Pakistan needs to press pause on its data overhaul – Atlantic Council

Our programs and centers deliver in-depth, highly relevant issue briefs and reports that break new ground, shift opinions, and set agendas on public policy, with a focus on advancing debates by integrating foundational research and analysis with concrete policy solutions.
When major global news breaks, the Atlantic Council’s experts have you covered—delivering their sharpest rapid insight and forward-looking analysis direct to your inbox.
New Atlanticist is where top experts and policymakers at the Atlantic Council and beyond offer exclusive insight on the most pressing global challenges—and the United States’ role in addressing them alongside its allies and partners.
A weekly column by Atlantic Council President and CEO Frederick Kempe, Inflection Points focuses on the global challenges facing the United States and how to best address them.
UkraineAlert is a comprehensive online publication that provides regular news and analysis on developments in Ukraine’s politics, economy, civil society, and culture. UkraineAlert sources analysis and commentary from a wide-array of thought-leaders, politicians, experts, and activists from Ukraine and the global community.
MENASource offers the latest news from across the Middle East, combined with commentary by contributors, interviews with emerging players, multi-media content, and independent analysis from fellows and staff.
IranSource provides a holistic look at Iran’s internal dynamics, global and regional policies, and posture through unique analysis of current events and long-term, strategic issues related to Iran.
{{ searchResult.post_type }}

{{ }}
{{ }}

New Atlanticist
July 26, 2023
By Uzair Younus
Pakistan’s government appears poised to push through onerous data regulations that will put the country’s tech industry under strain—and raise concerns for consumers. On July 26, Pakistani media reported that the country’s cabinet had approved the draft Personal Data Protection Bill 2023, signaling that parliament is likely to pass the legislation before its term ends in August. In addition, the cabinet approved the E-Safety Bill 2023, which is also expected to move through parliament in the coming days. While the data protection legislation has been in the works for several years, the sudden movement of the draft legislation has caught both industry and civil society by surprise, especially since there has been little engagement with stakeholders on the legislation in the past few weeks.
Earlier this year, our team at the Atlantic Council’s Pakistan Initiative discussed these issues with stakeholders in Pakistan’s technology sector, including members of digital rights groups, local technology businesses and industry associations, and global technology companies operating in Pakistan. 
As I wrote in April, a key takeaway from these conversations was that Islamabad should abandon “arbitrary actions and rulemaking” and follow a “more constructive, transparent, and collaborative approach to drafting legislation.” Unfortunately, Pakistan’s government has not followed such a process, with the US Chamber of Commerce saying on July 21 that “industry did not receive an invitation for comments” on the latest draft that the cabinet just approved. This sentiment is shared by digital rights advocates and representatives of domestic technology companies in Pakistan whom I have spoken with in the last day.
Another key recommendation from stakeholders in our April issue brief was that “policy must balance the need to regulate with avoiding the imposition of onerous compliance costs on the technology ecosystem.” This is especially true in the context of domestic technology companies, in particular those looking to scale and export their services, thereby helping earn scarce foreign exchange for Pakistan. The draft legislation ignores this recommendation as well, potentially increasing compliance costs and generating headwinds that will slow down the growth of the country’s burgeoning technology sector.
Some of the specific concerns voiced by stakeholders whom I have spoken with around the latest draft of the legislation revolve around broad definitions for categories of data, including critical and sensitive personal data. In addition, the scope and applicability of the legislation has also raised concerns, and the requirements for cross-border data flows and data localization are expected to create significant challenges for the technology ecosystem. Finally, the composition and powers of the National Commission for Personal Data Protection has also raised eyebrows.
Commenting on Section 32 of the draft legislation, which provides for mandatory access to “sensitive personal data” by the Government of Pakistan, the US Chamber of Commerce wrote that the “requirement is inconsistent with the Government of Pakistan’s goal of protecting the personal data of individuals and guaranteeing their fundamental right to privacy under Article 14 of the Constitution of Pakistan.” In addition, including this section is likely to “lead to the conclusion under global privacy law norms that the [Personal Data Protection Bill] is not adequate and therefore likely to hamper data transfers into Pakistan.”
Data localization requirements are also expected to create challenges for both domestic and international technology companies operating in Pakistan. Jeff Paine, managing director of the Asia Internet Coalition, stated on July 26 that this requirement “will limit Pakistanis’ access to many global digital services.” In addition, Paine stated that the legislation “creates unnecessary complexities that will increase the cost of doing business and dampen foreign investment.”
Stakeholders have long agreed that legislation and regulation governing the technology ecosystem in Pakistan is necessary. The current draft legislation, however, falls significantly short of stakeholders’ expectations.
Pakistan’s technology sector is a bright spot within a rather bleak economic outlook, but passing legislation like the current draft of the bill will only weaken the sector—and, by extension, the broader economy. Lawmakers ought to reconsider their plans to approve this legislation and, instead, hit the pause button. Then, they should seek to address pressing concerns and make necessary amendments to this draft in an inclusive and transparent manner. Such a process will ensure that once elections are held in Pakistan in the coming months, a new government can debate and pass legislation that has the buy-in of key stakeholders, especially those from within the country’s technology ecosystem.
Uzair Younus is the director of the Pakistan Initiative at the Atlantic Council’s South Asia Center.
Mon, Oct 3, 2022
Report By Hamna Tariq and Uzair Younus
A tightening global macro environment coupled with increasing domestic political instability is a cause of concern for the sector, especially the domestic startup economy.
Mon, Apr 17, 2023
Issue Brief By Uzair Younus
This issue brief provides recommended steps that policymakers in Pakistan ought to take to address key concerns around free expression on the internet, and to generate momentum to catalyze higher levels of growth in Pakistan’s technology ecosystem.
Thu, May 18, 2023
SouthAsiaSource By Amir Husain and Uzair Younus
Uzair Younus talks to Amir Husain, founder and chief executive officer of SparkCognition, about current and emerging trends, what countries like Pakistan can do to take advantage of seismic advances in technology, and how individuals can better prepare themselves for the future.
Image: A general view of a building illuminated with the colors of the national flag, during Pakistan’s Independence Day celebrations in Karachi, Pakistan August 14, 2020.
© 2023 Atlantic Council
All rights reserved.


Leave a Reply

Your email address will not be published. Required fields are marked *

Back To Top