Privacy International raises concerns regarding Pakistan’s Personal Data Protection Bill

Privacy International (PI) is concerned by developments in Pakistan regarding the enactment of the Draft Personal Data Protection Bill, 2023 and the opaque process which will see the bill become law.

The Bill was published on 19 May 2023 by the Ministry of Information Technology and Telecommunication ('MITT'). However no open and inclusive consultation was open for comments to be submitted to the MITT. In a concerning development it was reported that the Bill was approved by the Federal Cabinet in late July 2023, and will now proceed to the National Assembly and the Senate of Pakistan (collectively the Parliament) without any public consultation nor Parliamentary debate.

Whilst we are yet to receive confirmation of the version which will proceed to the legislative process, the Bill in its current form (public version published on 19 May 2023) still contains a number of shortcomings, does not meet international human rights standards and could have grave implications for the effective protection of people and their data.

This is not an exhaustive list of concerns, but provisions of the bill that illustrate the importance of further improving the law through an open and inclusive legislative process include: vague exceptions allowing the government to evade responsibility and deny individuals’ ability to exercise their rights to access their data and submit a complaint, a provision on data localisation of “Critical Personal Data”, or the lack of independence of the data protection authority which would be in charge of overseeing the implementation of the law. Data localisation is a worrying trend in many proposed regulations across the globe. PI has previously challenged its interpretation as a safeguard for protecting people and their data, given that it does not necessarily ensure better protection, and can be misused to access personal data for other purposes such as unlawful surveillance.

The Bill contains several exceptions on the basis of undefined criteria such as “national security” and terms with very wide definitions under the Bill such as “public interest” and “legitimate interest”. Given the lack of jurisprudence in the country defining these terms and the lack of an independence of the Commission from the Federal government, we are concerned that loopholes and shortcomings of the law could be abused.

PI has been monitoring various versions of the Bill for the last five years and our assessment has been that each new version put forward for consultation has made progress towards complying with international recognised data protection standards and principles. However, there remain glaring issues with the Bill that is expected to proceed to the legislative process. If allowed to become an Act in its current form, the proposed legislation will fall short of ensuring effective protection of people, their data and their rights. Given ongoing concerns of unlawful surveillance, and plans for further digital transformation in Pakistan, it is important that Pakistan ensures that it adopts a data protection law which can effectively respond to these developments.