Global Digital Media Giants Raise Concerns Over Pakistan’s Data Protection Bill 2023

The Asia Internet Coalition (AIC), comprising prominent global digital media giants, has raised serious concerns over Pakistan’s Draft Data Protection Bill 2023. In a letter addressed to Amin ul Haque, the Federal Minister for Information Technology and Telecommunication, Jeff Paine, the Managing Director of AIC, highlighted several issues that the current bill fails to address adequately. The AIC believes that these concerns could have a detrimental impact on foreign internet companies’ ability to operate in Pakistan, hindering the country’s economic recovery and deterring foreign investment. Moreover, local Pakistani companies may face challenges accessing cost-efficient global cloud services, making them less competitive and incurring substantial costs to maintain servers.

The key issues raised by AIC in their recommendations on the Draft Personal Data Protection Bill 2023 are as follows:

1. Data Localisation Requirement: The bill mandates that critical personal data must only be processed within Pakistan, potentially impacting private companies. The broad definition of critical personal data may create obstacles for businesses.
2. Sharing Sensitive Personal Data: The bill introduces a requirement to share sensitive personal data with the Government, raising concerns about data privacy and potential misuse.
3. Age of a Child: AIC proposes that the age of a child under the bill should be set at thirteen instead of eighteen, aligning it with international standards.
4. Maximum Fine for Breaches: The bill should define a set maximum fine payable for breaches, ensuring clarity and fairness in penalties.

Jeff Paine emphasized that the current Draft Bill falls short of international standards for data protection, such as the General Data Protection Regulation (GDPR), and may adversely impact both Pakistani consumers and businesses. AIC believes that the provisions related to stringent limitations on cross-border data flows and mandatory data localization, as well as the vague definitions of sensitive personal data and critical personal data, need further refinement.

While acknowledging the importance of personal data protection, AIC highlighted that such policies should not hinder innovation and technological advancement. The organization appreciates the Government of Pakistan’s efforts in developing national personal data protection policies but insists on addressing the concerns raised, especially regarding the cross-border transfer of critical and sensitive personal data.

AIC has requested an industry meeting to facilitate a better understanding of the stakeholders’ views and priorities. The organization also seeks opportunities for consultation to assist the Government in fine-tuning the Personal Data Protection Bill 2023. They have offered to arrange a video conference meeting at a mutually convenient date and time to discuss potential areas of collaboration and further support the government’s review of the bill.