Source: BNN Breaking https://bnn.network/wp-content/uploads/2023/04/asia-internet-coalition-pakistan-data-protection-bill-jpeg.webp
Introduction:
Data protection and data privacy are deemed to be the rights of individuals to know what information is being shared and who has access to their personal data. Therefore, data privacy laws are important so that individuals can freely exercise their fundamental right to privacy. Various countries have adopted such laws to protect their citizens’ personal information. Considering the importance of data protection, the former opposition-led government of Pakistan recently passed a few legislations namely, the Personal Data Protection Bill 2023 and e-Safety Bill 2023, and laid down some amendments to the Prevention of Electronic Crimes Act 2016. However, these legislations have yet to get signed by the President and the assent is deferred till the holding of the next general elections. The proposed legislative bills have been greatly criticized as they lack transparency, tighten the control over digital spaces, and infringe on the fundamental right to privacy. This paper highlights the flaws in these hasty legislative proposals passed by the federal cabinet in the last few weeks.
PECA Amendment Bill, 2023:
PECA, as implemented in 2016, has been used as a tool to infringe on freedom of speech and penalize on the basis of cases filed against activists and journalists. Later on, through PECA Ordinance 2022, its scope was broadened to criminal defamation with the intention “to insulate state institutions from criticism on social media.” However, it was later struck down by Islamabad High Court in the same year. Now, the Act is being amended again with an addition of Section 20-A. It says a person will be convicted of five years in prison for sharing “fake or false information.” Here, the problem arises with the vague language of this section because no specific definition of “fake or false information” has been provided. Such language can be abused and misused by state officials to prohibit criticism of their dubious policies. Moreover, this section proposes that the offense of sharing fake news is cognizable, non-bailable, and non-compoundable which means FIA can arrest anyone without any warrant, and the arrestee has no option of bail.
Another amendment proposed by this bill is the expansion of the powers of the Pakistan Telecommunication Authority (PTA) under Sec. 37 of the Act. Under this provision, the PTA will have the authority to remove content that is defamatory and criticizes the judiciary and the armed forces of the country.[1] The surveillance and regulation of digital content at such a level will widen internet censorship in Pakistan and result in the banning of various sites and channels as has been done many a time in the past.
E-Safety Bill, 2023:
Another bill approved by the federal cabinet is the e-Safety Bill. This bill has been introduced under the guise of preventing cyberbullying and harassment, all of which have provisions under PECA, 2016. Interestingly, the draft of the same bill has neither been made public nor consultations have been made with experts in its drafting, raising serious concerns about its legality and leaving citizens uninformed about its potential implications.
Moreover, the E-Safety Bill requires Social Network Platforms, like YouTube Channels, Netflix, Amazon Prime, and other networking sites, to be registered under the E-Safety Authority. The proposed law tries to impose a broadcasting regulatory model on the Internet, which breaches the principles of intermediary liability provided to service providers.[2] This hostile regulatory model will drive various online platforms out and affect the content creators badly as they will have to go through unnecessary registration requirements for simply uploading a vlog.
Personal Data Protection Bill, 2023:
The third bill in question is the Personal Data Protection Bill, 2023 (PDPB) which has been denounced by rights activists for various reasons including data localization. Although during the preparation of the draft of this bill, the government received feedback and suggestions from experts, their concerns were not addressed and their suggestions were not taken into account.[3] Unlike its name, the bill, if passed, will have the opposite effect on users’ privacy. Section 31(2) of the PDPB requires critical personal data to be processed only within the territory of Pakistan. Data localization is actually a bad policy as it hinders international trade, which can have drastic effects on foreign investment in Pakistan. Moreover, this provision will badly impact the growing businesses in Pakistan as their data would get “locked up” within Pakistan and would not be stored in the most favorable locations.
In addition, the bill defines “Sensitive Personal Data” as “financial information excluding identification number, credit card data, debit card data, account number, or other payment instruments data.” The financial information should not be regarded as sensitive personal data; otherwise, it would pose challenges in implementation without providing meaningful benefit to data subjects, while severely impacting the ability of companies to provide services requested by the user or identify the user.[4]
Similarly, Sec. 32 of PDPB gives mandatory access to “sensitive personal data” to the Government of Pakistan. This provision is against Art. 14 of the Constitution of Pakistan guaranteeing citizens the fundamental right to privacy. In addition, including this section is likely to “lead to the conclusion under global privacy law norms that the [Personal Data Protection Bill] is not adequate and therefore likely to hamper data transfers into Pakistan.”[5] Furthermore, the Draft Bill would have significant implications for foreign companies as it would place them in an impossible position of trying to adhere to conflicting global laws.
