PAKISTAN Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, S.U.Khan Associates
Children’s data must not be processed in a manner that may cause harm, and practices such as track - ing, behavioural monitoring, or targeted advertising directed at children are prohibited. Limited exceptions may apply where processing is permitted for specific purposes prescribed under the Act. 1.4 Processing of Personal Data for Research and Development Purposes As Pakistan does not currently have an effective, dedi - cated legal framework governing the processing of personal data for research and development purpos - es, no specific statutory conditions have been formally prescribed in this regard. Nevertheless, companies that provide products or services used by healthcare providers must exercise particular caution when han - dling personal data, whether in its original form or after anonymisation, and should adhere to internationally recognised best practices. In particular, organisations must ensure that any data relied upon for research or development is irreversibly anonymised, such that it can no longer be used to identify a patient, either directly or indirectly. 1.5 Processing of Personal Data in the Context of Artificial Intelligence In 2023, under the Digital Pakistan Vision, the Ministry of Information Technology and Tele-communication issued the Draft National Artificial Intelligence Policy (the “Policy”). In order to accelerate socio-economic adoption, this policy looks towards adapting legal and regulatory frameworks needed to ensure safe and secure data-sharing mechanisms, considering international best practices. In September 2024, the Regulation of Artificial Intel - ligence Act, 2024, was introduced in the Senate of Pakistan, aiming to regulate artificial intelligence (AI) in the country – though this is yet to be passed. The draft of this Act is presently under consideration by the Standing Committee on Information Technology and Telecommunication. 1.6 Data Breach Requirement In the event of a personal data breach, where the breach is likely to result in any risk to the rights of the data subjects, the data controller must notify the Commission and the affected data subject without
undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. The data breach notification must include the follow - ing: • a description of the nature of the personal data breach; • the name and details of the data protection officer; • the consequences of the personal data breach; and • the measures adopted or suggested by the data controller to address the personal data breach. In addition, data controllers need to maintain a record of any personal data breaches that have occurred. As Pakistan does not yet have an operative data protection law in force, there is currently no active supervisory authority conducting investigations into personal data breaches. However, the proposed National Commission for Personal Data Protection would be empowered to investigate such breaches The Draft Bill provides for the establishment of the National Commission for Personal Data Protection (NCPDP). The NCPDP shall be responsible for: • protecting the interests of individuals; • enforcing protection of personal data; • preventing any misuse of personal data; • promoting awareness of data protection; and • addressing complaints. 1.8 Enforcement Proceedings and Fines Administrative proceedings under the Draft Bill can be initiated with the filing of a complaint against any: • violation of personal data protection rights; • misconduct of any data controller or data proces - sor; • breach of a data subject’s consent to process data; or • breach of a data controller’s obligations. once established. 1.7 Regulators
361 CHAMBERS.COM
Powered by FlippingBook