Pakistan has zero laws on Data Protection or Privacy. On the contrary we have many laws that seek to intrude upon the privacy of individuals and gather data. The right to privacy has been enshrined as a fundamental right under the Constitution pf Pakistan 1973. Article 14 of the Constitution of Pakistan 1973 provides that the dignity of man and subject to law, the privacy of home, shall be inviolable.
Since the year 2000 when the National Database and Registration Authority (NADRA) was established, all personal data of the citizens of Pakistan has been centralized and compiled by the data warehouses of NADRA. Section 7 (j) of the NADRA Ordinance 2000 provides that NADRA shall ensure due security , secrecy and necessary safeguards for protection and confidentiality of data and information contained or dealt with by the National Data Warehouses at individual and collective level. Section 29 of the NADRA Ordinance 2000 expressly provides that no person shall be allowed to extract and use any of the information contained in the data warehouses of NADRA. Extraction and use of the information shall be punishable by fourteen years of imprisonment.
The reality is totally to the contrary; the government and security agencies of Pakistan obtain information from NADRA as and when they require. It would have been better if the NADRA Ordinance contained a mechanism and rationale for the provision of the information to the Government or security agencies. In the absence of any such mechanism or rationale for obtaining of information, any obtaining and subsequent usage of the information by any person would actually be contrary to Sections 7 (j) and 25 of the NADRA Ordinance 2000. On the other hand we have laws such as the Anti-Terrorism Act 1997, the Free Trial Act 2013 and the Protection of Pakistan Act 2014 which provide the security agencies of Pakistan with sweeping powers for surveillance and gathering of information on individuals.
Personal data is not only used by security agencies in Pakistan in fact the same is also obtained and used for persons seeking employment. From sending your CV to an organization to starting employment with the organization no law exists which can bar the organization from using a person’s information as and how they wish to use the same.
Information related to a person’s address, his telephone number, his age, his religious beliefs, his ethnic background are considered personal all over the world. Even websites when requiring this information from an individual clarify the requirement and usage of such information. Privacy and confidentiality with regard to the right to personal information is guarded throughout the world.
The following is a requirement which needs to be complied with by the Government of UK under the Data Protection Act of UK:
“have legitimate grounds for collecting and using the personal data; not use the data in ways that have unjustified adverse effects on the individuals concerned; be transparent about how you intend to use the data, and give individuals appropriate privacy notices when collecting their personal data; handle people’s personal data only in ways they would reasonably expect; and make sure you do not do anything unlawful with the data.”
The Data Protection of UK does however make exemptions for obtaining and use of data. Such instances are where the same is required for purposes of national security and for court proceedings. In the case of the former however the individual whose information is being obtained can challenge this decision before a Tribunal under the Act.
The Personal Data Protection Bill 2013 of India goes a step further than the Data Protection Act of UK and directs Intelligence Agencies to maintain only that personal data of individuals as is necessary and to delete it after its usage has been completed. Further the Bill lays down guidelines for limiting the circulation of the information and the extent to which it is copied. The Bill further constitutes a Data Protection Authority which is headed by a retired judge of the Supreme Court. The Data Protection Authority may take suo moto on the petition of an individual can inquire and decide on matters relating to gathering and usage of personal information.
There is a strong need in Pakistan for regulating the storage and usage of personal data. Information contained in CNICs and passports needs to be safeguarded and regulated as does personal information submitted during the course of employment. There is also a need for regulating information circulated over the internet in Pakistan. Ideally a totally new law on data protection should be framed or if this cannot be done then at least the NADRA Ordinance should be amended to regulate the obtaining and usage of personal data. For now the only relief available to people will be filing a constitutional petition under Article 199 of the Constitution of Pakistan 1973 seeking protection of information under section 7 (j) and 25 of the NADRA Ordinance 2000. This is also something which the Supreme Court can take up under Article 184 (3) of the Constitution of Pakistan 1973 and perhaps seek to increase the ambit of Article 14.
Matters regarding surveillance and data usage will get an indirect legal cover with the Supreme Court having dismissed Petitions challenging the 21st amendment. Whereas the example of the United States can be cited, when military courts were established after 9/11, it also needs to be mentioned that the United States has developed wide laws on data usage and protection.
Data Protection is a much neglected area of legislation in Pakistan. Whereas case law exists to an extent on the legal usage of surveillance in gathering information no case law exists on the protection of the data collected. Presently in Pakistan laws favoring data usage, surveillance and infringement of privacy clearly outweigh laws allowing people due process of law which is in fact their fundamental right. There needs to be a balance between laws.
