internet shutdown

Update: internet access, censorship, and the Myanmar coup

This statement was first published on February 15, 2021, and is being periodically updated.

Update: March 18, 2022 — Access Now, outraged by today’s announcement that the Myanmar Investment Commission has approved the sale of Telenor Myanmar, is calling for international actors to implement sanctions and stop the company’s irresponsible disposal of its Myanmar operations to a company whose 80% majority shareholder is military-linked Shwe Byain Phyu Group. 

Telenor stated that its sanctions screening “assured” them that Shwe Byain Phyu and its owners were not subject to any current international sanctions. However, they are linked to multiple individuals and companies currently subject to U.S., European Union, and UK sanctions.

The purchaser, Shwe Byain Phyu, may not be sanctioned now  — but it needs to be. International actors must recognize and take action against the company’s multiple and flagrant links to the military,” said Wai Phyo Myint, Asia Pacific Policy Analyst at Access Now.


Update: February 16, 2022 In the lead-up to the reported sale date of Telenor Myanmar (February 15) the people of Myanmar have made it loud and clear that the sale must not go ahead. 

On February 11, a petition to stop the sale of Telenor Myanmar to military-linked Investcom was launched, gathering more than 241,000 signatures in just four days. It calls on the Norwegian government to exercise its power as a major shareholder of Telenor Group to “stop the profitable sale of handing out 18.3 million users’ data to the Myanmar military junta.”

On February 12, 694 civil society organizations released a statement calling on Telenor to stop the sale of its Myanmar operations to military-linked Investcom. The groups expressed fear that Telenor will surrender users’ data that can be abused to extend oppression and violence against them. In their statement, the groups warned that if the sale pushes through, they will “condemn Telenor Group and hold it accountable according to local and international human rights law for contributing towards the unforseeable crimes, including crimes against humanity and genocide perpetrated by the junta.”

Access Now reiterates its call on the Prime Minister of Norway to stop the sale of Telenor Myanmar and for the Norwegian state to put pressure on Telenor to comply with human rights and responsible business obligations. Telenor’s investors are also now pressuring the company to provide assurances that customer data will be protected in the sale.

In failing to do so, Telenor Group could potentially fall foul of sanctions obligations. On February 14, a Mizzima report unearthed multiple connections between the proposed buyer Shwe Byain Phyu and military-linked sanctioned entities and individuals. On February 16, Free Expression Myanmar highlighted the sale could potentially contravene the Norwegian Sanctions Act and European Council Regulation No. 401/2013.


Update: February 8, 2022 — Access Now and civil society organizations from across the globe are calling on the international community and technology companies to stand with the people of Myanmar and resist the coup — both physical and digital.

A Myanmar citizen has filed a complaint at the Norwegian Data Protection Authority against Telenor Group under Article 77(1) of the European Union’s General Data Protection Regulation (GDPR) — contending that the sale of Telenor Myanmar will result in privacy violations of over 18 million customers. The complaint was filed by SANDS law firm, with the support of the Centre for Research on Multinational Corporations (SOMO). Access Now supports SOMO’s analysis that, “Telenor chose to enter the Myanmar market and asked Myanmar citizens — as part of its sales pitch — to trust the company with their personal data […] Telenor Group and its majority shareholder, the Norwegian government, have an obligation to protect these individuals from harm, which includes persecution, torture, and even extrajudicial killings.

On February 7, 2022, Myanmar Now reported that Telenor had complied with data requests from the military since the beginning of the coup — raising further serious issues  about Telenor’s failure to comply with international human rights and responsible business standards. 

Industry sources noted at least 200 requests for sensitive user information had been made to Telenor from the Ministry of Transport and Communications (MOTC) between February 2021 and February 2022 — with each request including multiple mobile numbers and some requests relating to hundreds of numbers, making the total number of potential victims number in the thousands. Telenor apparently complied with all of these requests,stating that non-compliance would have had “severe and completely unacceptable consequences for (their) employees”. It is unclear what steps the company took, and will be taking, to protect against severe and completely unacceptable consequences for their customers. 

