PAKISTAN Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, S.U.Khan Associates
The right of Access to Information Act, 2017 governs the general public’s right to access information; however, no such information will be provided that jeopardises the privacy of an identifiable individual. In view of said Act, the Pakistan Information Commission in Appeal No 1080-05-2021 decided that an appellant seeking information relevant to a housing society should be provided with the requested information, after removing the information touching on the priva - cy of other members. In its E-Commerce Policy of Pakistan (2019) and elsewhere, the Ministry of Commerce has adopted data protection as one of its policy initiatives. 1.2 Regulators Under the Draft Bill, the National Commission for Personal Data Protection (NCPDP) shall be established for regulation and for implementa - tion of the Draft Bill. It will be an autonomous body under the control of the federal govern - ment, where individuals’ grievances shall be addressed. For the purpose of complaints, the NCPDP shall be deemed a civil court, having the same powers as are vested in a civil court under the Code of Civil Procedure, 1908. The NCPDP is empowered to call for information from the data controller or from the data proces - sor as may be reasonably required for effective discharge of its functions. Under the Draft Bill, the NCPDP is empowered to formulate a compli - ance framework regarding data audits. As regards the banking sector, the State Bank Of Pakistan (SBP) – Pakistan’s central bank – is regulator and has the powers to call for any information related to the business of banks. The SBP has issued regulations and guidance that are to be followed by banks; non-compliance entails penal action by the SBP.
The PTA is the regulator for the telecoms sector. It monitors and enforces rules and regulations; non-compliance entails imposition of penalties under the Pakistan Telecommunication (Re- organization) Act, 1996. The Federal Investigation Agency (FIA) is the investigating agency under the PECA. The FIA and its authorised officers are empowered to investigate an offence under the PECA in accord - ance with the Code of Criminal Procedure, 1908. 1.3 Enforcement Proceedings and Fines Administrative proceedings under the Draft Bill can be initiated with the filing of a complaint, against any: • violation of personal data protection rights; • misconduct of any data controller or data processor; • breach of a data subject’s consent to process data; or • breach of a data controller’s obligations. The complaint should be filed in a simple written format, and the complainant must certify that they had not already or concurrently filed any application, complaint or suit before any other forum or court. Any individual whose identity information will be obtained, possessed or distributed or is being used without any authorisation may file a com - plaint with the FIA; if the victim requires blocking access to identifiable information or destroying such information, they may approach the PTA, as established under the Pakistan Telecommu - nication (Re-organization) Act 1996. Any malpractice carried out by a bank with respect to the secrecy of customers’ data may
335 CHAMBERS.COM
Powered by FlippingBook