Data Privacy and Protection Laws in Pakistan

An analysis of the key sections 

In the revised analysis of the 2023 Bill, we delve into the nuances of its provisions to ensure clarity and effective implementation.

Chapter I: Preliminary

Regarding Section 2(oo), which defines ‘vital interests’, it is recommended that a temporal limitation be introduced. This pertains specifically to contexts such as humanitarian emergencies, natural and man-made disasters, and the management of epidemics. The current breadth of this definition raises concerns about potential misuse in the collection and storage of personal and sensitive data. By introducing a time frame, the Bill can mitigate risks associated with the overextension of this term.

Section 3: Scope and Applicability

• Territorial Scope: The territorial scope, as stated in Section 1.2, remains consistent with the 2018 version, extending to the entirety of Pakistan. However, this fails to address the unique status of regions like Gilgit-Baltistan, ex-FATA territories, and Azad Jammu and Kashmir, which often lie outside the ambit of standard legislative reach. It is imperative to review and clarify this aspect to ensure the law’s unambiguous applicability across all regions within Pakistan’s boundaries.
• Definition of ‘Government’: The term ‘government’ as used in Section 2(o) requires more precise language. It should explicitly include a range of governmental institutions, such as attached departments and other public bodies. This clarification will ensure these entities fall squarely within the law’s scope, aligning with the legislation’s intent to protect personal data held by all government institutions.
• Categories of Data Controllers: The Bill distinguishes between data controllers established within Pakistan and those operating within the country but established elsewhere. This distinction, while necessary, raises questions about the accessibility of data for foreign data subjects. There is ambiguity surrounding whether data controllers must adhere to different data protection standards based on the data subject’s location. If this is the case, it could result in differential treatment, both within the group of foreign data subjects and between them and Pakistan-based data subjects. This potential for discriminatory treatment necessitates a closer examination to align with the principle of equal treatment under the law.

In conclusion, while the 2023 Bill marks significant progress in data protection, these specific areas require further clarification and adjustment to ensure the legislation is both comprehensive and effective in its application.

Chapter II: Processing of Personal Data and Obligations of Data Controllers and Processors

In the second chapter, we address crucial aspects of data handling and the responsibilities of data controllers and processors.

Section 6: Consent for Personal Data Processing

This section commendably mandates data controllers to secure consent from data subjects for processing personal data and places the onus of proving such consent on them. However, it is noteworthy that the revocation of consent necessitates immediate action from the data controller, barring exceptional and impracticable circumstances. The law could be enhanced by establishing more specific standards for these exceptions, and any delays should be justifiable to both the Commission and the data subject.

Furthermore, the exceptions to consent requirements, as outlined in sections 6(6)(g) and 6(6)(h), are overly broad and pose risks to data subjects’ interests. The concept of ‘legitimate interests’ is particularly vague and open to misuse. To mitigate this, a balance between legitimate interests and data protection rights is recommended, with a more precise definition of these exceptions in line with international human rights standards.

Section 7: Notice to the Data Subject

Section 7’s requirement for data controllers to notify data subjects within a ‘reasonably possible’ time is too ambiguous and could be exploited. A more concrete timeframe and written notice before data processing would enhance this provision. Additionally, penalties for non-compliance with notice requirements could be introduced to ensure adherence to the law.

The section could also benefit from including: the intention of cross-border data transfer, profiling for targeted purposes, and automated decision-making processes. Moreover, the disclosure of third-party names should be the default, with exceptions justified only when necessary.

Further, subsections 7(2)(a), (b), and (c) should be applied conjunctively, not alternatively, replacing ‘or’ with ‘and’. Also, accommodations for illiterate individuals or those with disabilities are crucial for inclusivity, suggesting the need for alternative methods like audio notices or visual aids.

Section 9: Security Requirements

The term ‘national interest’ as a criterion for data security is overly broad and subject to misuse, potentially prioritizing state interests over citizens’ rights. The reference to ‘best international standards’ is vague and leaves too much discretion to the Commission. It’s imperative to establish clear guidelines for data security, especially in Pakistan, where instances of data misuse are prevalent.

