including, for example, the number of website-blocking orders issued, the justifications for those orders, and their durations.
It is also necessary to provide prompt and effective avenues for judicial and administrative appeals against executive decisions, such as blocking and surveillance orders, with notification of the entities or individuals affected by the decision, enabling them to defend their rights. Executive authorities, such as the National Telecommunications Regulatory Authority, should also be subject to independent parliamentary and judicial oversight, whether by requiring prior judicial authorization for certain measures or by enabling Parliament to request reports and hold those responsible for implementing the law accountable.
Minimizing Criminalization:
Wherever possible, technology-related legislation should rely on civil, regulatory, or administrative mechanisms rather than expanding the use of criminal offenses and penal sanctions. Where criminalization is genuinely necessary, the offense should be defined narrowly and with precision.
Less serious technical violations can often be addressed through administrative measures, such as requiring the responsible entity to remedy a security vulnerability within a specified timeframe or by escalating financial penalties for repeated non-compliance.
Codes of conduct, developed in consultation with sector stakeholders, can also be used instead of excessive criminalization, which can stifle innovation. A restrained approach to criminalization aligns with the rapidly evolving nature of technology, where harmful conduct may sometimes result from a lack of knowledge or inadvertent negligence rather than criminal intent warranting penal sanctions.
Technological Neutrality and Future Development:
Legislation should be drafted in a technologically neutral manner as far as possible, so that its provisions are not tied to a specific technology or software tool that may become obsolete over time. Laws that enumerate detailed types of devices or media may lose their effectiveness in the face of rapid technological developments. Therefore, it is preferable to adopt general terms that allow the law to apply to new, emerging technologies.
For example, rather than naming a specific type of encryption, the law could set out principles for the use of secure encryption regardless of the algorithm used, leaving the details to technical standards that can be updated outside the legislative framework. Technological neutrality helps extend the text’s legislative lifespan and reduces the need to amend it with every new technological development.
Non‑Delegation of State Responsibilities to Private Entities:
The legislator should avoid granting law-enforcement powers to private entities, such as telecommunications companies and platform providers, in a manner that turns them into bodies that exercise prior and comprehensive surveillance over users. Maintaining public security and public order is a core responsibility of the State, to be exercised through its judicial and executive institutions. Accordingly, the law should not require private companies to proactively monitor all user-generated content or conduct blanket filtering of telecommunications, as such obligations undermine users’ privacy and render procedural guarantees void of their substance. Instead, intermediaries’ obligations should be limited to cooperating with competent authorities pursuant to specific judicial orders relating to clearly identified individual cases, without transforming them into investigative bodies or requiring them to collect information without judicial authorization.
Fourth: Common Legislative Drafting Pitfalls to Avoid
Egypt’s legislative experience over the past decade in the fields of telecommunications and information technology has revealed several recurring flaws and drafting issues that have drawn criticism from human rights advocates and caused implementation problems. This section presents the most prominent of these pitfalls, which the legislator should avoid in the future.
Ambiguity in Terms and Loose Drafting
The legislator sometimes resorts to using broad, imprecise terms such as “national security”, “public order” or “public morals” as grounds for restricting content or imposing penalties, without defining them precisely within the framework of the law. Similarly, some laws contain loose terms to criminalize acts such as “disseminating rumors”, “misusing means of communication,” or “threatening social peace” without clearly delineating the boundary between lawful and unlawful conduct.
Such legislative ambiguity is inconsistent with the principle of legality of crimes and penalties and renders individuals unable to anticipate the legal consequences of their actions. It also grants the executive authority a broad discretion to interpret the text in a manner that serves its political objectives.
Such ambiguity expands the scope of criminal liability beyond genuinely harmful conduct. It may extend to affect legitimate discourse under headings such as national security or the dissemination of rumors. This encourages self-censorship among individuals and institutions and hinders the consistent application of the law in the absence of clear, objective standards.
To avoid this pitfall, legislators must define key terms in the legal text; if a broad concept like national security is deemed necessary, it must be accompanied by a precise definition that clarifies its meaning and incorporates the standards of necessity and proportionality into the criminal articles.
Overreliance on Criminal Sanctions Instead of Regulatory Measures
Some legislation tends to adopt an escalating punitive approach, imposing severe criminal penalties, such as lengthy imprisonment and immense fines, for conduct that milder sanctions could address. This is evident in the Anti-Cyber and Information Technology Crimes Law, which imposes custodial sentences and high fines for offenses such as “unauthorized use of telecommunications service” or “unauthorized access to a government website”. These actions may sometimes stem from ignorance or a lack of understanding, and therefore do not always warrant criminal punishment.
