All Posts in Legal

September 25, 2025 - Comments Off on Probing Attacks on Journalists: Investigative Analysis of PECA’s Post-Amendment 2025 Cases 

Probing Attacks on Journalists: Investigative Analysis of PECA’s Post-Amendment 2025 Cases 

Over the past decade, Pakistan has experienced a rapid increase in digital connectivity and technological advancement. The internet has become a central platform for citizen engagement, political participation, journalistic expression, and public debate. However, this digital shift has also introduced pressing challenges, including the spread of misinformation, cyber harassment, privacy breaches, and other forms of cybercrime. These concerns have prompted the government to intervene and enact robust legal mechanisms to regulate digital spaces. 

The Prevention of Electronic Crimes Act, 2016 (PECA), was introduced as a primary law in Pakistan to govern online spaces and to provide safeguards against cybercrimes. Its provisions addressing offenses such as unauthorized access, identity theft, cyber harassment, child pornography, cyberbullying, and defamation provided a legal framework to enhance cybersecurity and protect individuals from the emerging threats of the digital age. However, over time, the implementation of PECA has evolved in a way that extends beyond this protective scope, shifting its focus away from the original purpose of safeguarding against online crimes for which it was enacted. 

In practice, rather than focusing on combating online crimes, the state's implementation of PECA appears directed at harassing, intimidating, and silencing the voices of critics. PECA now stands as a tool to restrict the right to free expression in online spaces, particularly for journalists, and has given rise to distressing attacks. 

Journalists and media practitioners have been the primary targets of PECA and have been subjected to attacks for their reporting, critique of state institutions, or exposing corruption. Attacks on them are becoming increasingly common, ranging from targeted disinformation campaigns to legal intimidation. The Clooney Foundation for Justice, an international organization dedicated to various causes for human rights protection, including monitoring trials targeting journalists to advocate against unfair convictions, published a comprehensive report in 2023 entitled "Section 20 of Pakistan’s Prevention of Electronic Crimes Act: Urgent Reforms Needed." This report documented cases of unfair prosecution of journalists in Pakistan and provides evidence regarding the prevailing pattern of using PECA by the Federal Investigation Agency (FIA) as a tool to suppress press freedom and target journalists.

These practices to harass journalists stand in direct conflict with Pakistan's constitutional guarantees and international obligations. The Constitution of Pakistan 1973 lays out clear guarantees for freedom of speech and expression. Article 19 states that “Every citizen shall have the right to freedom of speech and expression, and there shall be freedom of the press, subject to any reasonable restrictions imposed by law in the interest of the glory of Islam or the integrity, security or defence of Pakistan or any part thereof, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, commission of or incitement to an offence.” This constitutional safeguard provides the journalists and press with a strong legal foothold, even while permitting limitations. In Masroor Ahsan v. Ardeshir Cowasjee (PLD 1998 SC 823), the Supreme Court recognized freedom of the press as one of the pillars of individual liberty that cannot be curtailed beyond what the Constitution expressly permits. The 18th Amendment further strengthened this provision through  Article 19A, which states, “Every citizen shall have the right to have access to information in all matters of public importance subject to regulation and reasonable restrictions imposed by law.” Together, these provisions were designed to ensure that journalists can not only publish freely but also gather the information needed to do so.

Beyond constitutional guarantees, statutory protections also exist. The Press Council of Pakistan Ordinance, 2002, established a body to safeguard press freedom, uphold ethical standards, and provide a forum for complaints of interference, although its powers remain limited. More significantly, the Protection of Journalists and Media Professionals Act, 2021, passed by the National Assembly on November 8 and signed into law on December 2, 2021, is regarded as the most comprehensive piece of legislation on media safety in Pakistan. Its provisions affirm journalists’ right to life, privacy, and non-disclosure of sources; ensure independence in the performance of journalistic duty; and provide safeguards from harassment or violence. In Rana Muhammad Arshad v. Federation of Pakistan (W.P. No.2939/2020 IHC), the Islamabad High Court (IHC) reinforced these protections by quashing a cybercrime notice issued to a journalist, holding that the notice violated his constitutional rights to free speech and access to information and that the state bears a duty to protect the independence of journalists.

