Image via EngageMedia. Used with permission. This article is ​​part of Pandemic of Control, a series that aims to further public discourse on the rise of digital authoritarianism in Asia-Pacific amid COVID-19. Pandemic of Control is an initiative by EngageMedia, in partnership with CommonEdge. This edited version of the article by Samik Kharel is republished in Global Voices under a content partnership. In Nepal, the COVID-19 pandemic sped up the process of bringing public and private services online: from food delivery and shopping to government transactions. These changes came with many downsides, with data and privacy rights often not respected. Nepal does not yet have the technology and expertise to be globally competitive in the digital world. Instead, it has looked to its closest neighbours, China and India, for guidance. However, seeking ideas from countries that have largely failed to respect basic digital rights puts Nepal in a vulnerable position. From questionable data collection practices to the curtailment of free speech, Nepal is leaning towards an authoritarian model of internet control, with COVID-19 accelerating this development. China holds a poor digital rights record, with rights groups flagging its online censorship rules and deployment of mass surveillance against the Uyghur Muslims, among other rights violations. Similarly, India has been widely criticised for procuring spyware, imposing internet shutdowns, and passing IT laws that do not conform to global rights norms. In 2019, Nepali media reported on government plans to mount over 21,000 CCTV cameras for street-level surveillance. This is in addition to the thousands of surveillance cameras that are already installed in the Kathmandu Valley. Authorities say the cameras deter criminal activity, but they have also been used by police to monitor protests and other forms of expression. During the COVID-19 pandemic, police used these cameras as well as drones to monitor people’s movements and adherence to lockdown rules, publicly flaunting their use of this technology on their official YouTube channel. In April 2022, a major Nepali daily reported that the government had purchased the Pegasus spyware system and handed it to the Nepal Army for trial use. While the government claims the system is to ensure citizen safety and security, there has been widespread criticism of the spyware and its misuse by governments around the world. The government approach to COVID-19 vaccination built in a huge amount of personal data collection. To date, 70 percent of the total population has received at least one dose, requiring more than 20 million people to share their personal information with the government, including to obtain an official vaccine certificate. However, whether this massive dataset of personal information is kept secure is questionable. When the government announced booster shots for frontline workers in mid-January 2022, journalist Rajendra Rai (name changed) rushed to the vaccination centre. He filled out a vaccination form on the health ministry website via his phone, giving personal information including his name, birthdate, address, and occupation. This personal information could be used as a weapon by political parties and the state, especially with the federal and provincial elections coming up in late 2022. Who ensures the safety of the collected data, especially given previous instances of potential data misuse that call into question the government’s ability to ensure data security? In the 2022 local elections, voters from particular areas received SMSes and emails from political parties; it is unclear how they obtained voters’ contact details — could have come from public service forms submitted to the government. Body and Data, a digital rights organisation in Nepal, flagged privacy issues related to election campaigns: Another example of how citizens’ phone numbers are shared without their consent for the election campaigns. Sign our signature campaign petition requesting the Election Commission to secure our privacy!https://t.co/WzMUxgc0sa#dataprivacy #privacy #localelection2022 https://t.co/oHZphEak5j — Body & Data (@bodyanddata) May 11, 2022 The Election Commission of Nepal also came under fire for releasing a list of the 17.7 million voters on its website, which included details of their names, ages, genders, voting booths, voter ID numbers, and even their parents’ and spouses’ names. While civil society and rights groups criticised this privacy breach, the authorities did not remove the list, arguing that “there should be no concern of a breach of privacy” because the data did not include voters’ photos, thumbprints, or phone numbers.