The law also stipulates imprisonment for service provider managers if they fail to immediately block offending websites, potentially putting individuals who did not commit the original offense at risk of imprisonment due to a technical procedure that may not have been implemented quickly enough.
Overreliance on criminal sanctions harms the digital environment, as individuals may refrain from experimentation and innovation for fear of being subject to strict penal provisions. It also burdens the criminal justice system with a large number of cases that may not be as serious as traditional criminal offenses, thereby slowing down case resolution and draining state resources.
Overreliance on Executive Regulation Rendering the Law Void
Some recent Egyptian legislation has considered it sufficient to set out general principles and refer most of the substantive details to executive regulation or future ministerial decrees. While technical details may be appropriate for regulation, excessive referral to them creates a legal void until the regulation is issued and may create ongoing uncertainty if its issuance is delayed. In the field of technology, this causes disruption because many rights and obligations remain effectively undefined even though the law exists.
Egypt’s Personal Data Protection Law No. 151 of 2020 illustrates this problem. For several years after its enactment, the law remained largely inoperative in practice pending the issuance of its executive regulation. While the Law established rights for individuals and obligations for data controllers and processors, it deferred several essential matters to the executive regulation, including the conditions governing cross-border data transfers, procedures for notifying data breaches, and mechanisms for submitting complaints. The executive regulation was issued more than four years after the scheduled date, effectively suspending the law’s application throughout that period.
This approach leads to a state of uncertainty among those subject to the law, as they do not know precisely what is required of them to avoid until the regulations are issued, which may be delayed or remain incomplete. It also undermines the effective enforcement of the law: administrative authorities cannot act effectively without a detailed regulatory framework, and courts cannot resolve disputes consistently without clear standards for assessing compliance. As a result, the law loses both its deterrent and preventive effects for a prolonged period.
Therefore, the text of the law itself must clearly outline rights, obligations, and sanctions, and the essence of the right should not be left to regulations. When enacting the law, the legislator should envision how it will be applied in practice and ensure that the core elements are sufficiently detailed.
Where a referral to a regulation is necessary due to the changing nature of technology, the law should provide a specific, short timeframe for its issuance, such as three or six months from the date of the law’s publication. The law should provide for the immediate application of its provisions in their general sense, or the application of relevant international standards as a transitional measure, should the regulation not be issued within the specified period.
Restricting Digital Security Tools and Encryption
The fundamental principle of legislation is that technological tools, used to protect individuals and society from risks, are not inherently criminalized. Criminal liability should attach only to harmful conduct committed through such tools or by other means. The possession of digital security tools should not be criminalized simply because they may be misused.
Tools such as antivirus software, encryption technologies, anonymity and privacy-enhancing tools, and password managers are essential for protecting the security of individuals, institutions, and the state in the digital environment. Accordingly, legislation should promote their lawful and secure use rather than criminalize their possession.
Some legislation seeks to reverse this principle, expanding the scope of criminalization to include the mere possession or use of digital security tools, even in the absence of any harmful conduct. Encryption clearly illustrates this problem, as it is one of the most widely used and effective tools for protecting the confidentiality of data and communications. Instead of treating it as a legitimate right and a necessary tool for digital security, some legal texts treat it as a suspicious activity that requires licensing or prohibition, leading to counterproductive outcomes.
Article 64 of the Telecommunications Regulation Law exemplifies this approach. It prohibits both telecommunications service providers and users from using any equipment to encrypt telecommunications services without prior written approval from the National Telecommunications Regulatory Authority and multiple security agencies. It also obliges telecommunications companies to install technical equipment enabling security agencies to carry out surveillance. In practice, this provision imposes a general licensing restriction on encryption, thereby making its use – even for routine protective purposes such as securing databases or electronic transactions – contingent on obtaining multiple and complex approvals.
The restrictions imposed on digital security tools undermine individuals’ and entities’ ability to protect their systems and data and increase society’s vulnerability to hacking and unauthorized surveillance. They also impact investors’ trust in the hosting environment and infrastructure and complicate the operation of cloud services and local data centers that require strong encryption by default.
From a fundamental rights perspective, restrictions on encryption infringe upon the right to privacy, the confidentiality of correspondence, and freedom of expression, because they expose legitimate communications to prior surveillance and constrain journalists, human rights defenders, and researchers who rely on protective tools to ensure digital safety.
