Digital Rights Foundation has expressed concern over the confirmation of the 'Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards), Rules' for containing provisions that have troubling implications on privacy, free speech, and the digital economy.
This statement was originally published on digitalrightsfoundation.pk on 19 November 2020.
The confirmation of the Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards), Rules is cause for alarm given the state of digital freedoms in Pakistan. Digital Rights Foundation (“DRF”) is extremely concerned with both the procedure followed in passing the Rules, devoid of meaningful consultation and transparency, and the implications the Rules have for Constitutional freedoms in the country.
DRF, along with other civil society organisations, boycotted the consultation process conducted by the Ministry of Information Technology & Telecommunication (MoITT) on grounds that the ‘Citizens Protection (Against Online Harm) Rules, 2020’ notified in January 2020 were not formally de-notified by the government. Despite challenges in high courts across the country, the terms of the consultation process initiated in June 2020 were based on the earlier draft of the rules and the fundamentally flawed section 37 of the Prevention of Electronic Crimes Act, 2016 (PECA). We reiterated our concerns and reservations with the entire process at the time. Our worst fears have been confirmed since then as the government has failed to share the draft of the Rules with any of the stakeholders, including social media companies who participated in the process, and the Rules were notified and only available once Ghazzeted (the rules were published on the MoITT website on November 18, 2020). The entire ‘consultation’ process has been an eyewash to legitimise the Rules which are fundamentally similar to their earlier version.
The only major revision from the earlier draft and the one notified by the government now is the elimination of the body of the ‘National Coordinator’ and these powers have been vested in the Pakistan Telecommunications Authority (PTA). However, it is alarming that the grounds for removal of ‘unlawful content’ have been expanded beyond the ambit of section 37 of PECA to include sections of the Pakistan Penal Code (sections 292 – 298, 204 and 509) as well as criteria such as “fake or false information.” The definition of “integrity, security and defence of Pakistan” has been expanded to include any information that “harms the reputation of Federal or Provincial Government or any person holding public office” (Rule 4(1)(ii)). It should be noted that under Indian case law, “security” has been defined to include “those aggravated forms of prejudicial activities which endanger the very existence of the State but do not include ordinary breaches of the peace.” We fail to understand how harming the reputation of the Federal or Provincial government undermines the security of Pakistan. It is submitted that such draconian provisions are reminiscent of colonial times, where laws were made with the intent to establish control over the population rather than govern. It should also be noted that sub-statutory rules cannot impose or create new restrictions beyond the scope of the parent act. The defamation law under PECA (section 20) is limited to protecting the privacy or reputation of a “natural person” only, which is to say that only individuals can use the remedy available under section 20. It is submitted that the Federal or Provincial government do not fall under the definition of natural persons and cannot bring a claim under section 20 of PECA. We maintain that section 37 in its form and application is violative of the freedom of expression and right to information enshrined in the Constitution as well as in contravention of Pakistan’s international law commitments. The criteria laid down under Rule 4 exceeds the existing ambit and is ultra vires of the parent act and the powers granted under section 37(2) of PECA.
The powers of removal and blocking of content places immense discretion in the hands of the PTA, without adequate safeguards. While there is provision for review (Rule 11), that review will be conducted by the PTA itself, and the appeals process to the High Court will be the last resort (Rule 12). It is submitted that the remedy for review and appeal provided under the Rules are very limited and narrow. The appeal will be against the review order of the Authority and not against the original order of the Authority. This essentially means that the High Court while hearing the appeal will be limited to adjudication upon the grounds of the review and not the entirety of the record. This limited right to appeal is, therefore, largely ornamental as it leaves the citizens whose fundamental rights have been infringed without an efficacious right of appeal. The powers of banning entire social media applications and platforms (Rule 8) acts as a disproportionate measure to essentially bully service providers and social media companies to ensure compliance with the PTA’s demands. In the past this power has been wielded in an immensely non-transparent manner. There is also no provision for public transparency on what content is blocked or removed by the PTA pursuant to these Rules despite the fact that the removals impact online freedom of expression and access to information of the public at large. These practices, only bolstered by the Rules, will force some social media companies to leave Pakistan, leaving local users with less choice in terms of the applications and platforms they can access, and leave users with platforms which provide ‘compliant’ services which will be heavily censored, localised and surveilled.