A Myanmar Now report has revealed indications by industry insiders that Telenor’s sale will go ahead by February 15. The sale will reportedly be made to Investcom Myanmar a currently unregistered company which will likely be a subsidiary of M1 Group  and 70-80% owned by Shwe Byain Phyu Group. It was reported that two members of the military council could be involved in the sale — raising the potential that the sale may violate international sanctions measures. It is now crystal clear that Telenor’s irresponsible disposal will result in heightened control of telecommunications by the Myanmar military   risking the privacy and security of millions.


Update: January 31, 2022 — On behalf of 168 civil society organizations in Myanmar, Access Now joined the Norwegian Forum for Development and Environment and the Centre for Research on Multinational Corporations in calling on the Prime Minister of Norway to stop the sale of Telenor Myanmar. As the majority shareholder in Telenor Group, the Norwegian state must put pressure on Telenor to comply with human rights and responsible business obligations. A failure to act now will “stain Norway’s reputation as a long-time defender of peace and human rights globally.”


Update: January 27, 2022 — As the junta attempts to revive a notorious draft Cybersecurity Law that would be a disaster for human rights, Access Now has analysed the language and unpacked the risks. Access Now joins partners in affirming that this new bill is just as bad as the first, and is calling on the Myanmar military to immediately withdraw law, and urging international actors to take a stand.


Update: January 26, 2022 — On January 21, Reuters reported that the Myanmar military had privately approved the sale of Telenor Myanmar to a partnership of M1 Group and Shwe Byain Phyu Group. This alarming development clearly indicates that the military is consolidating control over the telecom sector to expand surveillance and invade privacy. The telecom sector in Myanmar must push back.


Update: December 17, 2021 — As 2021 draws to an end — more than five months since Telenor announced the sale of its Myanmar operations to M1 Group — Telenor’s users still have no answers about any protections the company will take to mitigate rights risks imminent from the disposal. This is unacceptable.

On December 9, Privacy International and Fortify Rights reiterated how Telenor’s “irresponsible exit” would “put customers’ lives at risk” through potential abuse of the users’ meta-data now in the hands of the Myanmar military. They say, “Ultimately, Telenor is leaving Myanmar and the firm’s bosses want to do it with their heads held high and pats on the back, principles and values publicly intact. Who can blame them. But to dismiss the risks associated with the metadata they leave behind is reckless.” Access Now agrees.

Reuters reported on November 8 that M1 Group was looking to partner with a Myanmar company to buy over Telenor’s operations following pressure from the military. The proposed partner, Shwe Byain Phyu, is a petrol station company, founded by U Zaw Thein Win, who has apparent links to ministry officials from the military regime before the 2000s.


Update: October 12, 2021  — Access Now addressed a second letter to Telenor’s Board, urging Telenor Group to immediately stop the sale to M1 Group. The letter outlined how M1 Group has demonstrated a complete disregard for human rights in other high-risk markets, and actively coordinates with oppressive regimes; highlighted serious corruption allegations against the company’s owners; and strong evidence suggesting ties between M1 Group and the Myanmar military.


Update: September 27, 2021 — Access Now welcomes the acceptance of the complaint by the OECD’s Norwegian National Contact Point, submitted on July 27 by the Centre for Research on Multinational Corporations (SOMO) on behalf of 474 civil society organizations. Telenor’s statement on the same day noted “the complaint should not be brought for further assessment by the NCP, as there is an insufficient link between the cause of the human rights violations and the operations and decision to sell Telenor Myanmar.”

On September 17, in response to potential rights abuse in Myanmar, L’Orient Today quoted the Executive Director of potential buyer M1 Group, Jamal Ramadan, as stating “accusations are completely irrelevant”. He noted M1 Group was “presenting an opportunity for the country” in “accepting to take a risk of a business in a country that has some challenges.” 


Update: September 15, 2021 — Telenor released a statement emphasizing that the “continued presence in Myanmar is not possible” as it “would require Telenor Myanmar to activate intercept equipment (for the use of Myanmar authorities) which is subject to Norwegian and EU sanctions.” Telenor further clarified that “having worked actively to avoid activation of intercept equipment, Telenor Myanmar Ltd. has until now not activated this equipment and will not do so voluntarily.” 


Update: September 3, 2021 —Telenor’s President and CEO, Sigve Brekke, responded to civil society’s joint letter of August 12, noting that Telenor “shares the concerns for the people in Myanmar,” that it “will continue to operate in accordance with the Code of Conduct and promote the OECD Guidelines and the UN Guiding Principles on Business and Human Rights” and that it will also “continue to support the Norwegian National Contact Point of the OECD with facts and information related to the complaints.”