The section would be strengthened by making data controllers’ security measures public, enabling data subjects to make informed decisions. Additionally, allowing other laws to override these provisions could undermine the section’s effectiveness.

Lastly, the integration of policies like the ‘National Cyber Security Policy’ and the establishment of CERTs should be harmonized with the data protection law to ensure a comprehensive and rights-centric approach to data privacy.

These enhancements will significantly strengthen the Bill, ensuring robust data protection and clarity in the responsibilities of those handling personal data.

Chapter III: Processing Children’s Personal Data

In the third chapter of the Bill, Section 14 focuses on establishing a legal framework dedicated to safeguarding children’s data rights and addressing the risks associated with the misuse of their personal information.

Section 14: Processing Personal Data of Children

This section rightly emphasizes the importance of protecting children’s personal data. However, it includes a clause stating that “such other factors as may be prescribed” should be considered for age verification and parental consent. It is crucial that these factors be clearly and explicitly defined to prevent any potential ambiguity or misuse of the law. A transparent and accountable process for age verification is essential, and it should avoid being privacy-intrusive or leading to unnecessary data collection about the child or their parent.

Moreover, considering Pakistan’s unique socio-cultural context, the requirement for parental consent raises concerns. It could inadvertently lead to increased monitoring of children, particularly young women, and potentially lead to harmful consequences based on their online activities. Instances of violence linked to online presence underscore the need for a careful approach in this regard, acknowledging that parents might not always be the best arbiters of their children’s safety in the online world.

The exception provided under subsection 6 of this section appears overly broad and could result in ambiguous legal interpretations or misuse. It would be prudent to rephrase and limit the scope of this exception to ensure clarity and prevent exploitation.

The Bill also needs to address the prevalent international business practice of allowing children over the age of 13 to access and use digital services. Since many social media platforms permit 13-year-olds to create accounts, this aspect could pose challenges for digital platforms operating in Pakistan. Therefore, it is necessary to provide clear guidelines on how these child protection measures will be implemented in the context of digital businesses.

In summary, while Section 14 of the Bill takes significant steps towards protecting children’s data rights, it requires further refinement to address specific socio-cultural factors in Pakistan, ensure clarity in its provisions, and align with international standards for digital services accessed by children.

Chapter IV: Additional Requirements for Processing Sensitive and Critical Personal Data

Section 15: Processing of Sensitive and Critical Personal Data

Section 15(a)(viii) of the Bill, which provides an exception for the administration of justice under court orders, should be explicitly subject to fundamental rights, particularly the right to privacy as enshrined in Article 14 of the Pakistan Constitution. This ensures a balanced approach between legal proceedings and the protection of individual privacy.

There appears to be a typographical error in Section 15(b), which references non-existent subclauses in clause (b) of subsection (1). These clauses actually pertain to clause (a) of subsection (1). It is imperative that this error is corrected to avoid any confusion or misinterpretation in the final draft of the Bill.

Chapter V: Rights of Data Subjects

Section 16: Right to Access

The provision allowing data subjects to access their data is commendable. However, the imposition of a fee for this access, as stipulated in 16(3), is problematic. Access to personal data should not be conditional on the ability to pay a fee. Ideally, such access should be free, with any administrative costs borne by the data controller.

Section 17: Compliance with Data Access Requests

While a response timeframe for data access requests is defined, the absence of penalties for non-compliance, where reasons are not provided as outlined in Section 18, is a concern. Implementing penalties would ensure greater accountability and compliance.

Section 18: Circumstances of Refusal to Comply with Data Access Request

It is advised that if a data access request is refused under the criteria of Section 18, the data controller should provide the data subject with written reasons for the refusal within the defined timeframe.

Section 26: Right to Erasure

The current 14-day timeframe for data erasure is excessively lenient. To uphold the rights of data subjects effectively, this period should be reduced to a maximum of 5 days, with any delay beyond this period requiring explicit justification to both the data subject and the Commission.

Section 27: Right to Nominate

The wording of Section 27, pertaining to the nomination of an individual to exercise rights over a deceased or disabled data subject’s data, needs revision. A clearer phrasing could be: “In the event of the death or disability of the data subject, any individual as may be prescribed or previously nominated by the data subject, may exercise the rights of the data subject under this Act.”