The writer is a practicing Advocate of the High Court of Pakistan and can be reached at: yousaf@yaa.com.pk
Since the year 2000 when the National Database and Registration Authority (NADRA) was established, all personal data of the citizens of Pakistan has been centralized and compiled by the data warehouses of NADRA. Section 7 (j) of the NADRA Ordinance 2000 provides that NADRA shall ensure due security , secrecy and necessary safeguards for protection and confidentiality of data and information contained or dealt with by the National Data Warehouses at individual and collective level. Section 29 of the NADRA Ordinance 2000 expressly provides that no person shall be allowed to extract and use any of the information contained in the data warehouses of NADRA. Extraction and use of the information shall be punishable by fourteen years of imprisonment.
Security agencies obtain information from NADRA as and when they require
The reality is totally to the contrary; the government and security agencies of Pakistan obtain information from NADRA as and when they require. It would have been better if the NADRA Ordinance contained a mechanism and rationale for the provision of the information to the Government or security agencies. In the absence of any such mechanism or rationale for obtaining of information, any obtaining and subsequent usage of the information by any person would actually be contrary to Sections 7 (j) and 25 of the NADRA Ordinance 2000. On the other hand we have laws such as the Anti-Terrorism Act 1997, the Free Trial Act 2013 and the Protection of Pakistan Act 2014 which provide the security agencies of Pakistan with sweeping powers for surveillance and gathering of information on individuals.
Personal data is not only used by security agencies in Pakistan in fact the same is also obtained and used for persons seeking employment. From sending your CV to an organization to starting employment with the organization no law exists which can bar the organization from using a person’s information as and how they wish to use the same.
Information related to a person’s address, his telephone number, his age, his religious beliefs, his ethnic background are considered personal all over the world. Even websites when requiring this information from an individual clarify the requirement and usage of such information. Privacy and confidentiality with regard to the right to personal information is guarded throughout the world.
The same is true for those seeking employment
The following is a requirement which needs to be complied with by the Government of UK under the Data Protection Act of UK:
“have legitimate grounds for collecting and using the personal data; not use the data in ways that have unjustified adverse effects on the individuals concerned; be transparent about how you intend to use the data, and give individuals appropriate privacy notices when collecting their personal data; handle people’s personal data only in ways they would reasonably expect; and make sure you do not do anything unlawful with the data.”
The Data Protection of UK does however make exemptions for obtaining and use of data. Such instances are where the same is required for purposes of national security and for court proceedings. In the case of the former however the individual whose information is being obtained can challenge this decision before a Tribunal under the Act.
Information contained in CNICs and passports needs to be safeguarded
The Personal Data Protection Bill 2013 of India goes a step further than the Data Protection Act of UK and directs Intelligence Agencies to maintain only that personal data of individuals as is necessary and to delete it after its usage has been completed. Further the Bill lays down guidelines for limiting the circulation of the information and the extent to which it is copied. The Bill further constitutes a Data Protection Authority which is headed by a retired judge of the Supreme Court. The Data Protection Authority may take suo moto on the petition of an individual can inquire and decide on matters relating to gathering and usage of personal information.
There is a strong need in Pakistan for regulating the storage and usage of personal data. Information contained in CNICs and passports needs to be safeguarded and regulated as does personal information submitted during the course of employment. There is also a need for regulating information circulated over the internet in Pakistan. Ideally a totally new law on data protection should be framed or if this cannot be done then at least the NADRA Ordinance should be amended to regulate the obtaining and usage of personal data. For now the only relief available to people will be filing a constitutional petition under Article 199 of the Constitution of Pakistan 1973 seeking protection of information under section 7 (j) and 25 of the NADRA Ordinance 2000. This is also something which the Supreme Court can take up under Article 184 (3) of the Constitution of Pakistan 1973 and perhaps seek to increase the ambit of Article 14.
Matters regarding surveillance and data usage will get an indirect legal cover with the Supreme Court having dismissed Petitions challenging the 21st amendment. Whereas the example of the United States can be cited, when military courts were established after 9/11, it also needs to be mentioned that the United States has developed wide laws on data usage and protection.
Data Protection is a much neglected area of legislation in Pakistan. Whereas case law exists to an extent on the legal usage of surveillance in gathering information no case law exists on the protection of the data collected. Presently in Pakistan laws favoring data usage, surveillance and infringement of privacy clearly outweigh laws allowing people due process of law which is in fact their fundamental right. There needs to be a balance between laws.
The writer is a practicing Advocate of the High Court of Pakistan and can be reached at: yousaf@yaa.com.pk