Recommendations by the US Chamber of Commerce:
After the final draft of this bill was prepared and released in May 2023 by the Ministry of Information Technology and Telecommunication, the US Chamber of Commerce provided certain recommendations in the bill to ensure the business concerns are addressed and the fundamental rights of the citizens are not infringed.
Firstly, the Chamber proposed to exclude financial information from the definition of “sensitive personal data.” The inclusion of financial information in this definition is not in consonance with international norms like the General Data Protection Regulation (GDPR). Otherwise, the organizations in Pakistan will have limited grounds to collect data of their users which will put them at a great disadvantage as compared to their competitors in the international market, where the personal information is treated much flexibly.
Secondly, the Chamber recommends the removal of the Government’s mandatory access to the users’ sensitive personal data. If the bill is turned into law giving the right to the government to access the personal data of individuals, it will not just infringe on the constitution of Pakistan but also global privacy norms and will ultimately hinder the data transfers in Pakistan.
Thirdly and lastly, the Chamber suggests removing the data localization requirements and proposes the cross-border transfer of data. Data localization will not only restrict international trade in Pakistan but also increase cyber security risks by storing data in one location. In contrast, distributed networks like cloud storage systems are resilient, and affordable and guarantee the security of data tackling crimes like financing terrorism and money laundering. The Chamber urges the Government of Pakistan to allow the unimpeded cross-border transfer of data as it will benefit Pakistan’s economy by lowering international trade barriers, promoting innovation and efficiency, and providing access to global products and services.
Constitutional Analysis of the Bills:
This section analyses the legality of the proposed bills in light of the Constitution of Pakistan and the relevant case law. As mentioned above, these bills, if turned into laws without making desired changes, will have severe implications on the fundamental rights of the citizens guaranteed in the Constitution. For instance, the inclusion and the vague language of Sec. 20-A in the PECA will infringe on the fundamental right to freedom of speech as enshrined in Art. 19 of the Constitution. Firstly, the vague language imposes restrictions on the individuals, mainly the activists and the journalists, for not commenting on or criticizing the actions of the state. Secondly, it provides severe punishment by making the offense non-bailable and giving FIA the authority to arrest the individuals without any warrants.
Similarly, the Personal Data Protection Bill, by giving mandatory access and unfettered powers to the government to control individuals’ personal sensitive data, violates the fundamental right to privacy of the citizens. The mass surveillance and control at the end of the government will not only restrict trade and hinder international investments but also violate constitutional provisions by not taking into account the privacy of the citizens. The jurisprudence on the right to privacy as developed in recent years by the superior courts of the country highlights how important the right to privacy is and the same is just not restricted to homes but has been extended to digital spaces as well.
In the latest judgment of Muhammad Nawaz v. Additional District and Sessions Judge and others,[6] the Supreme Court of Pakistan has defined the scope of the right to privacy expansively. The court held that the right to privacy guaranteed by the Constitution protects the individual’s personal information, communication, and other aspects of his personal from unwarranted intrusion by the government, organizations, or other individuals. Although the right to privacy can be attributed to the right to life and liberty, considering its sanctity it has been included as a separate independent right in the Constitution. It must be noted that the right to privacy, “privacy of home” as enshrined in Art. 14, is not restricted to homes only; rather, it covers the entirety of the personal lives of citizens. The reason is that privacy is linked to the person and not the places where he resides.