Update: August 12, 2021 — Telenor must halt the sale of its Myanmar outfit to M1 Group and immediately conduct human rights due diligence in line with international law and standards. 

Today, Access Now and 44 organizations addressed a joint letter to the Board of Telenor Group, expressing shock and dismay at the telecommunications company’s sudden and hurried decision to apparently “dispose” Telenor Myanmar by selling it to M1 Group – an investor with a dubious human rights record.


Update: July 29, 2021 — Access Now welcomes the complaint submitted on July 27 by the Centre for Research on Multinational Corporations (SOMO) on behalf of 474 Myanmar-based civil society organizations to the OECD Norwegian National Contact Point (NCP). The complaint contends that Telenor’s decision to sell its Myanmar outfit to M1 Group fails to meet the standards of responsible disengagement set out in the OECD guidelines.

On July 29, Telenor confirmed receipt of the complaint and emphasised its continuing commitment to OECD and UN guidelines on business and human rights. An adviser to M1 Group was meanwhile quoted stating concerns about the Lebanese company were “racist and discriminatory,” and that it had never “jeopardise(d) its ethics when it comes to human rights issues.”

Access Now echoes serious credible concerns raised by Justice for Myanmar about M1 Group’s rights record. The company was co-founded by Najib Mikati — a former Lebanese Prime Minister recently reappointed Prime Minister-delegate — who was charged with corruption and illicit enrichment in Lebanon in 2019. The oligarch Mikati family have a record of exploiting authoritarian markets for profits, including in Syria and Sudan.

On July 26, Myanmar Now reported that a Telenor spokesperson had confirmed the imminent sale would include “transfer of all call data records,”  raising serious concerns that the data will enable the Myanmar military to track and target individuals based on their contacts, location and other personal or organizational information. An activist expressed his feeling of vulnerability stating, “Telenor has data on […] my life, through services I paid to use as their customer. I don’t give consent for them to transfer my data to M1 Group, who I do not trust.”


Update: May 30, 2021 — The people of Myanmar have the right to open, reliable, and secure internet access without discrimination. Today, Access Now and the #KeepItOn coalition are calling on the military and all public authorities in Myanmar to immediately stop implementing internet shutdowns, and abandon all efforts to “whitelist” — or pick and choose — organizations, corporations, and individuals for whom internet connectivity should be reinstated.


Update: April 28, 2021 — Access Now welcomes any and all improvements to internet access in Myanmar, but calls for a full lift of the military-imposed internet shutdown. After more than 70 nights of near-complete internet shutdowns, reports are emerging that fixed-line connectivity in Myanmar is resuming across the country. The vast majority of people in Myanmar, however, rely on fixed wireless connectivity and mobile data connectivity — which remains unavailable.

For nearly two and a half months since the violent military coup in February,  the junta has intermittently shut down fiber optic and fixed cable connectivity throughout the night. As of April 28, access is apparently available. This form of internet connectivity is usually reserved for more privileged individuals, organizations, and businesses, and potentially provides space for online banking and other financial services to recommence. 

“Although the reinstatement of fiber optic and fixed cable connectivity in Myanmar is a minor positive development, it must be emphasized that mobile and other internet connectivity through wireless means remain shut off to the people of Myanmar,” said Dhevy Sivaprakasam, Asia Pacific Policy Counsel at Access Now. “The majority of people in Myanmar  essentially remain in a total blackout, while the junta continue to escalate its serious human rights abuses.”

Access Now has also learned about emerging efforts within Myanmar’s tech industry to propose the white-listing of organizations, corporations, and individuals for whom internet connectivity should specifically remain uninterrupted. Initial reports indicate implementation of white listing for banking and payment applications. This has the potential to carve out fissions between and within various sectors and communities, and works against any notion of network neutrality. Whitelisting services does not reflect respect for international human rights law; it in fact flips it on its head, by making complete blocking of the internet the norm and access to web services the exception. It’s not clear how the situation will develop. 

“White-listing internet connectivity only exacerbates inequality amidst  a human rights crisis — not only is white-listing technically difficult and practically ineffective to implement, it can be discriminatory as it will primarily seek to retain the functioning of only certain financial and other banking services,” stressed Raman Jit Singh Chima, Senior International Counsel and Asia Pacific Director at Access Now.“We need the internet immediately reinstated for all within the country — people must be able to communicate with their loved ones, seek assistance, share and receive information, report on violations, and ultimately exercise their fundamental rights once more.”


