Data privacy & protection: challenges

‘….the tax officials on the unlawful directions issued by Chairman of ARU, Barrister Shahzad Akbar with the concurrence of the Federal Law Minister, Dr Farogh Naseem, breached the statutory confidentiality of Mrs. Sarina Faez Isa’s tax returns.

I feel constrained to observe that allowing the said delinquents to continue in such important positions of authority by the worthy Prime Minister, and that too after this Court has unanimously declared their actions to be in violation of the Constitution and law, particularly the provisions of section 216 of the Ordinance entailing penal consequences, belies the most elementary principles of “good governance”, and exposes the worthy Prime Minister’s complicity in the commission of the said violations’—Justice Yahya Afridi in CRP. 296/2020, etc.

It is important to ensure that there are no artificial impediments to ensuring accountability of judges, provided the process is pursued in accordance with the law.

This demonstration of authority, particularly tax officials, however, should in no way detract them from their statutory duty to remain steadfast in ensuring confidentiality of the information of a tax filer as mandated under section 216 of the Income Tax Ordinance, 2001, which, as mentioned in the additional note in the judgment under review was held to be blatantly breached in the case of Sarina Faez Isa by the honourable judge.

The importance of data privacy cannot be denied in any civilized country and breach of data is termed a serious security lapse. In the era of technology, sanctity and privacy of data are paramount at the individual, corporate and national levels.

Governments and corporations are spending large amounts of money to protect and secure their confidential data/information from any type of breach or misuse which may ultimately cause huge financial as well existential losses.

Despite this, there are still a few countries where data privacy is not given due importance and Pakistan is one of them. Though the country has not introduced data privacy laws till today, yet some specific laws ensure confidentiality of information submitted to the government agencies. Unfortunately, most of these are compromised.

The recent judgment of the Supreme Court in Civil Review Petition No. 296 to 301, 308, 309 & 509 of 2020 and C.M.A No. 4533 of 20200 factually establishes that tax officials acted on the unlawful directions issued by the then Chairman of Assets Recovery Unit (ARU), Barrister Shahzad Akbar, in concurrence with Federal Law Minster, Dr Farogh Naseem.

They clearly breached the statutory confidentiality of Sarina Faez Isa’s tax returns. This unlawful act entails penal consequences quoting the Prime Minister, letting the delinquents continue in such important positions.

This is not the first time where taxpayer information is compromised. The tax information of the incumbent Prime Minister, the Ex-Prime Minister, Muhammad Nawaz Sharif, Ex-Federal Minister for Finance, Muhammad Ishaq Dar, and other senior politicians and dignitaries have already been subjected to such criminal breaches.

This is despite the fact that section 216 of the Income Tax Ordinance, 2001 ensures confidentiality of proceedings and/or those relating to recovery of demand barring public servants from disclosing such information.

Ignoring clear language of law, before amendment by the Finance Act 2021, regarding maintenance of confidentiality, the same was not ensured. Another factor, which highlights confidentiality is the Organization of Economic Cooperation and Development (OECD) guidelines issued to Tax Inspectors without border. In order to fight against tax evasion and avoidance, Pakistan became 104th Member of the organization in 2016.

The OECD also has issued guidance on protection of confidentiality of Information Exchanged for Tax Purposes and states that “Confidentiality of taxpayer information has always been a cornerstone of tax systems.

In order to have confidence in their tax system and comply with their obligations under the law, taxpayers need to also be confident that the often-sensitive financial information is not disclosed inappropriately, whether intentionally or by accident”.

However, this important issue has never been taken seriously in Pakistan. Apart from financial and tax information, even the confidentiality of the health record is not maintained, and relevant information, purely personal in nature, is disclosed and tampered with.

In civilized countries, it is a crime that has punishment for up to one year and fine as well but in Pakistan, this sensitive information is not only disclosed but made part of leading stories on television and other media platforms.

In the past, medical report of a three-time elected Prime Minister Muhammad Nawaz Sharif (later disqualified for life by the Supreme Court) was accessed and tampered with. Moreover, most television anchors do not realize the importance of data privacy and always compromise the confidentiality of personal information of dignitaries also compromising their code of ethics.

This is because Pakistan has failed to introduce comprehensive data privacy and protection laws, and even in cases where any specific law or regulation exists, the same has never been followed in its true spirit.

Even in the judgement referred to above, though the Supreme Court highlighted the breach of confidentiality and named the persons responsible for such violation, however, no directions were issued to the concerned agencies to initiate investigation against them. The most unfortunate part is that the courts as custodian and flag bearers of fundamental rights could not ensure securing privacy of the citizens.

Last year, the Ministry of Information Technology & Telecommunication introduced a consultation draft of the Personal Data Protection Bill 2021which is yet to be presented in parliament for debate and approval to attain finality as a law.

The current draft of the bill is not in conformity with the global standards and does not classify sensitivity of the data, nor does it align with monitoring requirements. Moreover, it is silent regarding the transmission and merger of data of big corporations.

It also lacks the assurance element entailing smooth transmission and highlighting the potential risks of data breach.

The proposed bill does not contain specific guidance regarding reporting requirements and obtaining data from third parties. The overall draft bill is too generic which does not meet the requirements of the fast-paced technological era, influenced by artificial intelligence and machine learning.

Data privacy laws help to secure the personal private information of the people and protect sensitive information which can eventually impact the national security of the country. Sound data protection laws restrict law enforcement agencies from accessing of personal and private data of the citizens to protect their human rights.

Pakistan is one of those countries which are known for surveillance of its citizens. It is the responsibility of the Parliament to ensure the privacy of the citizens by introducing comprehensive data privacy law which offers a sense of security to its citizens and protects national security. Pakistan has already faced various cyber-attacks on its financial institutions back in 2018 and recently in 2021.

The apex revenue authority of Pakistan, Federal Board of Revenue (FBR), was also exposed to various cyber-attacks and despite claims by the Finance Minister regarding the formation of a committee to determine responsibility of this negligence, so far, no action has been taken nor has anyone been brought to justice.

This is indicative of the casual behavior adopted by the government against a global challenge like data privacy. The government needs is to take cognizance of its responsibility for privacy and sanctity of data available with it.

It should ensure that the proposed legislation related to data protection not only guarantees the fundamental rights of the citizens but also meets the requirements of a new technological era, where information collected, transmitted in any form, would not be exposed to any kind of breach.

(Huzaima Bukhari & Dr Ikramul Haq, lawyers and partners of Huzaima, Ikram & Ijaz, are Adjunct Faculty at Lahore University of Management Sciences (LUMS), members Advisory Board and Visiting Senior Fellows of Pakistan Institute of Development Economics (PIDE). Abdul Rauf Shakoori is a corporate lawyer based in the USA and an expert in ‘White Collar Crimes and Sanctions Compliance’. They have recently coauthored a book, Pakistan Tackling FATF: Challenges and Solutions)

Copyright Business Recorder, 2022