Along with the domestic legal obligation to safeguard the rights of journalists, Pakistan also has an international obligation under the Universal Declaration of Human Rights (UDHR) and the International Covenant on Civil and Political Rights (ICCPR). The Pakistani legal system contains wider restrictions than ICCPR standards, as officials use national security and religious reasons to limit press freedom. The media faces censorship, while websites and YouTube channels get blocked, and reporters experience intimidation and oppression despite existing international obligations and constitutional protections. The 2025 global press freedom rankings place Pakistan at 158th of 180 countries, making it one of the most dangerous states for journalists. The UN Human Rights Committee, together with advocacy groups, has expressed worry that Pakistan violates ICCPR commitments through its extensive application of laws such as sedition, defamation, and blasphemy laws.

Despite the existence of such extensive national safeguards and international commitments that uphold press freedom, Pakistan has consistently disregarded these guarantees. Instead of protecting rights through legal frameworks, PECA has been used to curtail them. This trajectory reached a critical turning point with the introduction of the PECA Amendment Act 2025 (PECA Amendment), which further contributed to the restrictions on free expression rather than addressing the law’s earlier flaws.

With the passage of this amendment, Pakistan has further redrawn the parameters of online free speech, and once again, journalists are bearing the brunt. As noted by several critics and journalists, and highlighted in the Digital Rights Foundation’s analysis of the PECA Amendment, the legislation marks a negative turning point for Pakistan’s digital landscape by creating vague criminal offences which are potentially weaponized to suppress accountability and discourage individuals from speaking out or sharing information due to the threat of legal repercussions. This PECA Amendment transforms the already problematic online spaces into heavily monitored, state-regulated platforms, where free expression is further suppressed by criminalizing undefined "fake news" under section 26-A. 

As per the newly added Section 26-A through the 2025 Amendment, “Whoever intentionally disseminates, publicly exhibits, or transmits any information through any information system, that he knows or has reason to believe to be false or fake and likely to cause or create a sense of fear, panic or disorder or unrest in general public or society...” The newly introduced 26-A introduces severe penalties for violations, including imprisonment for up to three years, a fine ranging from one to two million rupees, or both. It is interesting to note how the PECA Amendment, or the original PECA Act itself, does not define the terms ‘fake’ and ‘likely to cause unrest’, leaving broad discretion in the hands of authorities. The legal ambiguity of Section 26-A has turned this provision into a powerful tool to curb free speech, rather than serving its original intent. As a result, journalists face FIRs, notices, summons, arrests, and prolonged investigations and trials. Such cases are now widespread in the country, occurring in both major cities and smaller districts. 

The examples below, especially those registered after the recent PECA Amendment 2025, highlight the growing trend of using amended PECA provisions not for accountability and online safety, but to deter investigative reporting and control over the press freedoms. 

