Personal Data Protection Bill 2018

Although Pakistan is still new to the implementation of Cyber Law, the country is doing its best to keep up with the pace of other countries. Recently the implementation of GDPR by the European Union also had a positive impact on the Cyber Law policymakers of Pakistan, the Ministry of Information Technology and Telecommunication.

A bill is proposed to protect the Personal Data of Pakistani Citizens called Personal Data Protection Bill 2018 by the ministry itself for approval. According to this bill, "A Bill to protect people against the violation of their privacy by processing of personal data. Whereas it is expedient to provide for the processing, obtaining, holding, usage and disclosure of data relating to individuals while respecting the rights, freedoms and dignity of natural persons with special regard to their right to privacy, secrecy and personal identity and for matters connected therewith and ancillary thereto." With regards into processing, obtaining, holding, usage and disclosure of data, rights should be involved with matters by freedom and dignity and happiness.

Scope

This Act applies to—

1. any person who processes; and
2. any person who has control over or authorizes the processing of, any personal data in respect of commercial transactions.

(2) Subject to subsection

(1), this Act applies to a person in respect of personal data if—

(a) the person is established in Pakistan and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment; and

(b) the person is not established in Pakistan, but uses equipment in Pakistan for processing the personal data otherwise than for the purposes of transit through Pakistan.

(3) A person falling within clause (b) of subsection (2) shall nominate for the purposes of this Act a representative established in Pakistan.

(4) For the purposes of subsections (2) and (3), each of the following is to be treated as established in Pakistan:

(a) an individual whose physical presence in Pakistan shall not be less than one hundred and eighty days in one calendar year;

(b) a body incorporated under the Companies Act 2017 (Act XIX of 2017);

(c) a partnership or other unincorporated association formed under any written laws in Pakistan; and

(d) any person who does not fall within paragraph (a), (b) or (c) but maintains in Pakistan—

(i) an office, branch or agency through which he carries on any activity; or

(ii) a regular practice.

Punishment

According to this bill a Punishment of Up to 2 years imprisonment and up to PKR 5 Million fine maybe imposed in case of non compliance and or intentional data breach.

Execution

It is proposed that a commission will be formed withing the six months of approval of the bill. A chairman will be appointed for a term of four years who will be responsible for the implementation of this new law.

As the Ministry of IT and Telecommunication fall under the jurisdiction of the Federal Government of Pakistan; this bill once approved will be applicable through out Pakistan.