Illegal processing of personal data may lead to 5 million rupees fine & 2 years of imprisonment

The Ministry of Information and Technology has written the Personal Data Protection Bill 2018 and it also contains the severe consequences of retrieving someone’s data unlawfully or modifying it. Imprisonment of two years and a fine of Rs. 5 million to be imposed is suggested in the bill.

As per the “Personal Data Protection Bill 2018,” the constitution of Islamic Republic of Pakistan ensures not the only privacy of home but also considers the dignity of every man and woman as their fundamental right Under its Article 14.
The Ministry has sought suggestions from every stakeholder on proposed legislation.

The bill objectives state that digitization of businesses and other public services that comprise of latest computing technologies involves processing of personal data. The advancement of technology has made it possible to not only collect personal data but also process personal data in various ways. The report further states that in present times, personal data has become quite a valuable commodity and for a number of business the sole way to generate income is through the personal information of users that they obtain. This personal data is also being sold without the concerned person’s knowledge.
While in some cases, the data is usually used to target the right customers and advertise them the offerings of the company. But in other cases, data can also be used to blackmail someone or for phishing scams.

For realizing the goal of full scale adoption of e-government and delivery of services and to enhance confidence of users in the confidentiality and integrity of government databases, it is critical that the users’ data is protected from any sort of unauthorized access apart from provision of remedies to them against any kind of processing of their personal data.
Furthermore, an upsurge in the users of broadband due to the arrival of 3G/4G in Pakistan led to an increase in reliance on technology.

This clearly calls for protection of people’s data against any misuse thus leading to their confidence on using of technologies fearlessly. Sectoral arrangements are operating in Pakistan and are working towards protecting data of citizens and prevention of Electronic Crimes Act 2016 (Act No XL of 2016) that deal with crimes concerning unauthorized access of data. A need arises for a comprehensive legal framework that is in sync with the Constitution and best practices for personal data protection.

The framework would clearly highlight the responsibilities of data collectors and processors and the institutional provisions for the regulation of activities regarding the collection and processing of data, as stated in the Bill.

Anyone who is involved in processing personal data including dissemination and disclosing of personal data will be subjected to 5 million fine and two years in jail. Furthermore, anyone who has possession of users data and fails to provide necessary data security measures needed to ensure data security will be subjected to one million rupees fine. Anyone who fails to comply with the orders of commission or court will be responsible to pay a fine worth five hundred thousand rupees.

Within a time frame of six months after the proposed bill is in effect, the Federal Government shall form a Commission for Personal data protection.