Pakistan needs to press pause on its data overhaul
Pakistan’s government appears poised to push through onerous data regulations that will put the country’s tech industry under strain—and raise concerns for consumers. On July 26, Pakistani media reported that the country’s cabinet had approved the draft Personal Data Protection Bill 2023, signaling that parliament is likely to pass the legislation before its term ends in August. In addition, the cabinet approved the E-Safety Bill 2023, which is also expected to move through parliament in the coming days. While the data protection legislation has been in the works for several years, the sudden movement of the draft legislation has caught both industry and civil society by surprise, especially since there has been little engagement with stakeholders on the legislation in the past few weeks.
Earlier this year, our team at the Atlantic Council’s Pakistan Initiative discussed these issues with stakeholders in Pakistan’s technology sector, including members of digital rights groups, local technology businesses and industry associations, and global technology companies operating in Pakistan.
As I wrote in April, a key takeaway from these conversations was that Islamabad should abandon “arbitrary actions and rulemaking” and follow a “more constructive, transparent, and collaborative approach to drafting legislation.” Unfortunately, Pakistan’s government has not followed such a process, with the US Chamber of Commerce saying on July 21 that “industry did not receive an invitation for comments” on the latest draft that the cabinet just approved. This sentiment is shared by digital rights advocates and representatives of domestic technology companies in Pakistan whom I have spoken with in the last day.
Pakistan’s technology sector is a bright spot within a rather bleak economic outlook, but passing legislation like the current draft of the bill will only weaken the sector…
Another key recommendation from stakeholders in our April issue brief was that “policy must balance the need to regulate with avoiding the imposition of onerous compliance costs on the technology ecosystem.” This is especially true in the context of domestic technology companies, in particular those looking to scale and export their services, thereby helping earn scarce foreign exchange for Pakistan. The draft legislation ignores this recommendation as well, potentially increasing compliance costs and generating headwinds that will slow down the growth of the country’s burgeoning technology sector.
Some of the specific concerns voiced by stakeholders whom I have spoken with around the latest draft of the legislation revolve around broad definitions for categories of data, including critical and sensitive personal data. In addition, the scope and applicability of the legislation has also raised concerns, and the requirements for cross-border data flows and data localization are expected to create significant challenges for the technology ecosystem. Finally, the composition and powers of the National Commission for Personal Data Protection has also raised eyebrows.
Commenting on Section 32 of the draft legislation, which provides for mandatory access to “sensitive personal data” by the Government of Pakistan, the US Chamber of Commerce wrote that the “requirement is inconsistent with the Government of Pakistan’s goal of protecting the personal data of individuals and guaranteeing their fundamental right to privacy under Article 14 of the Constitution of Pakistan.” In addition, including this section is likely to “lead to the conclusion under global privacy law norms that the [Personal Data Protection Bill] is not adequate and therefore likely to hamper data transfers into Pakistan.”
Data localization requirements are also expected to create challenges for both domestic and international technology companies operating in Pakistan. Jeff Paine, managing director of the Asia Internet Coalition, stated on July 26 that this requirement “will limit Pakistanis’ access to many global digital services.” In addition, Paine stated that the legislation “creates unnecessary complexities that will increase the cost of doing business and dampen foreign investment.”
Stakeholders have long agreed that legislation and regulation governing the technology ecosystem in Pakistan is necessary. The current draft legislation, however, falls significantly short of stakeholders’ expectations.
Pakistan’s technology sector is a bright spot within a rather bleak economic outlook, but passing legislation like the current draft of the bill will only weaken the sector—and, by extension, the broader economy. Lawmakers ought to reconsider their plans to approve this legislation and, instead, hit the pause button. Then, they should seek to address pressing concerns and make necessary amendments to this draft in an inclusive and transparent manner. Such a process will ensure that once elections are held in Pakistan in the coming months, a new government can debate and pass legislation that has the buy-in of key stakeholders, especially those from within the country’s technology ecosystem.
Uzair Younus is the director of the Pakistan Initiative at the Atlantic Council’s South Asia Center.
Further reading
Mon, Oct 3, 2022
Pakistan sees growing culture of innovation amid tech startup boom
Report By
A tightening global macro environment coupled with increasing domestic political instability is a cause of concern for the sector, especially the domestic startup economy.
Mon, Apr 17, 2023
Pakistan’s rapidly digitizing society requires clear policymaking
Issue Brief By Uzair Younus
This issue brief provides recommended steps that policymakers in Pakistan ought to take to address key concerns around free expression on the internet, and to generate momentum to catalyze higher levels of growth in Pakistan’s technology ecosystem.
Thu, May 18, 2023
A conversation on the transformational potential of decentralized and distributed technologies for Pakistan
SouthAsiaSource By
Uzair Younus talks to Amir Husain, founder and chief executive officer of SparkCognition, about current and emerging trends, what countries like Pakistan can do to take advantage of seismic advances in technology, and how individuals can better prepare themselves for the future.
Image: A general view of a building illuminated with the colors of the national flag, during Pakistan's Independence Day celebrations in Karachi, Pakistan August 14, 2020.