Finance Bill 2020 & data privacy  

Huzaima Bukhari & Dr. Ikramul Haq

The Finance Bill 2020, presented along with federal budget for fiscal year 2020-21 on June 12, 2020, contains certain provisions relating to real-time access to Federal Board of Revenue (FBR) of citizens’ data to be obtained from various institutions that in the absence of private data protection law infringe the inviolable fundamental rights enshrined in the Constitution of Islamic Republic of Pakistan [the “Constitution”]. These proposed amendments need reconsideration from this perspective. The framing of these provisions in Finance Bill 2020, vetted by the Ministry of Law & Justice (if actually done) and approved by Cabinet expose how little knowledge our Executive have about the Constitution and respect for the fundamental inalienable rights of the citizens. In the name of documentation, such powers to FBR amounts to intimidation, harassment and abuse of private information of citizens. This matter needs immediate attention of all those actively pursuing to defend digital rights of fellow countrymen.   

In the Finance 2020, the amendments are sought in the Income Tax Ordinance, 2001 and Sales Tax Act, 1990 to give FBR real-time access to:

• information and databases of the National Database and Registration Authority (NADRA) with respect to information pertaining to National Identity Card (NIC), Pakistan Origin Card, Overseas Identity Card, Alien Registration Card, and other particulars contained in the Citizen Database, notwithstanding anything contained in any law for the time being in force, including but not limited to the National Database and Registration Authority Ordinance, 2000.
• data base of the Federal Investigation Agency and the Bureau of Emigration and Overseas Employment with respect to details of international entry and exit of all persons and information pertaining to work permits, employment visas and immigration visas.
• land record of Islamabad Capital Territory (ICT), provincial, local and development authorities with respect to record-of-rights, including its digitized form, periodic record, record of mutations and report of acquisition of rights.
• record of registration of vehicles, transfer of ownership and other associated record from the ICT, Provincial Excise and Taxation Departments.
• particulars with respect to a consumers of all electricity suppliers and gas transmission and distribution companies of the units consumed and the amount of bill charged or paid and where the connection is shared or is used by a person other than the owner, the name and NIC of the owner and the user. For this purpose all electricity suppliers and gas transmission and distribution companies will have to make arrangements by January 1, 2021 allowing consumers to update the ratio of sharing of a connection or the particulars of users, as the case may be.

FBR will have the same power to have real-time access to data/information of any other agency, authority, institution or organization that it notifies. For implementing it, FBR is going to make arrangements for “laying the infrastructure and aligning it with its own database in the manner as it may prescribe”. The proposed amendments further provide till the time access to information and database is made available under such information, and data will be provided periodically in such form and manner as FBR may prescribe.

The Finance Bill 2020 says that any information/data collected through real time access or otherwise subject to certain exception provided in section 216 of the Income Tax Ordinance and section 56B of the Sales tax Act, 1990 “shall be used only for tax purposes and kept confidential”. For the purposes of the proposed provisions stated above, FBR will also be authorised to make rules relating to electronic real-time access for audit or a survey of persons liable to tax.

The proposed amendment, if passed, will give powers to FBR to have real-time access to personal data of citizens for which no legal sanction and/or protection is available under the relevant law for the said purpose that is still in the consultation process as per information available at the website of the Ministry of Information Technology and Telecom. This law is even not presented in the Parliament. The website of Ministry of Information Technology and Telecom has posted the text of  Personal Data Protection Bill, 2020 [Consultation Draft V.09.04.2020], preamble of which reads as under:

“A Bill to govern the collection, processing, use and disclosure of personal data and to establish and making provisions about offenses relating to violation of the right to data privacy of individuals by collecting, obtaining or processing of personal data by any means. Whereas it is expedient to provide for the processing, obtaining, holding, usage and disclosure of data while respecting the rights, freedoms and dignity of natural persons with special regard to their right to privacy, secrecy and personal identity and for matters connected therewith and ancillary thereto….”

Sections 5, 6, 7 and 8 of the draft Personal Data Protection Bill, 2020 [hereinafter “the Personal Data Protection Bill”] provide that the data collectors will have to communicate the purpose of sharing the data with the subject person. However, section 30 of the Personal Data Protection Bill provides exemption from such sharing, if the information is required for tax purposes. It is thus clear that FBR can only access/collect data after the passage of the Personal Data Protection Bill and establishment of Personal Data Protection Authority of Pakistan to regulate it as provided therein. This Authority shall have the responsibility to protect the interest of the data subject and enforce protection of personal data, prevent any misuse of personal data and promote awareness of data protection.

There are bona fide apprehensions that what is the guarantee of protection of personal data by FBR? Usman Khilji, director of an advocacy forum for digital rights in his article, Data protection law,published onJanuary 7, 2020, raised the following important issues/questions:      

“The NADRA database, which holds the identity information of all citizens, has been subjected to hacking many times in the past, but there has been little transparency on the investigation of these hacks, whether an official was held responsible, and any consequences for those who failed in their responsibility of protecting citizens’ data.

This [Personal Data Protection Bill, 2020] should also cover protections against leakage of personal data of citizens, including of families of public officials such as judges, ministers and generals, which is abused for political purposes. Such breaches often occur through connivance of officials in public bodies.

The Bill also gives broad discretionary powers to the federal government whereby it can grant or revoke exemptions to data controllers, without a specified procedure. This also goes against the spirit of protecting data of citizens fairly”.

He suggested that instead of establishing a separate Personal Data Protection Authority of Pakistan, “The government would be better off using the already existing information commission, which functions to administer appeals under the right to information law, as is the practice in the UK under the Data Protection Act. This way, the government can utilise an existing body already working on a related matter—information requests—and legislate on its independence to avoid conflict of interest”.

In the light of above perspectives, legal, technical and ethical, the amendments proposed in Finance Bill 2020 empowering FBR to have real-time access of the personal data of citizens without first passage of Personal Data Protection Bill, 2020 are in violation of Article 14 of the Constitution. The Government of Pakistan of Tehreek-i-Insaf must withdraw these till the time the draft law [Personal Data Protection Bill, 2020] for protecting the right of privacy of data of citizens is debated publicly, presented in the Parliament and passed as per procedure provided in the Constitution. Besides, the apparatus/infrastructure/capacity are provided about offenses relating to violation of the right to data privacy of individuals by collecting, obtaining or processing of personal data by any means and to ensure its processing, obtaining, holding, usage and disclosure of while respecting the rights, freedoms and dignity of natural persons with special regard to their right to privacy, secrecy and personal identity and all ancillary and connected matters with it as promised in proposed Personal Data Protection Bill, 2020.  

________________________________________________________________________

The writers, lawyers and authors, are Adjunct Faculty at Lahore University of Management Sciences (LUMS)