Addressing the criminalization of digital security tools requires shifting the legislative policy from a model of blanket prohibition to precise regulation grounded in clear judicial safeguards. This does not mean depriving the law of tools for intervention, as intervention remains possible in specific, narrowly defined cases through a judicial process that guarantees necessity, proportionality, and individual privacy. Such intervention should never be general or preventive in nature, but should instead be limited to a specific serious offense, directed at a particular individual, and carried out pursuant to a prior judicial order that is subject to review, appeal, and compensation.
Broad Definitions of Digital Crimes without Legitimate Exceptions
Some criminal legislation in the technology field suffers from an expansion of the scope of criminalization to include acts that, in certain contexts, may be legitimate or beneficial to society. For example, Egypt’s Anti-Cyber and Information Technology Crimes law criminalizes activities such as “website spoofing” and “violating the integrity of data and information” without providing clear exceptions for conduct undertaken for legitimate purposes, such as security testing or scientific research. This may deter information security researchers from reporting vulnerabilities or testing government systems for fear of prosecution, despite the recognition of these activities in cybersecurity practice as a means of enhancing digital protection.
The law also does not exempt cases in which the moral element of the crime is absent, such as when a person accesses a device believing they have permission, or as a result of an unintentional technical error. A clear exception is also absent for the copying of information for backup or educational purposes.
Any unauthorized copying of software or data may be treated as a criminal offense, even where there is no intent to obtain unlawful gain or cause harm. Accordingly, digital-related offenses should be drafted as narrowly as possible, with both the physical and moral elements of the crime clearly defined. The prohibited physical conduct should also be defined in such a way that it does not extend to lawful activities.
Absence of Human Rights and Economic Impact Assessment before Legislation
Some laws are enacted hastily, or in response to incidents that attract significant public attention on social media, without adequate assessment of their potential impact on fundamental rights or their economic and technological consequences. Such shortcomings in legislative preparation may lead to unintended outcomes, including restrictions on freedom of expression, excessive compliance costs on businesses, or disruptions to beneficial services. In many countries, Regulatory Impact Assessment has become a mandatory step before the enactment of any new legislation.
The absence of impact assessments creates a gap between the legal text and its practical implementation. It may become apparent after enactment that the law is not enforceable except at high cost, or that it hurts the investment environment. Public opposition or objections from the business community may also emerge once implementation begins, forcing the state to amend or suspend the legislation.
From a human rights perspective, harmful effects may likewise become evident only after the law takes effect, such as adverse impacts on press freedom. This may leave legislators having to defend legislation that has attracted widespread criticism or devote additional time and resources to rectify it.
Therefore, an explicit legal requirement should be introduced, mandating that every new draft law be accompanied by a publicly available human rights and economic impact study. This study must include an analysis of the draft’s provisions from a human rights perspective, including their impact on freedom of expression or privacy, and an assessment of whether the proposed restrictions are justified and necessary. It should also include an economic analysis, such as an estimate of compliance costs for companies and the draft’s impact on the digital gross domestic product.
The study should be prepared through public consultations with relevant stakeholders, including technology and telecommunications companies, civil society organizations working on digital rights, and academic experts. The proposed legislation should also be published on official government platforms for a reasonable period to allow public comments before its adoption. Such consultations help identify potential concerns before they arise in practice and may, in some cases, lead to abandoning the proposed legislation altogether where it is found to offer limited public benefit or where its likely adverse effects outweigh its expected advantages.
Fifth: Practical Recommendations for Effective and Balanced Legislation
This section addresses the procedures and steps that the legislator should follow to ensure that laws enacted in the field of telecommunications and information technology achieve their objectives, without infringing constitutional rights or hindering digital development.
Precise Definitions for Technical and Security Concepts
Any new law should begin with a comprehensive definitions article for the key terms contained therein, particularly those that may be open to multiple interpretations. For example, terms such as “information national security”, “online social peace”, “digital hate speech”, and “sensitive personal data” should be clearly defined.
These definitions should be as operational and practical as possible, clearly identifying the scope and standards of each concept. For example, the definition of “national security” may specify the types of conduct that constitute a genuine threat, such as cyberattacks targeting military installations or critical government networks. Likewise, the definition of “incitement to violence” may draw on internationally recognized standards, including explicit advocacy of violence or discrimination against a protected group.
This approach prevents core concepts from being left to broad interpretation after the law has been enacted, strengthens legal certainty, and limits the use of loose terms to restrict the exercise of a legitimate right.