Another very recent judgment of the Lahore High Court in the case of Muhammad Rehmat Ullah vs. The State, 2023[7] broadens the scope of Art. 14 of the Constitution which states “the dignity of man and, subject to law, the privacy of home, shall be inviolable.”[8] Using a figurative approach, the Honorable High Court declared digital devices akin to our homes. Just like Art. 9 of the Constitution was expanded in Shehla Zia v. WAPDA,[9] the High Court using a similar approach has broadened Art. 14 from homes to the digital spaces capturing personal data. The judgment is the right step towards protecting and upholding privacy rights because in the modern world, “accessing someone’s private device can often offer more information than a trespass on their homes as they tend to contain more of one’s financial, social and political lives.”[10]
Conclusion:
In conclusion, although there is a dire need to cater the modern needs and regulate digital spaces, it should not be done at the cost of infringing on the fundamental rights of the citizens. A balance must be struck between the innovation and basic rights of individuals. The proposed bills are necessary for law enforcement in the country, but there are certain loopholes that must be addressed before those are turned into laws. One of the major concerns is the bills have been introduced hastily without consulting the stakeholders ascribing a lack of inclusion, openness, and transparency. Similarly, major tech platforms like Meta, Amazon, Twitter (X), Apple, and Yahoo are skeptical that such legislations will negatively affect Pakistan’s digital economy and rights by impacting the operations and investments of foreign companies. Moreover, the recent judgments of the superior courts come at a crucial time when we are set to implement these laws. As the bills haven’t been turned into laws yet, it is necessary for the legislature to take into consideration the fundamental rights of the citizens as expanded by the judiciary.
[1] Shmyla Khan, ‘Muzzling Digital Media,’ August 6, 2023 https://www.thenews.com.pk/tns/detail/1097230-muzzling-digital-media Accessed: September 9, 2023
[2] Shmyla Khan, ‘Muzzling Digital Media’ August 6, 2023 https://www.thenews.com.pk/tns/detail/1097230-muzzling-digital-media Accessed: September 9, 2023
[3] Zainab Sabir Mir, ‘Data Protection Bill: What’s the Problem?’, August 02, 2023. https://www.geo.tv/latest/502883-data-protection-bill-2023-whats-the-problem accessed: September 10, 2023.
[4] Esperanza Gomez Jelalian and Jordan G. Heiber, ‘Submission on the Draft Pakistan Personal Data Protection Bill, 2023,’ US Chamber of Commerce, July 21, 2023. https://www.uschamber.com/international/submission-on-the-draft-pakistan-personal-data-protection-bill-2023 accessed: September, 10, 2023.
[5] Ibid.
[6] Muhammad Nawaz v. Additional District and Sessions Judge and others [PLD 2023 SC 461]
[7] The judgment approved for reporting.
[8] Article 14 of the Constitution of Islamic Republic of Pakistan, 1973.
[9] Shehla Zia vs. WAPDA [PLD 1994 Supreme Court 693]. The scope of Art. 9 of the Constitution was defined in figurative way. The court held that the word “life” is just not restricted to vegetative or animal life; rather, it includes all the basic amenities that a person born in free country is entitled to enjoy without any illegal restriction.
[10] Shmyla Khan, ‘Understanding privacy, the Pakistani Context,’ July 30, 2023. https://www.thenews.com.pk/tns/detail/1095086-understanding-privacy-the-pakistani-context#:~:text=Article%2014%20of%20the%20constitution,landmark%20Supreme%20Court%20case%20of accessed: September 10, 2023.
Works Cited:
Cases:
Muhammad Nawaz v. Additional District and Sessions Judge and others [PLD 2023 SC 461]
Muhammad Rehmat Ullah vs. The State, 2023
Shehla Zia vs. WAPDA [PLD 1994 Supreme Court 693]
Websites:
Jelalian E. and Heiber G., ‘Submission on the Draft Pakistan Personal Data Protection Bill, 2023,’ US Chamber of Commerce, July 21, 2023. https://www.uschamber.com/international/submission-on-the-draft-pakistan-personal-data-protection-bill-2023
Khan S., ‘Understanding privacy, the Pakistani Context,’ July 30, 2023. https://www.thenews.com.pk/tns/detail/1095086-understanding-privacy-the-pakistani-context#:~:text=Article%2014%20of%20the%20constitution,landmark%20Supreme%20Court%20case%20of
Khan S., ‘Muzzling Digital Media,’ August 6, 2023 https://www.thenews.com.pk/tns/detail/1097230-muzzling-digital-media
Mir S. Zainab, ‘Data Protection Bill: What’s the Problem?’ August 02, 2023. https://www.geo.tv/latest/502883-data-protection-bill-2023-whats-the-problem
Authors:
Muhammad Fahad Ashfaq – Research Assistant, RCIL & HR.
Ihtisham Ul Haq – Research Assistant, RCIL & HR.