Pakistan's New Cybersecurity Laws: Controversy and Concerns

Data Protection Bill Ambiguity: Rushed Approval Stirs Industry Worries

In response to the urgent requirement for data protection regulations, Pakistan's federal cabinet approved two significant cybersecurity laws on July 27, 2023: the Personal Data Protection Bill 2023 and the E-Safety Bill 2023. However, these legislative actions have not been met with unanimous approval. Various stakeholders, including digital rights activists, civil society members, and international entities, have expressed concerns and discontent over the perceived lack of transparency, ambiguity, and potential adverse consequences associated with these laws.

E-Safety Bill: Hidden Contents Fuel Suspicion

The E-Safety Bill aims to regulate digital media platforms and impose penalties for violations. However, the lack of public access to the bill's contents has raised suspicions and discontent. Critics argue that it is challenging to support a piece of legislation that remains shrouded in secrecy, leaving the public questioning its objectives and implications. This lack of transparency directly undermines the government's commitment to safeguarding consumers' interests.

Personal Data Protection Bill 2023: Ambiguity and Rushed Passage

The accessible Personal Data Protection Bill 2023, available on the Ministry of Information and Technology's website, has also drawn its share of criticism. The bill is intended to oversee the collection, processing, use, and disclosure of personal data, along with provisions for penalizing violations. Despite the acknowledged necessity for data protection, experts and activists have raised concerns about the rushed and secretive manner in which the bill was passed.

Expert Insights: Identifying Key Concerns

A recent online session hosted by the Centre for Excellence in Journalism (CEJ), IBA, brought together experts from diverse fields, including venture capitalism, technology, law, and digital rights activism, to shed light on the major issues surrounding the Personal Data Protection Bill 2023.

Urgent Need for Data Protection: Consensus Amid Concerns

Zainab Durrani, a prominent digital rights activist, highlighted the significance of protecting consumers' data, pointing out that only a mere seven countries lack data protection regulations. While there is a consensus on the importance of enacting data protection laws, experts unanimously expressed concerns about the lack of stakeholder feedback due to the hurried and secretive passage of the bill.

Industry-Specific Challenges: Technology's Perspective

Imran Moiuddin, a respected technology expert, addressed concerns specific to the tech industry. He stressed the importance of ensuring that data controllers and processors adhere to stringent standards to prevent negligent handling of data. Moiuddin emphasized the need for clear guidelines for cloud vendors, particularly in Pakistan's context where local infrastructure may not match international standards. Vague references to "best international security standards" and undefined minimum standards raised uncertainties regarding data security.

Business Impact: Investment and Startup Concerns

Misbah Naqvi, a seasoned venture capitalist, focused on the potential impact on businesses and foreign investment. She expressed concerns about the bill's potential to restrict startups and deter foreign investors due to increased costs and reduced business efficiency. While the need for data protection was acknowledged, Naqvi stressed the importance of comprehensive engagement with stakeholders to ensure effective implementation and to avoid a sweeping, one-size-fits-all approach.

Legal and Compliance Complexities

Mubariz Siddiqui, a legal expert, delved into the legal and compliance aspects of the bill. While recognizing the necessity for data protection, he pointed out that the bill's emphasis on security may come at the cost of other vital considerations, such as business interests. Siddiqui highlighted potential compliance challenges arising from unclear data protection obligations and questioned the bill's impact on small businesses and non-digital setups.

Privacy Rights and Data Localisation: A Civil Liberties Perspective

Zainab Durrani returned to discuss privacy rights and data localisation, emphasizing that privacy is a fundamental right enshrined in the Constitution. She questioned the practicality of data localisation and expressed concerns about the lack of transparency surrounding government agencies' data storage practices. The autonomy of the proposed commission and the need for clarity in definitions were highlighted as crucial aspects for effective implementation.

Striking a Balance

While the introduction of data protection laws in Pakistan is a critical step forward, the controversy surrounding the recently approved cybersecurity laws underscores the importance of inclusive processes and transparent consultations. Without addressing concerns related to transparency, ambiguity, and potential negative impacts on industry, investment, and civil liberties, the effectiveness of these laws could be compromised. The call to "do it once, but do it right" serves as a reminder of the necessity to ensure comprehensive and balanced data protection legislation that benefits all stakeholders involved.