Cases related to Propaganda and Fake News

  1. In March, Journalist Farhan Mallick, founder of the media agency Raftar, was also arrested in Karachi by the FIA on allegations of running “anti-state” content on his YouTube channel. He was booked under Sections 16, 20, and 26A of PECA, along with Sections 500 and 109 of the Pakistan Penal Code 1860, and was remanded into FIA custody for four days. As per the FIR, Farhan Mallic, by using the alleged YouTube Channel, namely “Raftar TV”, is involved in generating and continuously disseminating and uploading posts and videos related to anti-state with fake news and public incitement agenda. 
  2. In March, Journalist Waheed Murad was also taken from his residence in Islamabad, after which the FIA Islamabad registered a case against Journalist Waheed Murad under Sections 9, 10, 20, and 26A of PECA over allegations of posting intimidating and misleading content online. It is also stated in the FIR that Mr Murad shared highly intimidating content on social media platforms, at Facebook and X, leading to the dissemination of false, misleading, and misinterpreted information, which leads to hatred against government functionaries.
  3. In April, a case was registered against journalist Muneeb Indhar at Dadlo Police Station in Pano Aqil, Sukkur, under section 20 of PECA along with sections 500, 504, and 506 of the Pakistan Penal Code, for allegedly using derogatory language against President Asif Ali Zardari on his Facebook account.
  4. In July, a Judicial Magistrate in Islamabad, on the request of the National Cyber Crimes Investigation Agency (NCCIA), ordered the blocking of 27 YouTube channels under Section 37 of the PECA for allegedly spreading fake, misleading, and defamatory content against government institutions and the armed forces. The blocked channels included those run by journalists as well. Subsequently, a revision petition has been filed against the order. On September 9, 2025, Additional District and Sessions Judge Mohammad set aside the order, declaring the Magistrate lacks the jurisdiction, while deciding that the PTA is still competent to take action as per law.
  5. In August, an FIR was registered by NCCIA Islamabad against journalist Khalid Jamil under sections 20 and 26-A of PECA on accusations of “deliberate pattern of conduct involving mocking, ridiculing, and maligning state institutions with the clear intent to instigate public discontent”. As per the FIR, Mr Jamil was found sharing highly intimidating content on X, and his profile has knowingly disseminated fake and false information  leading to hatred against the government functionaries. 

Cases related to Local Accountability Reporting

  1. On 29 July 2025, journalist Iftikhar Ul Hassan (Director News, Samaa/PTV, based in Multan) posted on social media about actions taken by the deputy commissioner and chief officer of the Municipal Committee against the Grand City Housing Scheme in Vehari district, Punjab. Following this, the Vehari administration, through Chief Officer Naeem Khalid, filed an FIR against him under Section 20 of the PECA . 
  2. In July, an FIR was registered at Daniwal Police Station on the complaint of Municipal Officer Majeed Pathan against journalist Muhammad Aslam Chaudhry. The FIR alleged that Aslam uploaded a video on social media accusing the Municipal Committee Vehari of using substandard materials in a World Bank–funded road construction project under the Punjab Cities Program, claiming the video was intended to blackmail and damage the administration’s reputation and noting that Aslam lacked the technical expertise to make such claims. The case was lodged under Sections 20, 24, and 27 of PECA. 
  3. In August, journalist Irfan Khan posted on X (formerly Twitter) that deputy commissioner posts in Lakki Marwat, Malakand, and Karak districts in Khyber Pakhtunkhwa were being sold for up to Rs 25 million. After the post, the Khyber Pakhtunkhwa Secretary Establishment filed a complaint with the NCCIA, accusing him of spreading false and defamatory content against the provincial government.

The above cases show how online spaces in Pakistan, once celebrated as platforms for free expression and accountability, have become increasingly vulnerable for journalists. The rise of vague and sweeping laws against so-called “fake news” has blurred the boundaries between free expression and criminal conduct. Critical reporting that highlights major issues is now treated as a potential offense under the guise of 'fake news'. From national headlines to local stories, no piece of journalism remains safe from legal repercussions, leaving journalists exposed to harassment, censorship, and even legal action.  Each new FIR under the banner of “fake news” gives a louder message that speaking facts in today’s digital spaces comes at the cost of freedom, safety, and sometimes one’s career. In the longer run, the law will not only impact journalists but also ordinary citizens, content creators, activists, and even businesses that rely on open digital discourse.

To reclaim the promise of a free digital landscape, Pakistan must urgently reform PECA, and entirely eliminate PECA Amendment to eliminate ambiguous provisions and adopt global best practices by other countries, where various states have shown changes in law, institutions, and safety systems to help weak media environments grow into stronger democratic ones. In 2013, Jamaica abolished criminal defamation laws, removing the risk of imprisonment for journalists and helping to curb self-censorship. Ghana undertook a similar step in 2001 by repealing criminal libel, a reform that contributed to one of the freest press systems in Africa. Sweden also illustrates the importance of institutional safeguards, with strong protections for sources and independent press councils that preserve editorial independence while ensuring ethical accountability. On the safety front, the Netherlands’ PersVeilig initiative demonstrates how collaboration between law enforcement, prosecutors, and media organisations can provide rapid responses to threats. Colombia offers another model through its National Protection Unit, which supplies at-risk journalists with relocation support, bodyguards, and other protective measures in high-risk environments. To protect journalists in practice, Pakistan could draw on these precedents to introduce legal reforms, independent regulation, and strong safety mechanisms in order to reduce punitive prosecutions against journalists.

