On Wednesday, the federal cabinet approved two pieces of legislation that are expected to have a widespread impact on the digital rights of individuals, as well as the country’s ecommerce and digital economy. The E-Safety Bill 2023 and the Personal Data Protection Bill 2023 were given principle approval by the cabinet, which also okayed the establishment of a commission to enforce the latter. While the stated objectives behind these developments make sense, there are serious concerns regarding overreach and problematic implementation that could impede the growth of the IT sector and violate democratic norms.
As per the official statement, the data protection bill aims to protect user data and prevent the illegal use of information systems. This bill will ensure the protection and prevent the unauthorised use of consumers’ data on all types of online services, e.g. online shopping, as well as data provided to various companies and social networking websites in Pakistan. All of this is well and good, considering the many cases of private data being misused or leaked.
However, international bodies have expressed their concerns stating that it would raise the cost of doing business in Pakistan. This is because all entities that collect or maintain data or data processors “digitally or non-digitally” operational in Pakistan, will have to register themselves locally and will also be required to appoint a data protection officer. The Asia Internet Coalition (AIC) has pointed out that the bill in its current form falls short of international standards for data protection and creates unnecessary complexities that will increase the cost of doing business and dampen foreign investment. The AIC believes that this bill will limit Pakistanis’ access to many global digital services, and will create additional barriers to digital trade at a critical time, when Pakistan’s economic growth demands paramount attention.
The E-Safety bill on the other hand aims to prevent crimes such as online harassment, cyber bullying, blackmailing, and envisions the creation of a new regulatory authority, known as ‘The E-Safety Authority’. The first part of the bill makes sense, but it is the setting up of this authority that could be problematic. This authority will apparently be responsible for registering and monitoring websites, web channels, YouTube channels, and the existing websites of media houses. There is room for misuse here and raises concerns regarding free speech, as online YouTube channels have already been targeted in the recent past.
These are important issues that the regulators are working on, but it is crucial to undertake more transparent stakeholder consultations over the matter in light of the concerns that have been raised.