The government of Pakistan is proposing a new law that significantly threatens privacy rights, in a blatant attempt to establish a legal regime containing broad powers when it comes to obtaining, retaining, and sharing data obtained through criminal investigations, including communications data.

would require a service provider, which is defined in broad terms, to “within its technical capability, retain its traffic data minimum for a period of ninety days” (a requirement may already be in place under the Electronic Transaction Ordinance, 2002). The definition of traffic data includes information “indicating the communication’s origin, destination, route, time, data, size, duration or type of underlying service”.

The draft law contains a troubling provision that would allow the Federal Government of Pakistan to forward information obtained from investigations under the Act to foreign agencies or international agencies. A prior request from the foreign entity would not be required to exercise this power.

The information at stake is expansive: “text, message, data, voice, sound, database, video, signals, software, computer programs, codes including object code and source code”. The information shared could include particular sensitive information about individuals or large quantities of data involving significant numbers of people. Once this information has left the hands of the Federal Government, it would no longer be subject to national law and could be used by foreign entities as they see fit.

Another section, on “trans-border access”, would permit the Federal Government or investigation agency to access data that may be “located in a foreign country or territory, if it obtains the lawful and voluntary consent of the person who has the lawful authority to disclose it”. This could include personal data held by foreign corporations. This opens up the possibility of abuse, as “trans-border access” could be used to circumvent the safeguards established in other parts of the draft law.