The regulatory uncertainty and onerous restrictions on social media companies in the form of immediate removals (within 24 hours and 6 hours in cases of “emergency” even though the Rules do not define what constitutes emergency cases) will deter investment in Pakistan’s nascent digital economy. Social media companies have already expressed having to “re-evaluate their view of the regulatory environment in Pakistan, as well as their willingness to operate in the country.” These companies are after all businesses in need of a stable and predictable regulatory environment to operate in. Furthermore, these policies will discourage local businesses and startups – economic activity which the country’s flailing economy desperately needs.
Lastly, the Rules are an affront to the right to privacy as they require social media companies and service providers to hand over data to the Federal Investigation Agency (FIA) in decrypted form, placing a legal obligation on companies to break the encryption in secure and private communications (Rule 9(7)). The Rules also anticipate a future Personal Data Protection Act (the current draft of which requires undefined ‘critical personal data’ to be stored in servers within Pakistan) and require that companies set up “one or more database servers in Pakistan within eighteen months of coming into force” (Rule 9(5)(d)). This move towards data localisation is ill-advised as it jeopardizes the data security of Pakistani citizens.
We can only hope that the institutional checks and balances within the government, the parliament and courts, are able to correct this wrong before irreparable damage to our online freedoms is done. It is incumbent on our judiciary to independently review the legality and constitutionality of these Rules in light of the concerns we and other digital rights groups have raised. Lastly, the parliament needs to significantly amend the draconian PECA with a complete repeal of section 37 to ensure the integrity and freedom of the internet.
The Rules can be accessed here:
https://moitt.gov.pk/SiteImage/Misc/files/Social%20Media%20Rules.pdf
The earlier version of the Rules can be accessed here: https://bit.ly/2Th6CMD
Hasnaat Malik, “IHC moved against new rules for regulating social media. IHC will hear the case on August 17,” The Express Tribune, August 15, 2020, https://bit.ly/3jsdeCm
Ramsha Jahangir, “Govt begins consultation on online harm rules,” Dawn, June 3, 2020, https://bit.ly/35GFbSj
“Comments on the Consultation & Objections to the Rules,” July 1, 2020, https://bit.ly/35GFbSj
“[Pakistan] The Asia Internet Coalition (AIC) publishes statement on “Removal and Blocking of Unlawful Content (Procedure, Oversight and Safeguards) Rules” (23 Oct 2020),” Asia Internet Coalition (AIC), October 23, 2020, https://bit.ly/34jWpFs.
Romesh Thapper v. State of Madras (1960) SCR 594
The said section reads “whoever intentionally and publicly exhibits and transmits any information through any information system, which he knows to be false, and intimidates or harms the reputation or privacy of a natural person”
“[Pakistan] The Asia Internet Coalition (AIC) publishes statement on “Removal and Blocking of Unlawful Content (Procedure, Oversight and Safeguards) Rules” (23 Oct 2020),” Asia Internet Coalition (AIC), October 23, 2020, https://bit.ly/34jWpFs
The draft Personal Data Protection Bill 2020 can be found here: https://moitt.gov.pk/SiteImage/Misc/files/Personal%20Data%20Protection%20Bill%202020(3).pdf
We analysed the April 2020 draft of the Personal Data Protection Bill 2020, along with the implications for data localisation, here: https://bit.ly/3dUZvmC
“Citizens Protection (Against Online Harm) Rules, 2020: Legal Analysis,” Digital Rights Foundation, February 20, 2020, https://bit.ly/2FSvd7e
“Pakistan’s Online Censorship Regime,” BoloBhi, July 18, 2020 https://bit.ly/3joZBUH
“Citizens Protection (Against Online Harm) Rules, 2020: Key Concerns, Objections and Recommendations,” February 2020, https://bit.ly/2Tk8dkK
