Pakistan data protection bill approaches vote and draws criticism from Privacy International

Pakistan’s legislature is considering a data protection bill that defines biometrics as “sensitive personal data” and mandates the creation of a regulatory framework for special permissions relating to biometric data.

Privacy International (PI) says the bill contains “vague exceptions allowing the government to evade responsibility and deny individuals’ ability to exercise their rights to access their data and submit a complaint,” and would not grant the data protection authority sufficient independence to enforce the law. The bill also contains a data localization clause, which the rights group calls part of a “worrying trend.” PI also worries that the terms “national security,” “public interest” and “legitimate interest” are doing a lot of work, despite no definition for the former and broad definitions for the latter two terms.

The draft of the Personal Data Protection Bill, 2023 received Federal Cabinet approval in late July and is headed towards votes in the National Assembly and Senate.

The version published on May 19 by the Ministry of Information Technology and Telecommunication is described as “final,” and is the latest version made available to the public, though it is not known if this is the same version approved by Cabinet.

PI says that over five years of tracking the Bill’s development, various versions have moved progressively closer to international practices and principles for data protection.

The bill would establish the National Commission for Personal Data Protection (NCPDP), which would have the creation of the compliance frameworks for biometrics, data breaches and audits, data protection impact assessments, grievance redressal and cross-border data sharing, among 15 areas. It also sets out requirements for obtaining permission to process the data of children under 18 years old, and establishes rights for people to access, correct and erase data about them.

The World Bank has commented that the draft would need to be amended to align it with global best practices.

Article Topics

biometric data  |  biometrics  |  data protection  |  legislation  |  Pakistan  |  Privacy International