Section 28: Right to Redressal of Grievance

While the addition of a grievance redressal right is a positive development, the section lacks detail on how this system will function. It should specify that data controllers address complaints in writing within five working days of receipt, with any delay requiring a written explanation to the complainant.

These suggestions aim to enhance the clarity and enforceability of the Bill, ensuring robust protection for sensitive and critical personal data, as well as clearly defining the rights and mechanisms available to data subjects.

Chapter IV: Right to Data Portability and Automated Processing

Section 29: Right to Data Portability and Automated Processing

Section 29(6) introduces the ‘public interest’ exception in the context of data portability and automated processing. However, this exception lacks the nuanced safeguards present in the General Data Protection Regulation (GDPR) of the European Union, particularly in Article 9(2)(g), which emphasizes the importance of balancing substantial public interest with the essence of the right to data protection. The Bill would benefit from incorporating similar parameters to ensure a harmonious balance between public mandates and individual rights. Moreover, any automated decision-making should be accompanied by explicit anti-discriminatory policies, communicated to data subjects and aligned with constitutional protections, as per Article 25.

Section 31: Condition for Cross-Border Transfer

Subsection 2 of Section 31 proposes that ‘Critical Personal Data’ be processed only within servers or digital infrastructure located in Pakistan. This data localisation requirement contradicts the principles of an open internet and may compromise data security. Pakistan currently lacks the infrastructure for such localized cloud storage, and the requirement overlooks practical challenges, including energy constraints. With data centers contributing significantly to energy-related greenhouse gas emissions, this requirement could exacerbate Pakistan’s existing energy crisis. Additionally, data localisation imposes burdens on small businesses and conflicts with the interests of larger international corporations, potentially hindering service delivery and increasing operational costs in Pakistan.

Section 32: Framework on Conditions for Cross-Border Transfer

The addition of sub-sections (a), (c), and (d) in the revised draft undermines the previously established explicit consent requirement for data transfer. These subsections allow for data transfer in certain situations without the explicit consent of the data subject, thus diluting the importance of consent. The conditions to be considered by the Commission for data transfer should be transparent and accessible to data subjects for informed decision-making.

Furthermore, the use of terms like “national interest” and “public order” in this section introduces vague and subjective criteria, granting excessive discretion to the Commission and potentially leading to misuse. A more defined and constrained approach would be beneficial to ensure fairness and prevent the arbitrary application of these terms.

In conclusion, while these sections aim to protect data rights and regulate data transfer, they require refinements to address ambiguities, safeguard individual rights effectively, and ensure practical feasibility in the Pakistani context.

Chapter IV: Exemptions and the Establishment of the Commission

Section 34: Exemption

Section 34(2)(c) exempts research and statistics collection from the consent requirement, which could potentially lead to misuse for profit, reminiscent of the Cambridge Analytica scandal. It is advisable to narrow this provision to prevent such misuse. Additionally, including non-governmental organizations working in the public interest within this research exemption would be beneficial.

Sub-section 4, with its reference to “specific situations/use cases” for Federal Government exemptions, is overly vague and broad, granting too much discretion to the Commission. A more precise definition of these terms or additional conditions for exemptions would enhance clarity and prevent potential misuse.

Section 34(2)(f) provides a broad exemption for journalistic purposes. This exemption covers critical and sensitive personal data and overlooks the significant risks posed by data breaches, especially those affecting women and gender minorities. To safeguard against such risks, it is essential to establish explicit Standard Operating Procedures (SOPs) by the National Commission for the Protection of Data Privacy (NCPDP), to be enforced within six months of the law’s enactment.

Section 35(2): Establishment of the Commission

There is a notable contradiction in Section 35(2), which describes the Commission as autonomous but places it under the administrative control of the Federal Government. To truly ensure its autonomy, the Commission should be independent of governmental control, in line with international best practices like the Paris Principles.

Section 37: Special Provisions Concerning Members

The terms “misconduct” and “misappropriation” in Section 37(2) are vaguely defined, providing excessive discretion to the Commission. These terms should be explicitly defined to prevent arbitrary interpretations and ensure accountability.

