New laws to fight cybercrime in Pakistan: Cabinet passes e-safety and data protection bills

In a significant development, the federal cabinet of Pakistan granted principle approval to two crucial pieces of legislation on Wednesday, which are expected to have a far-reaching impact on digital rights, e-commerce, and the digital economy of the country.

The first bill, named the E-Safety Bill 2023, aims to tackle and prevent online crimes such as cyberbullying, online harassment, and blackmailing. To enforce the provisions of this bill, the cabinet also greenlit the establishment of a regulatory authority known as ‘The E-Safety Authority.’ This authority will be responsible for registering and monitoring websites, web channels, YouTube channels, and existing media houses’ websites. The main objective behind this initiative is to safeguard the rights of citizens, businesses, as well as public and private institutions from online harassment and blackmail.

Presently, the Pakistan Telecommunication Authority (PTA) has the authority to monitor content and enforce relevant laws online, while the Federal Investigation Agency (FIA) handles cybercrime-related cases. However, the proposed E-Safety Authority will take charge of the front-end monitoring of all websites, promptly addressing violations and imposing penalties. This measure is deemed necessary due to the rapid pace at which cybercrime incidents occur, often exceeding the FIA’s investigative capacity, while the PTA’s role is primarily limited to regulatory functions for internet and telecom service providers.

According to Dawn, the second bill, titled the Personal Data Protection Bill 2023, focuses on protecting user data and preventing the unauthorised use of information systems. The bill will apply to all types of online services, including online shopping platforms, various companies, and social networking websites operating in Pakistan. It aims to safeguard consumers’ data and ensure that it is not misused or illegally accessed.

As per the official statement, “personal data” under the proposed legislation refers to any information directly or indirectly related to an identifiable individual, encompassing sensitive or critical personal data. The bill mandates all entities collecting or maintaining data, digitally or non-digitally operational in Pakistan, to register themselves locally and appoint a data protection officer. The National Commission for Personal Data Protection (NCPDP) will oversee the registration process and will establish sub-offices in provincial capitals and other necessary locations within six months of the bill’s passage.

However, the approval of the Personal Data Protection Bill 2023 has raised concerns among international bodies representing internet-based platforms. The Asia Internet Coalition (AIC), through its Managing Director Jeff Paine, highlighted that the bill’s current form falls short of international data protection standards and imposes unnecessary complexities that may increase the cost of doing business and hinder foreign investment. The requirement for “critical” data to be stored locally and the restriction on cross-border transfer of other personal data could potentially limit access to global digital services for Pakistanis.

In response to these concerns, the AIC has called for more transparent stakeholder consultations by the government. Digital rights campaigner and Meta board member, Nighat Dad, expressed similar sentiments, stating that while the bill addresses important issues, the lack of consultations is undemocratic.

Despite concerns from international bodies, an official from the IT ministry defended the legislation, emphasising that the government’s primary responsibility is to protect Pakistan’s interests and its citizens. He asserted that commercial entities’ apprehensions are primarily driven by their business concerns.

The approval of these significant bills marks a crucial step towards enhancing digital rights and data protection in Pakistan. As the nation progresses into a more digitally interconnected era, finding a balanced approach that addresses concerns from both local and international stakeholders will be crucial for the country’s digital economy and growth.