The Firm recently advised a large international development sector organization on the legalities surrounding the possession, obtaining, storage and transmission of Identity Data of citizens of Pakistan. Although Pakistan has yet to enact a Data Protection Law, however the Prevention of electronic Crimes Act 2016 amongst other matters also provides for Data Protection. Under the Act, data can only be obtained and transmitted with the consent of the the owner of the data. In the case of Identity Data this would mean that the permission of the citizen to whom the data belongs to must be obtained.
