The Finance Bill 2020, presented along with federal budget for fiscal year 2020-21 on June 12, contains certain provisions relating to real-time access by the Federal Board of Revenue (FBR) to citizens’ data to be obtained from various institutions that, in the absence of private data protection law, infringe upon the inviolable fundamental rights enshrined in the Constitution of Islamic Republic of Pakistan.

The proposed amendments need reconsideration from this perspective. The framing of these provisions in Finance Bill 2020, vetted by the Ministry of Law and Justice (if actually done) and approved by the cabinet expose how little knowledge our Executive have about the Constitution.

Giving such powers to the FBR in the name of documentation amounts to intimidation, harassment and abuse of private information. This needs immediate attention of those defending digital rights of fellow countrymen.

In the Finance Bill 2020, the amendments are sought in the Income Tax Ordinance, 2001 and Sales Tax Act, 1990 to give FBR real-time access to:

information and databases of the National Database and Registration Authority (NADRA) with respect to information pertaining to National Identity Card (NIC), Pakistan Origin Card, Overseas Identity Card, Alien Registration Card, and other particulars contained in the Citizen Database, notwithstanding anything contained in any law for the time being in force, including but not limited to the National Database and Registration Authority Ordinance, 2000.

data base of the Federal Investigation Agency and the Bureau of Emigration and Overseas Employment with respect to details of international entry and exit of all persons and information pertaining to work permits, employment visas and immigration visas.

land record of Islamabad Capital Territory (ICT), provincial, local and development authorities with respect to record-of-rights, including its digitized form, periodic record, record of mutations and report of acquisition of rights.

record of registration of vehicles, transfer of ownership and other associated record from the ICT, Provincial Excise and Taxation Departments.

particulars with respect to consumers of all electricity suppliers and gas transmission and distribution companies of the units consumed and the amount of bill charged or paid and where the connection is shared or is used by a person other than the owner, the name and NIC of the owner and the user.

To implement these, the FBR will make arrangements for “laying the infrastructure and aligning it with its own database in the manner as it may prescribe”. The proposed amendments further provide till the time access to information and database is made available under such information, data will be provided periodically in such form and manner as FBR may prescribe.

The Finance Bill 2020 says that any information/data collected through real time access or otherwise subject to certain exception provided in Section 216 of the Income Tax Ordinance and Section 56B of the Sales tax Act, 1990 “shall be used only for tax purposes and kept confidential”. For the purposes of the proposed provisions stated above, the FBR will also be authorised to make rules relating to electronic real-time access for audit or a survey of persons liable to tax.

The proposed amendment, if passed, will give powers to the FBR to have real-time access to personal data of citizens for which no legal sanction and/or protection is available under the relevant law.

The website of the Ministry of Information Technology and Telecom has posted the text of Personal Data Protection Bill, 2020 [Consultation Draft V.09.04.2020], preamble of which reads as under: “A Bill to govern the collection, processing, use and disclosure of personal data and to establish and making provisions about offences relating to violation of the right to data privacy of individuals by collecting, obtaining or processing of personal data by any means. Whereas it is expedient to provide for the processing, obtaining, holding, usage and disclosure of data while respecting the rights, freedoms and dignity of natural persons with special regard to their right to privacy, secrecy and personal identity and for matters connected therewith and ancillary thereto….”

Sections 5, 6, 7 and 8 of the draft Personal Data Protection Bill, 2020 [hereinafter called the Personal Data Protection Bill] provide that the data collectors will have to communicate the purpose of sharing the data with the subject person. However, Section 30 of the Personal Data Protection Bill provides exemption from such sharing, if the information is required for tax purposes. It is thus clear that the FBR can only access/collect data after the passage of the Personal Data Protection Bill and establishment of Personal Data Protection Authority of Pakistan to regulate it as provided therein. This Authority shall have the responsibility to protect the interest of the data subject and enforce protection of personal data, prevent any misuse of personal data and promote awareness of data protection.

There are apprehensions about protection of personal data by the FBR.

Usman Khilji, director of an advocacy forum for digital rights in his article, Data protection law, published in Dawn on January 7, raised the following questions:

“The NADRA database, which holds the identity information of all citizens, has been subjected to hacking many times in the past, but there has been little transparency on the investigation of these hacks, whether an official was held responsible, and any consequences for those who failed in their responsibility of protecting citizens’ data.

This [Personal Data Protection Bill, 2020] should also cover protections against leakage of personal data of citizens, including of families of public officials such as judges, ministers and generals, which is abused for political purposes. Such breaches often occur through connivance of officials in public bodies.”

He suggested that instead of establishing a separate Personal Data Protection Authority of Pakistan, “The government would be better off using the already existing information commission, which functions to administer appeals under the right to information law, as is the practice in the UK under the Data Protection Act.”

In the light of the above perspectives, legal, technical and ethical, the amendments proposed in Finance Bill 2020 empowering the FBR to have real-time access to personal data of citizens without prior passage of Personal Data Protection Bill, 2020, are in violation of Article 14 of the Constitution.

The federal government must withdraw these till the time the draft law [Personal Data Protection Bill, 2020] for protecting the right of privacy of data of citizens is debated publicly, presented in the parliament and passed

The writers, lawyers and authors, are Adjunct Faculty at Lahore University of Management Sciences (LUMS)