In short, this investigative piece, with the aid of case studies, exposes the systemic attacks on journalists, revealing a stark reality of censorship and curtailment of basic freedoms. Laws intended to protect vulnerable groups, including journalists, are now being misused against them. This probe highlights the ills of politically motivated amendments and demands that legal instruments and their enforcement agencies deliver justice instead of serving those in authority. 

January 23, 2025 - Comments Off on Digital Nation Pakistan Bill 2024: DRF Analysis and Recommendations

Digital Nation Pakistan Bill 2024: DRF Analysis and Recommendations

Context:

On 16 December, 2024, the Minister of State for IT Shaza Fatima tabled[1] the Digital Nation Pakistan Bill 2024[2] (“Bill”) in the National Assembly (NA). The proposed Bill aims to facilitate the formation of digital identity for citizens and centralize social, economic, and governance data. The digital identity is expected to include data about a citizen’s health, assets, and other social indicators. Furthermore, the Bill proposes to create three bodies[3] including a high-powered National Digital Commission (NDC), to be chaired by the Prime Minister, a Strategic Oversight Committee (SOC), and a Pakistan Digital Authority (PDA). Reportedly, NDC will “set the strategic vision and policy framework for the country's digital transformation.” Furthermore, PDA will “implement these policies by coordinating and harmonizing digital initiatives across all levels of government.” Lastly, SOC will provide oversight on the work on PDA. Reportedly, the Bill has been prepared under the World Bank’s US$78 million Digital Economy Enhancement Project (DEEP)[4]. It will likely enable the creation of a centralized digital infrastructure by 14 August, 2025 and all existing databases would be linked to it.

The bill has received widespread criticism from digital rights advocates, industry and parliamentarians, with some urging the government to consult all stakeholders before rushing through the legislation. On the other hand, IT Minister Shaza has defended the bill, terming it a “historic initiative” that would “eliminate red tape”.

The bill has been referred to the National Assembly’s Standing Committee on IT for further consultation. In terms of the next steps, it has to be tabled in the National Assembly again if new changes are incorporated into the existing draft. Once approved by the NA, it will then have to be tabled and approved by the Senate, before it is sent to the President for formal assent and becomes an Act. It is unclear how soon the government will move it through the parliament.


Concerns pertaining to the Bill:

