Pakistan has zero laws on Data Protection or Privacy. On the contrary we have many laws that seek to intrude upon the privacy of individuals and gather data. The right to privacy has been enshrined as a fundamental right under the Constitution pf Pakistan 1973. Article 14 of the Constitution of Pakistan 1973 provides that the dignity of man and subject to law, the privacy of home, shall be inviolable. Since the year 2000 when the National Database and Registration Authority (NADRA) was established all personal data of the citizens of Pakistan has been centralized and compiled by the data warehouses of NADRA. Section 7 (j) of the NADRA Ordinance 2000 provides that NADRA shall ensure due security , secrecy and necessary safeguards for protection and confidentiality of data and information contained or dealt with by the National Data Warehouses at individual and collective level. Section 29 of the NADRA Ordinance 2000 expressly provides that no person shall be allowed to extract and use any of the information contained in the data warehouses of NADRA. Extraction and use of the information shall be punishable by fourteen years of imprisonment.
The reality is totally to the contrary; the government and law enforcement agencies of Pakistan obtain information from NADRA as and when they require. It would have been better if the NADRA Ordinance contained a mechanism and rationale for the provision of the information to the Government or law enforcement agencies. In the absence of any such mechanism or rationale for obtaining of information, any obtaining and subsequent usage of the information by any person would actually be contrary to Sections 7 (j) and 25 of the NADRA Ordinance 2000. On the other hand we have laws such as the Anti-Terrorism Act 1997, the Free Trial Act 2013 and the Protection of Pakistan Act 2014 which provide the security agencies of Pakistan with sweeping powers for surveillance and gathering of information on individuals.
Personal data is not only used by law enforcement agencies in Pakistan in fact the same is also obtained and used for persons seeking employment. From sending your CV to an organization to starting employment with the organization no law exists which can bar the organization from using a person’s information as and how they wish to use the same.
Information related to a person’s address, his telephone number, his age, his religious beliefs, his ethnic background are considered personal all over the world. Even websites when requiring this information from an individual clarify the requirement and usage of such information. Privacy and confidentiality with regard to the right to personal information is guarded throughout the world. Countries such as UK have strict Data Protection Laws.
For now in Pakistan the only relief available to people will be filing a constitutional petition under Article 199 of the Constitution of Pakistan 1973 seeking protection of information under section 7 (j) and 25 of the NADRA Ordinance 2000. This is also something which the Supreme Court can take up under Article 184 (3) of the Constitution of Pakistan 1973 and perhaps seek to increase the ambit of Article 14 OR rely on the relevant provisions of the Prevention o Electronic Crimes Act 2016 which provides for protection and usage of data of Pakistani citizens by every person other than the Government of Pakistan itself. With the Covid-19 scenario circulation of personal information of patients becomes even more unethical.
The above does not constitute legal advice and is protected by Copyright. (c) Yousaf Amanat & Associates 2020.
