Senator Anusha Rehman raised serious concerns in the Senate on Monday, accusing the National Database and Registration Authority (NADRA) of selling citizens’ thumbprints and misusing their personal data during election processes. Her remarks came during a heated discussion on the Digital Nation Pakistan Bill, highlighting a growing unease about the unchecked handling of sensitive personal information by government entities.
Senator Rehman called for urgent measures to address these issues through the IT Ministry’s proposed Personal Data Protection Bill 2023. The bill is designed to regulate the collection, storage, and use of personal data while holding entities like NADRA accountable. It aims to create a robust legal framework to protect citizens from data misuse and enhance oversight of governmental and non-governmental organizations handling sensitive information.
The session saw representatives from the IT Ministry, including the IT Secretary, assuring lawmakers that the Personal Data Protection Bill 2023 is in its final stages of consultation with relevant departments. Once these consultations are complete, the bill is expected to be tabled in Parliament for legislative approval. Despite these reassurances, the session turned tense as the committee chairman criticized the delay in finalizing the bill, emphasizing that its timely introduction is essential to curb data breaches and ensure accountability for entities like NADRA.
The proposed legislation would address growing concerns about privacy violations, especially in light of repeated allegations of misuse of personal data. It is seen as a critical step to establish mechanisms for monitoring and penalizing misuse while ensuring that organizations adhere to strict data protection guidelines.
Interestingly, this debate comes amid another controversy over a similar proposal. Last week, the Ministry of IT opposed the Personal Data Protection Bill 2023 submitted by Senator Afnan Ullah as a Private Member’s Bill (PMB). The ministry argued that the private bill violates legislative protocols, conflicts with the constitutional framework, and has not met essential procedural and consultative requirements.
In its response, the IT Ministry cited Article 74 of the Constitution, which stipulates that any legislation involving federal expenditure or withdrawals from the Federal Consolidated Fund can only be introduced with the Federal Government’s approval. The ministry also criticized the bill for failing to align with legislative policy and constitutional boundaries, further complicating efforts to pass comprehensive data protection legislation.
The delay in introducing a finalized data protection framework has drawn criticism from lawmakers and civil society alike. With digital transformation accelerating across Pakistan and citizens increasingly relying on digital platforms for services, concerns about the misuse of personal data are becoming more pressing.
Senator Rehman’s allegations against NADRA underscore the need for immediate legal safeguards. If the proposed data protection bill is enacted, it would not only provide clarity on the responsibilities of data controllers like NADRA but also strengthen mechanisms to prevent unauthorized access or misuse of personal data.
The debate also highlights a broader challenge for Pakistan—balancing rapid digitization with the need for regulatory oversight to protect citizens’ rights. With entities like NADRA at the center of Pakistan’s digital infrastructure, ensuring transparency and accountability in data management is crucial for maintaining public trust.
The lack of an effective data protection law has long been a point of contention in Pakistan, where data breaches and allegations of unauthorized use of personal information are not uncommon. The passing of the Personal Data Protection Bill 2023 could mark a pivotal moment in addressing these vulnerabilities and setting a benchmark for responsible data governance.
As the government faces mounting pressure to finalize and enact the legislation, the focus will remain on ensuring that it is comprehensive, inclusive, and aligned with international data protection standards. For now, the allegations against NADRA and the unresolved debates around legislative proposals have brought the issue of data privacy into sharp focus, signaling the urgent need for action.
