PAKISTAN Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, S.U.Khan Associates
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws The Constitution of Pakistan, under Article 14, rec - ognises the right to privacy as a fundamental right. In this context, the Ministry of Information Technology and Telecommunication has prepared a draft Personal Data Protection Bill, 2023 (the “Draft Bill”). Although the Draft Bill has completed the consultation stage, it has yet to be passed by both houses of the Par - liament. Its framework largely mirrors the European Union’s General Data Protection Regulation (GDPR). Pakistan is also a signatory to the International Cov - enant on Civil and Political Rights (ICCPR), which also demands that signatory states protect the privacy of individuals. Sector-specific laws or regulations are enforced in Pakistan, specifically governing privacy of custom - ers/individuals in the respective sectors. The Pakistan Telecommunication Authority (PTA), under the Pakistan Telecommunication (Re-Organi - zation) Act, 1996, issued the Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communica - tion Regulations, 2009. These regulations apply to all telecommunications operators and are designed to safeguard consumers from spam, fraudulent, unso - licited and obnoxious communications. The Preven - tion of Electronic Crimes Act, 2016 (PECA), address - es cybercrime, offering protection against electronic offences and fraud involving personal or digital data, and seeks to protect the integrity, privacy and security of electronic data. The Banking Companies Ordinance, 1962, governs the banking sector in Pakistan. It requires that banks not disclose any information pertaining to consumers’ data except where required under the law or for an appropriate purpose. Similarly, the Payment Systems and Electronic Fund Transfers Act, 2007 (the “Elec - tronic Fund Transfers Act”), regulates electronic fund transfers and consumer protection, secrecy and pri - vacy.
The Credit Bureaus Act, 2015, and the regulations made thereunder govern the unauthorised access or disclosure of credit information. The Right of Access to Information Act, 2017, gov - erns the general public’s right to access information; however, no such information will be provided that jeopardises the privacy of an identifiable individual. In Appeal No 1080-05-2021, the Pakistan Informa - tion Commission held that an appellant seeking infor - mation concerning a housing society was entitled to receive the requested material, provided that any information affecting the privacy of other members was redacted. In its E-Commerce Policy of Pakistan (2019) and elsewhere, the Ministry of Commerce has adopted data protection as one of its policy initiatives. With regard to the extraterritorial scope of the Draft Bill, it provides that personal data must not be trans - ferred to any unauthorised person. Critical personal data may only be processed on servers located within Pakistan, while the Commission is tasked with devis- ing a mechanism for the transfer of sensitive personal data. Where personal data, other than critical or sensi - tive personal data, is to be transferred outside Paki - stan, the receiving country must have an adequate legal framework for personal data protection. In the absence of such adequacy, the Commission may authorise the transfer subject to specified safeguards, including: • binding contractual arrangements; • the explicit consent of the data subject provided such consent does not conflict with Pakistan’s public interest or national security; • transfers necessary for international co-operation pursuant to applicable international obligations; and • any additional conditions prescribed by the Com - mission. 1.2 Rights and Obligations Grounds for Processing Personal Data • Lawful and Fair Processing: Personal data must be processed in a lawful, transparent, and fair manner, in compliance with the Act. • Purpose Limitation and Legitimate Purpose: Data may only be collected for specified, explicit, and
359 CHAMBERS.COM
Powered by FlippingBook