  1. No Prior consultation with civil society: The proposed initiative will transform the way citizens interact with the state and will have huge implications for human rights as well as the digital economy. Civil society organisations were not given a chance to provide inputs during the drafting of the bill or share any solutions to address any human rights concerns pertaining to the proposed Digital ID framework. Furthermore, the World Bank did not initiate such a consultation while providing input to the government. It is also unclear what advice was sent to the government by the World Bank on the proposed framework. Global civil society organisations had long urged the Bank to consult human rights groups while facilitating the launch of such ID systems globally. An open letter[5] in this regard was also issued in 2022 that called for human rights impact assessments of digital ID systems. Additionally, in the governance bodies, there is no representation of ordinary citizens or civil society.
  2. Overlapping Agenda: The proposed authorities in the bill seem to share many of the ambitions on digital development for which there already exist autonomous bodies such as the National Information and Technology Board[6] and provincial technology boards. It is unclear why a new set of authorities are needed to design and implement a “National Digital Masterplan”, as per Sections 11 and 12 of the Bill,  given the presence of existing bodies with similar mandates and areas of focus. The Act also contains broad definitions for terms like "digital economy," "digital governance," and "emerging technologies," which may lead to overlapping responsibilities across agencies or entities, causing inefficiencies.
  3. Austerity Vs Efficiency: The new Bill proposes the creation of a new authority called the Pakistan Digital Authority (PDA). The PDA will monitor implementation, assess compliance, and report progress to the NDC (Section 12(2)). However, there are no timelines for these processes, which will pose a risk of delays and ineffective implementation. Further, the current draft of the Bill proposes that the PM will appoint the three members of the authority and they may be eligible to open new offices. The creation of new authority with overlapping agenda may not be a good use of government resources at a time when the Prime Minister and the Finance Minister Muhammad Aurangzeb are spearheading an austerity drive that will likely lead to abolishing at least 82 government departments[7] at the federal level and also include a few in the IT Ministry. Finance Minister Aurangzeb in particular criticised[8] the need for creating the NDC and PDA, urging instead for the use of current technological infrastructure.
  4. Data Protection Bill Vs Digital Nation Pakistan Bill: The proposal of a centralised digital infrastructure amid multiple incidents of massive data breaches and the absence of a data protection framework raise serious concerns around the government's capability to effectively manage data security of a centralised infrastructure. In various jurisdictions across the globe, a clearly laid out data protection framework and an autonomous data protection authority is essential to providing clarity around safety of the citizens’ data. Without a strong legal framework , a digital ID system runs the risk of highly sensitive data breaches with no mechanism for redressal and accountability, as has already been noted extensively in the case of data breaches in Aadhaar (India’s digital ID system) by CSOs such as Privacy International[9]. Given the proposed masterplan under this Bill is likely to increase data processing of citizens’ data from various government departments, the next step towards enhanced digitalization is a Data Protection law, not a DNPB at this stage. Unless citizens have clarity on the accountability mechanisms pertaining to their data, creating additional authorities with powers to handle citizen data would create uncertainty among citizens. Numerous jurisdictions have adopted universally acclaimed data protection frameworks such as GDPR[10] in the EU, Sri Lanka’s Registration of Persons Act[11] in South Asia, and the Philippines’ Data Privacy Act of 2012[12].  It is positive to note that the IT Ministry is already working on the bill and has been provided with feedback from all the stakeholders, especially from the digital economy and the human rights lens.
  5. Internet connectivity challenges: Additionally, the effectiveness of the digital identity system relies heavily on reliable internet connectivity, which remains inaccessible to more than half of the population. Even those with access have complained of poor internet quality and intermittent disruptions with no clear explanation from the government on how soon the internet connectivity would improve. Reportedly, Pakistan’s internet speeds were rated among the lowest 12% of the countries.[13] In such a situation, a centralized digital ID framework is likely to exacerbate the digital divide and deprive half of the population from the services it aims to offer.
  6. Sweeping powers, Lack of Accountability and Judicial Oversight: Sections 28 and 29 of the Bill raise serious concerns by giving unchecked power to the authorities enforcing it. By stipulating under Section 29 that “no decision or action taken under this Act or rules" or regulations made thereunder shall be questioned by any agency or challenged in any court or tribunal, nor shall any injunction be granted against such decisions or actions”, the law shuts the door for accountability, removes judicial scrutiny, and violates the principle of checks and balances.  This prohibition further conflicts with constitutional guarantees, such as the right to due process, as it bars seeking legal remedies against potential abuses of power. The lack of oversight and barring injunctions will risk arbitrary decision-making and misuse of powers. It could also discourage foreign businesses and investors who prefer strong legal safeguards. Moreover, section 28 giving this Bill an overriding power over other laws will threaten existing or future right-based protections, like those for privacy or data protections. Concerningly, the Strategic Oversight Committee (SOC), established under Section 9 of the Bill, which claims to be an independent body, will be chaired by the IT Minister, effectively rendering its independence and autonomy compromised. For instance, Cambodia set up a monitoring body called the National Steering Committee on CRVS and Identification (NSCI) under its National Strategic Plan of Identification (2017-2026) that includes civil society representation apart from members of multiple government ministries[14].
  7. Concerns around the Bureaucratic Composition of Proposed Authorities:  The establishment of three governance bodies in the Bill raises concerns regarding power concentration, accountability, and operational effectiveness. Firstly, the NDC, chaired by the Prime Minister and made up of political leaders, centralizes decision-making, which could lead to politicized decisions. NDA is composed of 17 members, including the Prime Minister, key federal ministers, and all four provincial chief ministers. This composition raises concerns about the practicality and functionality of the commission. For instance, holding meetings could be challenging with this centralized structure of the high-level membership, resulting in delays in decision-making, and difficulties in coordinating across various levels of government. The sustainability of such a structure over time may be questioned, given the complexities of aligning federal and provincial interests within a single body. Secondly, though the PDA does have administrative and financial powers, it does not appear to have true autonomy, as any appointments will be made by the Prime Minister, who also has the authority to remove persons “for reasons to be recorded” (Section 7(6)), in the absence of voluntary resignation. Lastly, the SOC, according to the Bill, will promote accountability through monitoring the PDA’s performance and providing independent reviews. Its purview for thorough external oversight could be limited, however, given that it will be answering to the NDC. The language of the Bill does not indicate or address any clear mechanism for conflict resolution between these bodies or the federal and provincial stakeholders involved.
  8. Unclear Funding Mechanism: There are many vague sources of the "Digital Nation Fund," like government allocations, grants, and loans, but no mechanism for securing and sustaining these funds. Getting an annual allocation from the Finance Ministry will be a challenge.

