Finance Bill 2020 & personal data privacy  

Huzaima Bukhari & Dr. Ikramul Haq

The Finance Bull 2020, presented along with federal budget for fiscal year 2020-21 on June 12, 2020, contains certain provisions relating to giving powers to Federal Board of Revenue (FBR) to have online access of personal data from various institutions/bodies that are in violation of Constitution of Islamic Republic of Pakistan [the “Constitution”]. These need to be reconsidered/withdrawn immediately. The preparation of the Finance Bill 2020, its vetting by the Ministry of Law & Justice (if actually done) and approval by Cabinet expose how little respect our Executive have for the supremacy of the Constitution and care for the fundamental inalienable rights of the citizens of Pakistan.

In the Finance 2020, the following provisions have been proposed in the Income Tax Ordinance, 2001:

“56AB. Real-time access to information and databases.— (1) Notwithstanding anything contained in any law for the time being in force, including but not limited to the National Database and Registration Authority Ordinance, 2000 (Ordinance VIII of 2000), and the Emigration Ordinance, 1979 (Ordinance XVIII of 1979), arrangements shall be made to provide real-time access of information and database to the Board in the prescribed form and manner by–

• the National Database and Registration Authority with respect to information pertaining to National Identity Card (NIC), Pakistan Origin Card, Overseas Identity Card, Alien Registration Card, and other particulars contained in the Citizen Database;
• (b) the Federal Investigation Agency and the Bureau of Emigration and Overseas Employment with respect to details of international entry and exit of all persons and information pertaining to work permits, employment visas and immigration visas;
• the Islamabad Capital Territory and Provincial and local land record and development authorities with respect to record-of rights including digitized edition of record-of-rights, periodic record, record of mutations and report of acquisition of rights;
• the Islamabad Capital Territory and Provincial Excise and Taxation Departments with respect to information regarding registration of vehicles, transfer of ownership and other associated record;
• all electricity suppliers and gas transmission and distribution companies with respect to particulars of a consumer, the units consumed and the amount of bill charged or paid: Provided that where the connection is shared or is used by a person other than the owner, the name and NIC of the owner and the user shall also be furnished: Provided further that all electricity suppliers and gas transmission and distribution companies shall make arrangements by the 1st day of January, 2021 for allowing consumers to update the ratio of sharing of a connection or the particulars of users, as the case may be; and
• any other agency, authority, institution or organization, notified by the Board.

(2) The Board shall make arrangements for laying the infrastructure for real-time access to information and database under sub-section (1) and aligning it with its own database in the manner as may be prescribed.

(3) Until real-time access to information and database is made available under sub-section (1), such information and data shall be provided periodically in such form and manner as may be prescribed.

(4) Subject to section 56B, all information received under this section shall be used only for tax purposes and kept confidential”.

In section 175 of the Income Tax Ordinance, 2001, the following sub-section is proposed:

“(9) For the purpose of clause (a) of sub-section (1), the Board may make rules relating to electronic real-time access for audit or a survey of persons liable to tax.

After section 175, amended as aforesaid, the following new section is proposed to be added:

“175A. Real-time access to information and databases.— (1) Notwithstanding anything contained in any law for the time being in force, including but not limited to the National Database and Registration Authority Ordinance, 2000 (Ordinance VIII of 2000), and the Emigration Ordinance, 1979 (Ordinance XVIII of 1979), arrangements shall be made to provide real-time access of information and database to the Board in the prescribed form and manner by–

• the National Database and Registration Authority with respect to information pertaining to National Identity Card, Pakistan Origin Card, Overseas Identity Card, Alien Registration Card, and other particulars contained in the Citizen Database;
• the Federal Investigation Agency and the Bureau of Emigration and Overseas Employment with respect to details of international entry and exit of all persons and information pertaining to work permits, employment visas and immigration visas;
• the Islamabad Capital Territory and provincial and local land record and development authorities with respect to record-of-rights including digitized edition of record-of-rights, periodic record, record of mutations and report of acquisition of rights;
• the Islamabad Capital Territory and provincial Excise and Taxation Departments with respect to information regarding registration of vehicles, transfer of ownership and other associated record;
• All electricity suppliers and gas transmission and distribution companies with respect to particulars of a consumer, the units consumed and the amount of bill charged or paid: Provided that where the connection is shared or is used by a person other than the owner, the name and CNIC of the owner and the user shall also be furnished: Provided further that all electricity suppliers and gas transmission and distribution companies shall make arrangements by the 1st day of January, 2021for allowing consumers to update the ratio of sharing of a connection or the particulars of users, as the case may be; and
• any other agency, authority, institution or organization notified by the Board.

(2) The Board shall make arrangements for laying the infrastructure for real-time access to information and database under sub-section (1) and aligning it with its own database in the manner as may be prescribed.

(3) Until real-time access to information and database is made available under sub-section (1), such information and data.