Update: April 1, 2021 — Access Now is appalled by the junta’s methodical increase of digital control, and suppression of free speech and access to information across Myanmar. Today, the Ministry of Transport and Communications ordered internet service providers to suspend wireless broadband services. This will disrupt all connections that use wireless routers — a common set up across much of Asia. The order is open ended. As yet, fiber optic and fixed cable internet is not affected, though only a limited portion of people in Myanmar have access via these connections.

“The junta is systematically digitally stripping away the rights of people in Myanmar,” said Raman Jit Singh Chima, Senior International Counsel and Asia Pacific Director at Access Now. “Today’s shutdown of wireless routers compounds with the country’s long-lasting wireless shutdown, and increasing surveillance millions of people have had to endure — at the same time reports of horrendous human rights abuses are amplifying. We call on the international community to immediately intervene.”

Access Now has also spoken directly with impacted stakeholders and sources in Myanmar who have confirmed this latest internet shutdown.

 


Update: March 15, 2021 — The Myanmar junta’s blocking of mobile internet access across the country is escalating, while the threat of military use of surveillance technology is increasing. As the junta imposes martial law in six townships in Yangon, and five more in Mandalay bringing the city’s total to 12 data from internet platforms’ transparency reports indicate a major drop-off in internet traffic, rendering mobile internet unavailable in the country. Previously,  the near daily junta-ordered shutdowns generally took place at night, lifting by morning. The present disruption, however,  has lasted all day (March 15) with no sign of restoration This escalation in the junta’s disruption of the internet raises serious concerns for Access Now and the international community that the next step may be an indefinite, complete blackout of telecommunications services for the people of Myanmar. 

“The military in Myanmar clearly understand the power of internet access,” said Felicia Anthonio, Campaigner and #KeepItOn Lead at Access Now. “From the get-go they have been manipulating services as an attempt to quash democracy. This is both scary and futile.”

On March 14, Yangon saw “one of its deadliest days of anti-coup protests”, during which approximately 50 people were killed, and, in turn, martial law was imposed in the city. 

The threat of surveillance technology abuse by the military to perpetuate crimes continues to be very present. On March 12, Human Rights Watch reported that the roll-out through 2021 of new public camera infrastructure with facial recognition and license plate recognition capabilities as part of the “Safe City” initiative in Naypyidaw, Mandalay, and Yangon will only “bolster the junta’s increasingly abusive crackdown”.

“In any given scenario, disabling internet connectivity is a serious rights violation,” said Dhevy Sivaprakasam, Asia Pacific Policy Counsel at Access Now. “But to take this escalatory step in Myanmar as the junta imposes martial law across the country — and while state forces perpetuate serious human rights violations — is a blatant signal that the military plans to double down on the violence under the cover of darkness.”


Update: March 5, 2021 — Periodic internet shutdowns are continuing across Myanmar, cutting the population off daily between 01:00 and 09:00 local time. And as the human rights situation significantly deteriorates, the military is escalating violence to suppress protests in the face of growing international condemnation — including using ammunition, rubber bullets, and tear gas against crowds. On March 3, at least 38 protesters were killed in what the UN envoy to Myanmar denounced as “the bloodiest day since the coup.” Against a backdrop of international pressure — including calls for an embargo on spyware —  Myanmar’s deputy military chief stated, “we are used to sanctions, and we survived.”

Access Now remains deeply concerned for the welfare of people in Myanmar, and again calls on authorities to ensure a fair and open internet, and immediately halt the use of any and all surveillance technology. A full-scale, nation-wide internet shutdown would have devastating effects on the population.

The internet continues to be weaponized by the junta, and hundreds of pro-military videos — including of people in uniform openly  threatening violence against protesters — are circulating on Tik Tok. On March 3, the social media company  stated that it continues to “promptly remove all content that incites violence […] and [is] aggressively monitoring to remove any such content that violates [their] guidelines.” On March 4, VICE News found that most of the original videos had been taken down, but others inciting violence remained accessible — including an anti-Aung San Suu Kyi video that received more than 120,000 likes.

