Pakistan’s Ministry of Information Technology and Telecommunication recently introduced a new draft of Pakistan’s Personal Data Protection Bill, 2020 (the “Bill”) and launched a public consultation regarding the same. The public consultation period will end on May 15, 2020. The Bill, which applies to “any person who processes” or “has control over or authorizes the processing of” any personal data, if the data subject, the controller or processor are located in Pakistan, would establish certain requirements and restrictions related to the processing of personal data, as well as penalties for violating the law. In addition, under the Bill, the federal government would, within six months of coming into force, establish a Personal Data Protection Authority of Pakistan with rulemaking authority to enforce the act.

Below is a summary of the Bill’s key provisions:

• Consent: Personal data (including sensitive data) may not be processed without consent to the processing, unless the processing is necessary for a broad list of enumerated purposes.

• Lawfulness: The processing of personal data must be: (1) for a lawful purpose directly related to an activity of the data controller; (2) necessary for or directly related to that purpose; and (3) not excessive in relation to that purpose.

• Notice: Data subjects must be provided written notice that includes certain content when the personal data of the data subject is collected by or on behalf of the data controller. This notice must be provided when the data subject is first asked to provide the data, when the data controller first collects the personal data, or before (1) the personal data is used for a purpose other than the purpose for which the data was collected or (2) the personal data is disclosed to a third party.

• Disclosure and Transfer: Data controllers may not disclose personal data without the consent of the data subject (1) for any purpose other than the purpose for which the personal data was disclosed at the time of collection or a purpose directly related to that purpose, or (2) to any third party not within the class of third parties provided within its notice. In addition, personal data may not be transferred to any unauthorized person or system.

• Cross-Border Transfers: Where necessary, data may be transferred to a country that offers at least the same amount of protection of personal data, as long as the data subject provides consent where required and the data continues to be processed in accordance with the Bill’s requirements.

• Data Localization: Critical personal data may only be processed in servers and data centers located in Pakistan.

• Data Security: Data controllers must take “practical steps to protect personal data” when collecting or processing personal data including, among other factors, taking into consideration the nature of the personal data and the harm that would result from loss, misuse, modification, or unauthorized or accidental access, disclosure, alteration or destruction. The data protection authority will prescribe standards that the data controller must comply with.

• Data Integrity: Data controllers must take reasonable steps to ensure that personal data is accurate, complete, not misleading and kept up-to-date.

• Sensitive Data: Additional limitations apply to the processing of sensitive personal data.

• Data Subject Rights: The Bill provides data subjects with the right to: (1) be informed about whether a controller has processed their personal data; (2) for a fee, make a data access request for the information being processed and to have a copy of their personal data provided to them in an intelligible form; (3) request correction of their personal data where inaccurate, incomplete, misleading or not up-to-date; (4) withdraw consent to process personal data; (5) prevent processing that is likely to cause damage or distress; and (6) erasure of their personal data when certain conditions are met.

• Breach Notification: Data controllers must notify the data protection authority within 72 hours of becoming aware of a personal data breach, unless the personal data is unlikely to result in a risk to the rights and freedoms of relevant data subjects.

• Recordkeeping: Data controllers must keep and maintain a record of any application, notice, request or any other information relating to personal data that has been or is being processed. The controller also must maintain a record of personal data breaches.

• Retention: Data controllers may not keep personal data for longer than necessary to fulfill the purposes of the collection. The data controller must destroy or permanently delete the data when no longer needed.

If passed, the Bill would come into force one year from the date of its promulgation or “such other date not falling beyond two years from the date of its promulgation.”

Read the new draft of the Bill.