(4) Subject to section 216, all information received under this section shall be used only for tax purposes and kept confidential”

In the Sales tax Act, 1990, after section 47A, the following new section is proposed:

“47AB. Real-time access to information and databases.— (1) Notwithstanding anything contained in any law for the time being in force, including but not limited to the National Database and Registration Authority Ordinance, 2000 (Ordinance VIII of 2000) and the Emigration Ordinance, 1979 (Ordinance XVIII of 1979), arrangements shall be made to provide real-time access of information and database to the Board in the prescribed form and manner by–

• the National Database and Registration Authority with respect to information pertaining to National Identity Card (NIC), Pakistan Origin Card, Overseas Identity Card, Alien Registration Card and other particulars contained in the citizen database;

(b) the Federal Investigation Agency and the Bureau of Emigration and Overseas Employment with respect to details of international entry and exit of all persons and information pertaining to work permits, employment visas and immigration visas;

(c) the Islamabad Capital Territory and provincial and local land record and development authorities with respect to record-of-rights including digitized edition of record-of-rights, periodic record, record of mutations and report of acquisition of rights;

(d) the Islamabad Capital Territory and provincial excise and taxation departments with respect to information regarding registration of vehicles, transfer of ownership and other associated record;

(e) all electricity suppliers and gas transmission and distribution companies with respect to particulars of a consumer, the units consumed and the amount of bill charged or paid: Provided that where the connection is shared or is used by a person other than the owner, the name and NIC of the owner and the user shall also be furnished: Provided further that all electricity suppliers and gas transmission and distribution companies shall make arrangements by the 1st day of January, 2021 for allowing consumers to update the ratio of sharing of a connection or the particulars of users, as the case may be; and

(f) any other agency, authority, institution or organization notified by the Board.

(2) The Board shall make arrangements for laying the infrastructure for real-time access to information and database under sub-section (1) and aligning it with its own database in the manner as may be prescribed.

(3) Until real-time access to information and database is made available under sub-section (1), such information and data shall be provided periodically in such form and manner as may be prescribed. (4) Subject to section 47B, all information received under this section shall be used only for tax purposes and kept confidential.”

After sub-section (3), the following new sub-section shall be added, namely:–

“(4) For the purpose of sub-section (1), the Board may make rules relating to electronic real-time access for audit or a survey of persons liable to tax.

The proposed amendment, if passed, will give powers to FBR to have real-time access to personal data of citizens for which no legal sanction and/or protection is available, as relevant law for the said purpose is still in the consultation process by the Ministry of Information Technology and Telecom and not even tabled in the Parliament.

The website of Ministry of Information Technology and Telecom has text of draft Personal Data Protection Bill, 2020 [Consultation Draft V.09.04.2020], preamble of which reads as under:

“A Bill to govern the collection, processing, use and disclosure of personal data and to establish and making provisions about offenses relating to violation of the right to data privacy of individuals by collecting, obtaining or processing of personal data by any means. Whereas it is expedient to provide for the processing, obtaining, holding, usage and disclosure of data while respecting the rights, freedoms and dignity of natural persons with special regard to their right to privacy, secrecy and personal identity and for matters connected therewith and ancillary thereto….”

Sections 5, 6, 7 and 8 of the proposed Personal Data Protection Bill, 2020 [hereinafter “the Bill”] provide that the data collectors will have to communicate the purpose of sharing the data with the subject person. However, section 30 of the Bill provides exemption from such sharing, if the information is required for tax purposes. However, it is only possible after the passage of the Bill and establishment of Personal Data Protection Authority of Pakistan to regulate it. This Authority shall have the responsibility to protect the interest of the data subject and enforce protection of personal data, prevent any misuse of personal data and promote awareness of data protection.

The important question is what is the guarantee of protection of data by FBR? Usman Khilji, director of an advocacy forum for digital rights in his article published in Dawn [Data protection law, January 7, 2020], raised the following fundamental questions:      

“The Nadra database, which holds the identity information of all citizens, has been subjected to hacking many times in the past, but there has been little transparency on the investigation of these hacks, whether an official was held responsible, and any consequences for those who failed in their responsibility of protecting citizens’ data.

This [Personal Data Protection Bill, 2020] should also cover protections against leakage of personal data of citizens, including of families of public officials such as judges, ministers and generals, which is abused for political purposes. Such breaches often occur through connivance of officials in public bodies.

The bill also gives broad discretionary powers to the federal government whereby it can grant or revoke exemptions to data controllers, without a specified procedure. This also goes against the spirit of protecting data of citizens fairly”.

He suggested that instead of establishing a separate Personal Data Protection Authority of Pakistan, “The government would be better off using the already existing information commission, which functions to administer appeals under the right to information law, as is the practice in the UK under the Data Protection Act. This way, the government can utilise an existing body already working on a related matter—information requests—and legislate on its independence to avoid conflict of interest”.

In the above perspective, the amendments proposed in Finance Bill 2020 empowering FBR to have online access of the personal data of citizens without first passage of Personal Data Protection Bill, 2020 are in violation of Article 14 of the Constitution. The Government of Pakistan Tehreek-i-Insaf must withdraw the proposed amendments till the time the law for protection of personal data of citizens is debated publicly, presented, tabled and passed as per procedure provided in the Constitution.

________________________________________________________________________

The writers, lawyers and authors, are Adjunct Faculty at Lahore University of Management Sciences (LUMS)