“We’re witnessing the Myanmar military unleash an arsenal of tech tools on people,” said Dhevy Sivaprakasam, Asia Pacific Policy Counsel at Access Now. “On top of internet shutdowns, they are relying on a stockpile of tech surveillance equipment, abuse of vaguely-written laws to censor online content, and manipulation of social media platforms.”

On March 1, the New York Times reported that the military is employing invasive dual-use surveillance, hacking, and forensic technologies to monitor and target critics and protesters. Pre-coup, the military built “electronic warfare capability,” and bought surveillance tech — including phone hacking tools that were exploited in Hong Kong to monitor pro-democracy activists — from Israeli, American, and European companies, despite existing bans on such exports by their home governments. 

“Governments ranging from Myanmar’s neighbours in ASEAN, to states in Europe, North America, and the Middle East need to prevent access to censorship and surveillance technologies by the junta, and stand together to send an unequivocal message that the international community deems daily internet shutdowns unacceptable in the 21st Century,” added Raman Jit Singh Chima, Senior International Counsel and Asia Pacific Director at Access Now.

On March 1, civilian government leader Aung San Suu Kyi was charged with the alleged publication of online information that “may cause fear or alarm or disrupt public tranquility.” 

On February 27, Myanmar’s envoy to the UN Kyaw Moe Tun was fired, a day after he made an impassioned address to the UN General Assembly, calling on countries to take “strongest possible action” to restore democracy to Myanmar. 


Update: February 25, 2021 — As internet remains unstable in Myanmar, and the military continues to tighten its grip on power, protesters are creating, sharing, and translating tools to help keep themselves safe while organizing. However, many of these digital resources are vulnerable to military interference. 

“You have to remember that no tech is hack-proof, no mechanism is completely secure. Everything has insecurity built in,” said Raman Jit Singh Chima, Asia-Pacific Policy Director and Senior International Counsel at Access Now in an interview with Rest of World. “What we’re concerned about is that, [while] we know about the internet disruptions, we don’t know about surveillance.” 

With the threat of military surveillance ever present, Access Now has joined civil society organizations from across the globe in calling on the United Nations Security Council and UN member states to urgently institute a coordinated, global arms embargo on Myanmar in response to the military coup. Any sale or transfer of military-related equipment, including dual-use and surveillance equipment, could provide the means to further repress the people of Myanmar in violation of international humanitarian and human rights law.

The military must not be allowed to use ICT tools to curtail people’s rights, or to facilitate their repression of peaceful protests. The Myanmar military’s ability to publish calls for violence against protesters via social media is becoming a critical issue. In turn, the military has been banned from Facebook and Instagram, after having its main page deleted by Facebook last weekend.

“We are banning the remaining Myanmar military (“Tatmadaw”) and military-controlled state and media entities from Facebook and Instagram, as well as ads from military-linked commercial entities,” said the social media giant in a statement on February 24. “We’re continuing to treat the situation in Myanmar as an emergency and we remain focused on the safety of our community, and the people of Myanmar more broadly.”


Update: February 22, 2021 — Troubling reports are continuing to flock in from Myanmar, stating the daily 01:00 to 09:00 local time shutdowns are still regularly being implemented, and that an internet shutdown was scheduled for today, February 22, from 01:00 until 12:00 noon local time in the capital, Yangon.


Update: February 17, 2021 Millions of people in Myanmar continue to be affected by unreliable internet access. Authorities have periodically plunged the nation into darkness by shutting down the internet between 01:00 and 09:00 local time on Monday, Tuesday, and Wednesday this week (February 15 — 17). In effect, this has created a nightly communications black hole that facilitates abuse by, and impunity for, the military junta. Despite this, thousands of protesters marched against the coup today across major cities. 

Network measurement reports indicate that internet traffic throttling continues to be observed every day even after the scheduled shutdowns.

Rumours are emerging that the newly drafted “cybersecurity” bill may no longer be tabled, with the military having already amended or seeking to imminently amend the Electronic Transactions Law instead. Access Now is working to confirm development, and review the amended content.


February 15, 2021 Breaking: Reports are emerging today, February 15, that another internet shutdown has been ordered for 01:00 — 09:00 local time tomorrow, February 16.

