The Ministry of IT & Telecommunication last week published a draft of a personal data protection bill, with an invitation to stakeholders for feedback.

The Ministry of IT & Telecommunication last week published a draft of a personal data protection bill, with an invitation to stakeholders for feedback. With a May 15 deadline, the ministry maintained that the privacy of personal data of an individual has become `more relevant and important than ever` at a time when digital measures such as mobile phone tracking are being employed to contain the virus. While the government`s effort to move forward on data protection is encouraging, it has been a long time coming.
A similar attempt was made during the PML-N tenure, but it did not yield results. In the absence of such legislation, and as internet and telecom penetration increase in Pakistan, citizens have been victims of privacy breaches and data leaks at the hands of companies, individuals and the state, without any repercussions.
There is no doubt that there is an urgent need for citizens to have legal protections for their data. The phrase `data is the new oil` aptly describes how companies mine personal data to build and profit from profiles. In this respect, the current draft bill aims to govern the collection and processing of data and criminalise violations of privacy and data leaks. Yet, it is not very clear whether this scrutiny will apply to the state, which arguably controls the largest amount of citizen data and has been accused of breaches. From Nadra to FBR to ECP, the state holds a wide range of private citizens` information, including home addresses, biometric and electoral data, as well as information of ethnicity and religious beliefs. Given these large-scale data-gathering functions, the exemption given to the federal government under Section 31 is alarming, as it empowers the state to grant exemptions to `any data controller`. Furthermore, Section 38 stipulates that employees of the data protection authority will be public servants, giving rise to apprehensions that the legislation will not hold authorities accountable. Rights groups have correctly demanded a more independent and transparent decision-malcing process. They have also made a legitimate request for more time to critically examine the draft. The government must invite and accept the feedback given by these stakeholders with sincerity.