The Ministry of Information Technology and Telecommunication has finalized the Personal Data Protection Bill, 2021. Once the Ministry of Law vets it, the bill will be approved.
The proposed legislation proposes fines of up to Rs. 25 million for violators. People who process or reveal personal data or have caused either of those things are included here.
Why it matters: In the digital era, personal data is precious. It is frequently collected and sometimes sold without the owner’s knowledge.
Primarily the data collected is used for commercial purposes like targeted advertising. However, there is still a chance of this data being misused for blackmailing, phishing scams, etc.
The protection bill will ensure that individuals’ private data is protected and not collected without their consent. Trust in new technologies is vital to Digital Pakistan’s development.
What it says: The proposed legislation will:
- govern the collection, processing, use, and disclosure of personal data.
- make arrangements to address the offenses related to the violation of an individual’s right to privacy of their data.
- provide for the processing and disclosure of data while respecting the rights, freedom, and dignity of the person.
Additionally, a data controller will only process personal data if the person consents to it.
Tell me more: There are some cases in which the data controller can process data without the formal consent of the concerned person. Like:
- executing the contract which that person is a part of.
- agreement with any legal obligation to which the data controller is subject to.
- to preserve the vital interests of the concerned person.
- legitimate cases proceeded by the data controller.
- the operation of any functions presented on any person by or under any law.
- department of justice can get the data processed according to an order of the court of competent jurisdiction.
Personal information will not be processed unless:
- it is being processed for a legitimate purpose that is directly related to an action of the data controller.
- the processing is crucial for or directly related to that purpose.
Zoom Out: Despite being drafted in 2017, the Data Protection Bill kept getting delayed.
The ministry’s draft proposed earlier this year was termed vague by the Asia Internet Coalition (AIC). Pakistan’s Digital Rights Organisations also submitted feedback on the bill to the government.
