• E-Safety bill envisions creation of new regulator to register websites, YouTube channels
• Data protection bill calls on internet, social media companies to comply with local rules

ISLAMABAD: Two pieces of legislation approved by the federal cabinet on Wednesday are expected to have a widespread impact on the digital rights of individuals, as well as country’s ecommerce and digital economy.

The E-Safety Bill 2023 and the Personal Data Protection Bill 2023 were given principle appro­val by the cabinet, which also okayed the establishment of a commission to enforce the latter.

However, international bodies representing internet-based platforms have expressed concerns over the draft data protection law, fearing that it would raise the cost of doing business in Pakistan.

The data protection bill, as per an official statement, aims to protect user data and prevent the illegal use of information systems. It would ensure the protection and prevent the unauthorised use of consumers’ data on all types of online services, e.g. online shopping, as well as data provided to various companies and social networking websites in Pakistan.

The E-Safety bill aims to prevent crimes such as online harassment, cyber bullying, blackmailing, and envisions the creation of a new regulatory authority will be established, known as ‘The E-Safety Authority’. This will ostensibly be responsible for registering and monitoring websites, web channels, YouTube channels, and the existing websites of media houses.

A senior official of the IT ministry told Dawn that the idea behind establishing the E-Safety Authority was to protect the rights of citizens, businesses as well as both public and private institutions from online harassment and blackmail.

Currently, the PTA has the power to monitor content and check back-end enforcement of relevant laws online at websites, whereas the FIA enforces cybercrime laws. The proposed E-Safety authority, however, will monitor the front-end of all websites, take notice of violations and even impose penalties.

“This was essential, as cybercrime cases occur at a much faster pace than FIA can investigate them, while the role of PTA is limited to regulatory functions and violations related to internet and telecom service providers,” the official said.

The new authority will also have the power to grant licences to websites, including web channels, and will even regulate existing news and media website.

Data protection

The draft data protection law will govern the privacy of data collected by various online services, digital platforms, e-commerce websites and even news and entertainment websites etc.

The bill defines “personal data” as any information that relates directly or indirectly to a subject, who is identified or identifiable from that information, including any sensitive or critical personal data.

However, anonymised, or pseudonymised data is not considered “personal data” in light of the proposed bill.

Under this legislation, all entities that collect or maintain data or data processers “digitally or non-digitally” operational in Pakistan, will have to register themselves locally and will also be required to appoint a data protection officer.

The registration function will be carried out by a National Commission for Personal Data Protection (NCPDP), which is to be established within six months of the passage of the bill. This commission may set up its sub-offices in provincial capitals and other places, as it may deem necessary from time to time. The bill, which first appeared in the form of the ‘Protection of Personal Data Bill 2021’, was earlier granted approval by the Imran Khan-led cabinet in February 2022.

Concerns

After it was reported that the bill had received cabinet assent, the Asia Internet Coalition (AIC) issued a statement highlighting concerns regarding the data protection bill.

Issued by AIC Managing Director Jeff Paine, the statement points out that in its current form, the bill falls short of international standards for data protection and creates unnecessary complexities that will increase the cost of doing business and dampen foreign investment.

“By requiring unspecified ‘critical’ data to be stored locally and through significantly restricting the cross-border transfer of all other personal data, the bill will limit Pakistanis’ access to many global digital services,” Mr Paine said.

He said the bill creates additional barriers to digital trade at a critical time, when Pakistan’s economic growth demands paramount attention.

The AIC has called on the government to undertake more transparent stakeholder consultations over this subject.

Digital rights campaigner and Meta board member, Nighat Dad, told Dawn that while the subject the bill dealt with was very important, there had not been any consultations over it. “This secretive style is undemocratic.”

However, an IT ministry official said it was its responsibility to protect the interests Pakistan and Pakistanis, whereas commercial entities were only worried about their businesses.

Published in Dawn, July 27th, 2023