Achieving Legislative Alignment and Issuing a Framework Law When Necessary
When enacting new legislation on a subject that intersects with other existing laws, the legislator must ensure legislative consistency. If the new law represents the broader general policy, it may be established as a “framework law” under which general principles are set out, and other laws are amended accordingly to align with it.
For example, if a comprehensive information security law is enacted, it should include consequential amendments to the Telecommunications Regulation Law, the Penal Code, and other relevant legislation to eliminate any conflict or duplication. On the other hand, if a specialized law is enacted, such as the Personal Data Protection Law, it should include an article stipulating the supremacy of its provisions over other laws in case of conflict in the field of privacy, with exceptions limited to a narrow scope, such as criminal investigation cases conditional upon a judicial order.
Limiting Criminalization to Actually Harmful Conduct and Rationalizing Sanctions
The legislator should narrow the scope of criminalization to acts that cause material or moral harm so grave that they cannot be addressed by non‑criminal means. To this end, the list of offenses in technology‑related laws should be reviewed and refined. For example, online defamation and insult may be addressed through civil remedies, including compensation, without resorting to criminal sanctions.
Vague offenses such as “misuse of social media” should likewise be repealed or reclassified as administrative violations, such as fines for disseminating offensive content that falls outside the scope of freedom of expression.
By contrast, conduct posing a clear and serious risk should remain subject to criminal liability, such as hacking with the intent of causing damage, digital identity theft for financial fraud, dissemination of malicious software that damages systems, and online sexual exploitation of children.
These conducts are linked to specific victims, or directly threaten public security and the digital economy, thereby justifying their criminalization and the imposition of deterrent penalties. Even in such cases, criminalization should be linked to criminal intent so that those who did not have criminal intent are not punished.
A graduated punitive scale should also be adopted, whereby the baseline penalty is a misdemeanor, such as a short term of imprisonment or a fine, and is elevated to a felony only in cases of recidivism or where the conduct causes grave harm.
The unnecessary accumulation of multiple penalties for the same act should be prohibited, such as prosecuting a single person for a single post under the Anti‑Terrorism Law, the Anti-Cybercrime Law, and the Penal Code simultaneously. Instead, a single law should provide for the applicable penalty, or the duplication of accountability should be excluded in application of the principle: “No one shall be tried twice for the same offense”.
In addition, penalties prescribed for digital-related crimes should be proportionate to those prescribed for similar traditional ones to maintain coherence in the escalating penal framework. Alternative sanctions to the custodial ones should be included, such as subjecting the convicted person to a training program or to perform community service of a technical nature, thereby promoting both deterrence and rehabilitation.
Protecting Freedom of Expression, Journalism and Research in Digital Legislation
It is essential to include protective provisions in the laws and regulations governing the digital space to ensure legitimate expression, journalistic or civil work is not targeted. This can be achieved through several means:
- Stipulated General Exemption: For example, the Anti-Cybercrime Law could include a provision stating: “The provisions of this Law shall not apply to opinions expressed or content disseminated by individuals where such expression falls within the scope of the constitutionally protected right to freedom of expression”. Such a provision would require courts to interpret the law in light of this general exemption, ensuring that criminalization does not extend to peaceful expression or legitimate political criticism.
- Protection of Scientific and Security Research: A provision should be added stipulating that: “A person who commits an act criminalized under this law shall be exempt from punishment if the act was carried out in the context of approved scientific research or security testing of information systems, with the consent of their owners or in the public interest and for the purpose of exposing vulnerabilities, provided that any discovered vulnerability is reported to the competent authorities within a reasonable period”. This provision protects ethical hacking and responsible security research from broad criminal interpretation.
- Excluding Content of Public Interest: Laws regulating hate speech or false information should not be used to suppress debate on matters of public concern. For example, the definition of “false news” should expressly exclude unintentional errors in journalistic reporting, as well as the publication of information in the public interest, even where such information may be embarrassing to the state.
Mandatory Human Rights and Economic Impact Assessments Before Enacting Digital Legislation
Before any new legislation governing the digital sphere is enacted, a comprehensive impact assessment should be conducted, covering the following elements.
Assessment of Rights Protected by the Constitution and International Covenants:
The assessment should verify that the draft law does not infringe upon constitutional rights such as freedom of expression, the right to privacy and fair trial safeguards, or clearly demonstrate how to mitigate potential risks through clear and effective safeguards. It should also clarify whether the restrictions imposed by the draft law satisfy the principles of necessity and proportionality, drawing on the expertise of independent human rights specialists and specialized civil society organizations.
