VPNs with servers in Nepal

The Electronic Transactions Act 2063 (section 42) makes network service providers liable for what their subscriber agreement, their licence and any further rule provide. Whether either law reaches a VPN operator is not established.

Section 47(1) of the Electronic Transactions Act restricts publishing or displaying, in electronic media including the internet, material prohibited by prevailing law, material contrary to public morality or decent behaviour, material that may spread hate or jealousy against anyone, and material that may jeopardise harmonious relations among castes, tribes and communities.

A person who publishes or displays such material faces a fine of up to NPR 100,000, imprisonment up to five years, or both (s. 47(1)).

Unauthorised use of a computer to access its programmes, information or data carries a fine up to NPR 200,000, imprisonment up to three years, or both (s. 45).

According to the Kathmandu Post, a joint bench of the Supreme Court, in a case arising from police collection of more than 500,000 call records and over 30,000 text messages in 2012, held that investigating a crime does not give the state unrestricted authority to access citizens’ communications data.

The same report says the ruling made judicial authorisation a necessary safeguard for obtaining such information, and that Article 28 of the Constitution guarantees the privacy of an individual’s body, residence, property, documents and data. The order of the rows is the security score, and a server’s location is not a recommendation.