Section 43: Powers to Issue Policy Directives

The power granted to the Federal Government to issue policy directives to the Commission severely undermines the Commission’s independence. Such directives could potentially lead to external influences impacting the Commission’s decision-making.

Section 47: Cooperation with International Organizations

The requirement for government approval before the Commission cooperates with international organizations unnecessarily restricts the Commission’s autonomy. This condition could lead to delays and procedural hurdles, hindering the Commission’s effectiveness and its ability to engage in global data protection initiatives.

In summary, while the Bill aims to establish a robust data protection framework, certain sections require refinement to ensure precise definitions, prevent misuse, and maintain the independence and effectiveness of the Commission. The Bill would benefit from clearer guidelines and an autonomous, empowered Commission, capable of upholding data protection standards and cooperating effectively with international bodies.

Chapter IX: Complaint and Offenses; Chapter X: Miscellaneous Provisions

Section 51: Complaint

In Section 51, the Bill stipulates a “reasonable fee” for filing complaints before the Commission. It is advised that this fee be abolished, as even a nominal charge could deter individuals, particularly those from economically disadvantaged backgrounds, from exercising their right to file a complaint.

Section 54: Power to Make Rules; Section 59: Dissolution

The Bill grants the Commission the authority to make rules for implementing the Act, subject to the approval of the Federal Government. However, Section 54 appears to confer absolute rule-making power to the Federal Government. This centralization of power could potentially undermine the Commission’s autonomy and effectiveness.

Additionally, Section 59 permits the dissolution of the Commission by the Federal Government’s order. This contrasts with earlier drafts, where the Parliament held the power to wind up the Commission. Such a shift in power from the legislative to the executive branch disrupts the fundamental principle of separation of powers. It raises concerns about the potential for executive overreach and the implications for the independence and impartial functioning of the Commission.

In conclusion, while the Bill seeks to establish a comprehensive data protection regime, certain provisions in these chapters could hinder the accessibility of the complaint mechanism and compromise the independence of the Commission. It is essential to revisit these sections to ensure that they align with democratic principles and facilitate the effective protection of data rights without imposing undue barriers or centralizing excessive power in the executive branch.

The 2023 Bill, focusing on data protection and privacy, presents several key takeaways:

1. Enhanced Data Protection Framework: The Bill introduces a comprehensive framework for the protection of personal data, emphasizing the rights of data subjects and imposing obligations on data controllers and processors.
2. Consent and Rights of Data Subjects: It underscores the importance of obtaining consent from data subjects for processing their personal data and grants various rights such as access to personal data, right to erasure, and data portability.
3. Protection of Children’s Data: The Bill pays special attention to the processing of children’s personal data, recognizing the need for additional safeguards in this area.
4. Regulations for Sensitive and Critical Data: It delineates specific provisions for handling sensitive and critical personal data, highlighting the need for heightened security and caution.
5. Exemptions and Governmental Control: The Bill includes exemptions for research, statistics collection, and journalistic purposes. However, it grants significant power to the Federal Government in terms of rule-making and the potential dissolution of the Commission, raising concerns about the balance of power and the autonomy of the Commission.
6. Data Localization Requirements: The Bill proposes data localization for critical personal data, which could have implications for international business practices and local infrastructure capabilities.
7. Commission’s Autonomy and Governance: The Bill establishes a Commission for data protection but places it under the administrative control of the Federal Government, which might affect its independence.
8. Concerns Over Vague Definitions: Various sections of the Bill have been noted for their vague definitions (such as ‘public interest’ and ‘misconduct’), which could lead to subjective interpretations and potential misuse.
9. International Alignment: While the Bill reflects an effort to align with international data protection standards, such as the GDPR, there are areas where it diverges or lacks clarity, indicating a need for further refinement.
10. Fees and Accessibility Issues: The Bill’s provisions for fees for filing complaints or accessing personal data reports could potentially hinder the accessibility of these rights for all individuals, regardless of their financial situation.

In summary, the 2023 Bill represents a significant step towards establishing a robust data protection regime in Pakistan. However, it also presents challenges and areas for improvement, particularly in ensuring the independence of the regulatory body, refining vague definitions, and balancing the rights of individuals with the interests of the state and businesses.