On February 1, a sudden military coup took place in Myanmar. In the weeks following, as people protested, scrambled for information, and attempted to document the events unfurling, authorities flexed their power by arbitrarily shutting down and reinstating the internet, and blocking social media platforms. The latest reported nation-wide shutdown was implemented overnight, and  lifted only today, February 15. It accompanied increased military presence, and use of force against demonstrators. 

“Censorship and military control over free speech is increasing in Myanmar, as access to information and communication is decreasing dramatically,” said Felicia Anthonio, Campaigner and #KeepItOn Lead at Access Now. “The military continues to weaponize the use of internet shutdowns and censorship in order to quell protests and silence dissent. This is unacceptable and a flagrant violation of human rights laws.”

Last week, in another blow to human rights, the military introduced the draft of an alarming new cybersecurity” bill with the potential to criminalize many normal acts of online expression, and dampen the efforts of those seeking to provide digital security assistance to civil society and democratically-elected political leaders in the country (see an unofficial translation). This is an incredibly dangerous move, and the international community has a responsibility to stop it in its tracks

“Myanmar’s draft cybersecurity bill is already instilling a fear of surveillance and being persecuted for what you say and do online. Everyone from journalists to digital security providers to civil society actors — and all those in between — are at risk,” said Raman Jit Singh Chima, Asia-Pacific Policy Director and Senior International Counsel at Access Now.The gagging of telecom and ICT firms from being able to report on government orders concerning internet shutdowns, web censorship, or user surveillance is very concerning. Given the evolving situation and suppression of free media on the ground, the ability of telecom firms to provide information about the government directives they receive is key”.

Shutdowns and blockings

Access Now has been working closely with local partners and concerned organizations across the world, and although the situation is constantly changing, a number of key disruptions can be confirmed by the #KeepItOn community:

Telcos

The Telenor Group, a Norwegian telco operating in Myanmar publicly listed the government directives they received, citing most recently an order to block IP addresses and URLs yesterday, February 14. However, this transparency has come to an end as the company stated it could no longer disclose this information. This increases the difficulty to confirm disruptions.

Cybersecurity bill

Authorities are attempting to further expand  digital repression through a new cybersecurity bill that was circulated within the last 48 hours, with demands for stakeholder input by next week. Problems with the present cybersecurity bill include:

  1. The “hacking” definition is very loosely characterized and could be used against legitimate activity in journalism, digital security, and network measurement;
  2. It requires the military approval of private sector cybersecurity teams, at a time when independent digital security access to Myanmar users, journalists, and democratic actors is crucial; and
  3. It proposes requirements for online service providers to be licensed; effectively outlining an Internet Content Provider (ICP) license framework — similar to what exists in China.
Civil society and the international community

On February 12, the United Nations held the 29th special session of the Human Rights Council on the human rights implications of the crisis in Myanmar, with civil society voicing concern over the escalating situation. Thirty-nine states co-sponsored the Human rights implications of the crisis in Myanmar resolution, which “calls for the immediate and permanent lifting of restrictions on the internet, telecommunications and social media.”

On February 6, Myanmar civil society organizations published an open letter appealing to internet service providers to ensure, and uphold human rights — a call Access Now vehemently supports.

Demands for change

Access Now and the #KeepItOn coalition joins the increasing calls for action from around the globe, specifically urging the military in Myanmar to: 

  1. Put an end to the ongoing disruption of the internet, and restore access to all blocked social media platforms and websites;
  2. Allow  internet service providers to operate freely by providing open, reliable, and secure access to the internet and digital communications platforms;
  3. Withdraw the draft cybersecurity bill and halt all processes leading to its adoption and implementation with immediate effect; and
  4. Uphold the fundamental rights of the people of Myanmar, including peaceful assembly and association, freedom of opinion and expression, and access to information.
Sanctions and oversight of businesses operating in Myanmar

Access Now calls on all governments imposing restrictions and sanctions in response to the coup to ensure civil society, members of civilian political parties, and the people of Myanmar alike have access to telecom and ICT services. Sanctions and further restrictions must not prevent the everyday people protesting the coup from using communication tools, or accessing digital security products and services to secure their communications and guard against the junta’s surveillance. 

All companies and investors transacting or operating in Myanmar must review their operations for their potential human rights impacts. Relevant governments — whether the United States, EU member states, the UK, Singapore, India, South Korea, Japan, or others — have an obligation to ensure that the businesses they regulate undertake such reviews immediately.