 

Recommendations:

  1. Human Rights Risk Audit: Prior to and during the implementation of a digital ID system under the Digital Nation Pakistan Bill (2024), a human rights risk audit conducted by independent experts is necessary. This audit will comprise contextual and baseline analyses, independent rights-focused evaluations, and cost-benefit audits that take into account political, social, and economic dynamics. Funding and resources must be allocated to such an audit . The audit team should be independent from the World Bank or government to avoid conflict of interests.
  2. Create opportunities for sustained, high-level engagement with civil society and other experts: In the review stage of the Bill, the government must facilitate inclusive multistakeholder fora by holding open and transparent dialogue with civil society, experts, and other stakeholders. These fora should enable the evaluation of current systems and potential implementations across various sectors, including trade, healthcare, and migration management.
  3. Enact a Human Rights compliant data protection bill: The government should prioritize the passage of a rights-respecting data protection law instead of the proposed Bill, with clear guidelines on how data will be collected, stored, and used, alongside strict protocols for consent mechanisms, data security, and accountability. In parallel, given the centralization of data, there must be proper implementation of cybersecurity measures, including checks on access controls and regular assessments.
  4. Cyber Security of Centralized Data Systems: Refrain from establishing digital ID systems as a centralized repository that government officials or private actors can easily access without limitations, particularly if the digital ID system includes biometric data. Access to the data should be strictly limited, and law enforcement access should be predicated on a warrant issued by an independent judicial authority. All data collection, processing, and storage must instead be decentralised, and distributed across multiple locations or systems instead of relying on a single, centralized database. Capacity building in cybersecurity infrastructure is possible for Pakistan through collaboration with international organisations and experts, enhanced public funding, and public-private partnerships.
  5. Develop a legal framework with robust transparency and oversight mechanisms: The government must develop robust legal frameworks to govern the operation, use, and access of digital ID systems. These frameworks must classify citizen data by sensitivity—particularly protecting biometric, financial, and medical data under strict guidelines inspired by international standards such as the European Union General Data Protection Regulation (EU GDPR), United Kingdom Digital Identity and Attributes Trust Framework (UK DIATF), United States Health Insurance Portability and Accountability Act (US HIPAA), and Gramm-Leach-Bliley Act (GLBA).

    Section 29 of the Digital Nation Pakistan Bill 2024 which provides blanket immunity provisions that undermine transparency and accountability, must be amended to allow for limited judicial review. Any oversight mechanisms must be independent, and must include accessible grievance processes to address rights violations, gain public trust, and protect against potential abuses of power.