Economic and Technical Impact Assessment:
The assessment should include a cost-benefit analysis. This includes an estimate of the cost of compliance thatthe private sector, such as telecommunications companies or content providers, will incur as a result of the new obligations, the impact of these costs on service prices, the time needed to adapt, and the expected benefits, such as an estimated reduction in cybercrime.
The assessment should also assess whether the expected benefits outweigh the costs, analyze the law’s impact on innovation, start‑ups, and foreign investment, and determine whether it will attract major technology companies or drive them to avoid the market due to restrictions.
Potential Alternatives:
The assessment should identify the alternatives that were discussed, and the reasons for rejecting them in favor of legislation. This should demonstrate that the legislator considered less restrictive options and determined that they were insufficient before resorting to punitive legislation.
Stakeholder Views:
The assessment should include a summary of the public consultations, the views of telecommunications and technology companies on the draft law, and the observations of civil society organizations, along with the responses to them. This demonstrates that the legislator took various perspectives into account before enacting the law.
This assessment enables parliamentarians and the public to assess the viability of the law before its enactment. It may be made publicly available to receive comments, thereby enhancing transparency. These assessments should also be reviewed after the law has been in force for a period, such as three years, to compare expectations with reality and determine whether amendments are needed.
Sixth: Implementation, Follow-up, and Legislative Update Mechanisms
The legislator’s role does not end with enacting the law, but extends to ensuring its implementation and periodic review. This requires stipulating practical tools and mechanisms within the law implementation plan, allowing for monitoring the law’s impact and amending it when necessary.
Ongoing Participatory Consultation Mechanism
In addition to consultations preceding the enactment of the law, communication channels between government entities, the tech community, and civil society must continue throughout the implementation phase.
A permanent advisory committee may be established within the regulatory authority or the Ministry of Communications, comprising representatives of the private sector—such as telecommunications and internet companies—as well as representatives of user communities, relevant professional unions, and specialized human rights associations. The committee should meet periodically to discuss problems and loopholes that emerge during the application of the law, and to propose policies or regulatory amendments to address them.
Phased Implementation Plans
Where significant new obligations are imposed, such as cybersecurity requirements on banks or the establishment of a sovereign data center, implementation should be phased. The law or its executive regulation should specify clear timelines for the sequential entry into force of its provisions. For example, large companies could be required to comply in the first year, medium‑sized companies in the second year, and small companies in the third year.
Likewise, enforcement of penalties may begin after a grace period of six months following the completion of the necessary infrastructure or compliance framework. Such phased plans, supported by performance indicators for each stage, provide sufficient time to adapt and avoid sudden disruptions to essential services.
Periodic Transparency Reports
It is important to establish an open data platform, published by the Ministry of Justice or the Public Prosecution, publishing annual statistics on cyber-related criminal cases, including the number of cases heard, the nature of judicial outcomes—such as conviction and acquittal rates—and the number of official requests submitted to companies for access to user data, together with information on how those requests were handled. The platform may draw on the model of transparency reports published by companies such as Facebook and Google, while adapting it to a governmental context.
This transparency enables the legislator and oversight institutions to evaluate the effectiveness of the law. If the number of certain cases rises without a clear impact, this may indicate that their criminalization is ineffective. If the conviction rate drops significantly due to evidentiary difficulties, this may suggest the need to amend the text to make it clearer or less severe.
Immediate, Deferred, and Temporary Provisions
The law should distinguish between provisions taking effect immediately, provisions deferred until a specific condition is met, and provisions of a temporary nature. Deferred provisions mean that the law, or certain parts of it, will not take effect until a specific condition is met. For example, the penalties under the Data Protection Law could be made non‑applicable until the Data Protection Center is established and its members trained, so that the private sector does not face obligations for which it is unprepared.
Temporary provisions, on the other hand, remain in force for a specified period, after which their continuation is subject to evaluation and renewal. Including such provisions encourages executive authorities to fulfill the necessary conditions for implementation and ensures periodic review of the law.
For example, it could be stipulated that: “The provisions of this law shall remain in effect for a period of five years from the date of its entry into force and shall be submitted to Parliament for an assessment of its impact before its operation is renewed for a further equivalent period”. This obliges the competent authorities to collect data on the outcomes of the law’s implementation during that period, enabling an assessment of its effectiveness or shortcomings before extending its application.
