PAKISTAN Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, S.U.Khan Associates
4.2 Personalised Advertising and Other Online Marketing Practices The Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations, 2009, require all operators (holding a licence from the PTA) to establish a standard operating procedure (duly approved by the PTA) to control spamming. Similarly, all operators are required to develop a stand - ard operating procedure for controlling unsolicited calls. The operators are also required to establish a consolidated “Do Not Call Register” in connection with controlling unsolicited calls. The operators are further required to ensure registration of telemarket - ers. The Draft Bill provides that data subjects must not be subjected to automated decision-making, including profiling that presents significant harm to data sub - jects. 4.3 Employment Privacy Law Pakistan has no specific law concerning workplace privacy. The Draft Bill provides that sensitive personal data may be processed by a data controller for the purposes of exercising or performing any right or obligation conferred or imposed by law on the data controller in connection with employment. The Public Interest Disclosures Act, 2017, governs the mechanism for public interest disclosures and protec - tion of persons making such disclosures (related to the prevention of corruption in public sector organi - sations). Anonymous or pseudonymous disclosures are not considered under said Act. The identity of the complainant is to be protected unless required otherwise. The Act provides protection to the com - plainant against any victimisation on the ground that they made a disclosure. A complainant is considered victimised if they are:
• threatened with any of the above matters; or • subjected to discriminatory or other adverse meas - ures by their employer or by a fellow employee. Said Act also provides for due protection of the com - plainant, witness or any other person rendering assis - tance in an inquiry. The Securities and Exchange Commission of Paki - stan (SECP) has issued the Listed Companies (Code of Corporate Governance) Regulations, 2019 (the “Code”). The Code requires that listed companies’ boards of directors maintain a whistle-blowing policy, by establishing a mechanism to receive and handle complaints in a fair and transparent manner while providing protection to the complainant against vic - timisation. The Code requires that the chief executive officer of a listed company place “reports on/synopsis of issues and information pursued under the whistle- blowing policy, clearly disclosing how such matters were dealt with and finally resolved or cancelled”, before the board of directors or before the committee of the board of directors. Matters pertaining to the role of labour organisations, e-discovery issues, use of digital loss-prevention technologies and scanning/blocking websites at a workplace are not dealt with under the Draft Bill or under any other law. 4.4 Data Protection in M&A No regulatory framework is available governing data protection in M&A.
5. International Considerations 5.1 Restrictions on International Data Transfers
Under the Draft Bill, the transfer of personal data outside Pakistan is only permissible in the following cases: • equivalent protection; • explicit consent of the data subject; and • under a framework to be devised by the NCPDP.
• dismissed; • suspended; • denied promotion; • demoted; • made redundant;
• harassed; • intimated;
363 CHAMBERS.COM
Powered by FlippingBook