  6. Ensure Digital ID systems are inclusive: The proposed Bill risks excluding marginalized communities due to limited internet access in rural and underdeveloped areas such as Gilgit-Baltistan and Balochistan. The framework does not address how these regions will be accommodated. The government should make significant investments to expand broadband and 5G infrastructure, leveraging public-private partnerships and government subsidies. A good model to follow can be India’s BharatNet[15], which aims to provide broadband access to 250,000 villages for e-health, e-education, and e-governance. Policies should be designed to incentivize ISPs to reduce service costs in underserved areas alongside launching digital literacy campaigns to empower citizens.
    Further, the framework must delink digital IDs from legal status, following examples like the World Bank-funded Nigeria Digital Identification for Development Project. This allows refugees, migrant workers, and stateless persons to access essential services without barriers.
    The Bill should include periodic appraisals pertaining to digital inclusivity, annual progress reports to Parliament, and a clear timeline for infrastructure development with robust accountability mechanisms.
  7. Ensure Strategic Oversight Committee (SOC) is fully independent: As highlighted in the concerns above, the proposed establishment of the Strategic Oversight Committee (SOC) as an independent and autonomous body consisting of private sectoral representation with the aim of legally enabled input is hindered by the fact that it will be chaired by the IT Minister. In order to ensure the independence of this body, there must be no involvement of government officials in the Committee.

[1] https://www.dawn.com/news/1879138

[2] https://www.na.gov.pk/uploads/documents/6760344aeafac_156.pdf

[3] https://www.geo.tv/latest/579958-digital-nation-pakistan-bill-tabled-in-na-to-establish-unified-identity-for-citizens

[4] https://www.brecorder.com/news/40338210/talks-on-digital-nation-bill-inconclusive

[5] https://www.accessnow.org/press-release/open-letter-to-the-world-bank-digital-id-systems/

[6] https://www.nitb.gov.pk/

[7] https://www.dawn.com/news/1855153

[8] https://tribune.com.pk/story/2495476/ministers-object-to-creation-of-more-authorities

[9] https://privacyinternational.org/long-read/2299/initial-analysis-indian-supreme-court-decision-aadhaar#:~:text=The%20court%20has%20demanded%20that,for%20government%20grants%2C%20and%20schools

[10] https://gdpr.eu/

[11] https://www.srilankalaw.lk/r/1018-registration-of-persons-act.html

[12] https://privacy.gov.ph/data-privacy-act/

[13] https://www.google.com/url?q=https://www.dawn.com/news/1882236/the-year-they-came-for-the-internet&sa=D&source=docs&ust=1736247757914673&usg=AOvVaw0DwtDZoKi3rpzmLbVr9jIZ

[14] https://greaterinternetfreedom.org/wp-content/uploads/2023/09/Regional-Report_South-and-Southeast-Asia.pdf

[15] https://www.akalinfo.com/blog/bharatnet/

May 5, 2020 - Comments Off on Digital Rights Foundation’s Legal Analysis of the 2020 Personal Data Protection Bill

Digital Rights Foundation’s Legal Analysis of the 2020 Personal Data Protection Bill

History of Data Protection Legislation in Pakistan

According to the UN, 107 countries across the world have enacted data protection and privacy legislation. In order to ensure the fundamental rights of its citizens and compliance with international human rights standards, Pakistan has also taken steps to enact a personal data protection law in Pakistan. Article 14 of the Constitution of Pakistan guarantees the Right to Privacy, however serious efforts to introduce a law were first taken in 2018 (though a draft Bill was put forward in 2005 but was deemed too weak) when the Ministry of Information Technology and Telecommunication (MOITT) introduced a draft Personal Data Protection Bill in July 2018 and invited comments from the public. The Bill was lauded as a good first step, however suffered from serious issues in terms of scope as it restricted the definition of personal data to “commercial transactions”, limiting its applicability to government-held data, and the proposed Data Protection Commission was not sufficiently independent in its functions and composition. 

A second iteration of the Bill was shared by the Ministry in October 2018, with slight improvements in terms of definitions but many of the same concerns remained especially when compared to international best practices such as the General Data Protection Regulation (GDPR). There was little headway by the MOIT since despite appeals from civil society and being taken up by bodies such as the Senate Standing Committee on Human Rights. The third draft of the Personal Data Protection Bill (referred henceforth as the “Bill”), was put forward by Ministry in April 2020.