Seventh: Mandatory Controls and Tests before Introducing Any New Penal Provision
It is recommended to adopt a test‑based approach in legislative decision‑making, so that no new penal provision is included in the law unless it has passed a set of prior tests. These tests include the following.
The Problem to Be Addressed:
It must be determined whether the problem can be addressed through non-criminal means. It must be demonstrated that other regulatory tools, such as awareness campaigns, codes of conduct, administrative sanctions, and civil liability, have been tried or have proven insufficient. If an effective non-criminal alternative exists, the punitive provision should be excluded.
The criminal act:
The proposed wording should be examined to ensure it is free from generalization or ambiguity. Each element of the criminalization, such as the perpetrator, the act, the instrument, and the result, should be as specific as possible so that the prohibited conduct is clear to those subject to the law. Any vague or ambiguous terminology should be narrowed or deleted.
Specific Criminal Intent:
The default rule for technology‑related offenses is that they require specific intent; therefore, they are punishable only if there is a clear intent to cause harm or obtain illicit gain. Therefore, the legislator should include phrases such as “with the intent to commit a crime” or “with the intent to harm” in the text to ensure it does not apply to those lacking criminal intent.
It is also advisable to include an explicit exemption for those who can demonstrate that they acted in good faith, based on a reasonable belief of entitlement, or in the course of work that inherently exposes them to the prohibited conduct without criminal intent.
Stipulating Exceptions for Legitimate and Protected Activities:
It should be examined whether the wording of the text applies to journalistic activity, security research, information gathering for human rights documentation, or legitimate data backup.
If applicable, an exception should be added to protect these activities. For example, hate speech offenses should not include calls for peaceful political change or criticism of authorities, and hacking offenses should exclude those with legitimate authorization or professional intent.
Adequate Procedural Safeguards Accompanying Punitive Text:
Any penal provision that grants a power of seizure or search must be accompanied by adequate procedural safeguards. These safeguards should include a requirement for a judicial order before searching devices or email, the specification of a period for retaining seized data and its destruction when no longer needed, the guarantee of the accused’s right to have a technical expert present during the examination of their devices to reduce the risk of planted fabricated evidence, and the notification of the person subject to surveillance in accordance with legal controls. These safeguards should be included when drafting any legislation to avoid the risk of subsequent unconstitutionality.
Proportionality of the Proposed Penalty:
The legislator should review the proposed penalty, whether imprisonment or a fine, in comparison with the gravity of the act and with penalties prescribed for similar acts outside the technology field. Any unjustified elevation of the maximum penalty should be reduced.
For example, if a penalty of five years’ imprisonment is proposed for a technology‑related offense causing financial harm, this penalty should be compared with those for fraud or vandalism of public property, and this comparison should be taken into account to calibrate proportionality. The aim is to ensure that laws regulating the digital space do not become a source of penalties more severe than their equivalents without clear justification.
Avoid Punitive Duplication:
It must be ensured that no other law includes a provision that criminalizes the same act. If such a provision exists, one of them must be repealed, or the new law must explicitly state that a person cannot be held accountable twice for the same offense. This limits the misuse of multiple legal provisions to accumulate charges for a single act.
Applying these tests, preferably with the participation of an independent panel of experts consulted during the drafting process, helps ensure that no new criminal offense is introduced without an assessment of its necessity, scope, and impact. It also conditions punitive texts on clearly defined standards, rather than expanding the scope of criminalization merely in response to the emergence of new technological or social challenges.
Conclusion
Telecommunications and information technology legislation affects individual rights, the development of the digital economy, and public confidence in the law. The Egyptian experience in recent years demonstrates that prioritizing a security‑oriented and punitive approach may lead to a regression in rights safeguards and weaken the regulatory environment necessary for the growth of digital services. This paper seeks to offer a legislative methodology to help legislators address these imbalances through clearer rules, stronger safeguards, and a more restrained use of criminalization.
The paper emphasized that digital legislation should be treated as a measure of last resort, adopted only after available alternatives have been carefully considered, and that any legislative intervention should be founded on the principles of legality, proportionality, the protection of rights, and transparency.
It also examined the principal shortcomings that have characterized legislation enacted in recent years, such as vague and conflicting texts, the absence of safeguards, and the expansion of disproportionate penalties. The paper offered practical recommendations to avoid these shortcomings, including precisely defining terms, assessing the human rights and economic impact, and ensuring periodic oversight and review.