Executive Summary

We appreciate the efforts by the MOITT in making data protection and privacy of citizens a priority. Furthermore, we welcome the consultative process adopted by the Ministry. However we hope that during a time when the entire world, including Pakistan, is under lockdown and reeling from the economic, social and public health implications of the COVID-19 pandemic, that such important legislation will not be passed hastily and without the opportunity for an inclusive and open consultative process.

The new 2020 Personal Data Protection Bill, while a better version in comparison to the drafts issued in 2018, still does not fully capture the data protection needs of people in Pakistan. The most prominent issue we see with the draft is the exemption-making and wide-ranging powers given to the Federal Government, in particular under Sections 31 and 38 which risk undermining the protections afforded under the Act. Government bodies collect and process vast amounts of personal data and the obligations in the Act must extend to them and the Government should not be able to introduce further exemptions without proper scrutiny and safeguards. Additionally, the independence of the Personal Data Protection Authority of Pakistan needs to be ensured, by limiting the powers of the Federal Government to appoint members and approve rules made by the Authority (Section 48).

The need for and reliance on technology has and will drastically increase during the COVID-19 pandemic and in a post-Coronavirus world where we will see a predominantly offline world transform into an online world. Access to online platforms of communication, healthcare, education and business is no longer a luxury. In the midst of all this, the need for protection of our personal data is essential more than ever.

Our primary recommendations to the Ministry are:
  1. Definitions of terms such as “Public Interest” and “Critical Personal Data” should be explicitly defined under the Act;
  2. The definition of “Sensitive Personal Data” should be expanded to include categories such as “membership of a trade union” and “philosophical and/or religion beliefs”;
  3. Implementation of the Act should be on a progressive basis to ensure a balance between rights protection and a grace period for data controllers to ensure compliance;
  4. Clearer language regarding scope and jurisdiction of the Act;
  5. Mandatory requirements for obtaining consent should be expanded to include information on intention to transfer of personal data to a third country and the level of protection provided, the existence profiling for targeted purpose, and the existence of automated decision-making;
  6. The Act should develop a higher consent standard for personal data of children and young adults below the age of majority;
  7. Clearer and minimum requirements for security measures for data controllers should be laid down in the Act;
  8. Data localisation measures introduced for cross-border personal data flows should be seriously revised in light of international best practices;
  9. Procedure for withdrawal of consent should be simplified to ensure that it is as easy for the data subject to withdraw consent as it is to give it;
  10. Rights of data subjects such as the right to data portability, right to information related to profiling and automated decision-making, and right to compensation should be explicitly included in the Act;
  11. Powers of the Federal Government to make exemptions under Section 31 be removed;
  12. Safeguards should be included to ensure independence of the Data Protection Authority;
  13. Powers of the Federal Government to issue policy directives under Section 38 should be removed.Find DRF’s detailed, section-by-section analysis of the Personal Data Protection Bill 2020 here.

 

February 20, 2020 - Comments Off on Citizens Protection (Against Online Harm) Rules, 2020: Legal Analysis

Citizens Protection (Against Online Harm) Rules, 2020: Legal Analysis

The ‘Citizens Protection (Against Online Harm) Rules, 2020’ have been notified under sections of the Pakistan Telecommunication (Re-organisation) Act, 1996 and the Prevention of Electronic Crimes Act (PECA) 2016 (hereinafter collectively referred to as the ‘Parent Acts’). Under these Rules, the Pakistan Telecommunication Authority is the designated Authority. This legal analysis will highlight the jurisdictional and substantive issues with the Regulations in light of constitutional principles and precedent as well as larger policy questions.

Summary of the Legal Analysis

Given that the Rules exceed the scope of the Parent Acts and substantively violate the fundamental/Constitutional rights, particularly Article 14 and 19, they are inconsistent and in derogation with the Constitution as well as the Parent Acts and should be immediately denotified.