*** UPDATE: This statement was modified on Feb. 28 to clarify that GNI “acknowledge[s]” the government’s decision to hold consultations on the Rules and clarify our expectations for the scope of those consultations. ***
Concerned about the lack of public consultation and the broad scope of the “Citizens Protection (Rules Against Online Harm) 2020,” approved by the Government of Pakistan on 21 January 2020, GNI released a statement identifying aspects of the Rules that create significant risks to privacy and freedom of expression and acknowledging the government’s decision to hold “extensive and broad based consultations” on the Rules.
“GNI and its members stand ready to engage thoughtfully and respectfully with the government of Pakistan and any other government that is considering how best to address content regulation,” said Judith Lichtenberg, GNI Executive Director.
As drafted, the Rules would require social media platforms to comply with censorship orders made without judicial review and facilitate access to ICT users’ data endangering privacy. The broad and unspecified nature of these authorities and requirements pose real risks to the digital rights of Pakistani citizens.
“The Rules Against Online Harm, as currently drafted, raise more questions than they answer. We encourage the government to work with interested stakeholders to ensure proper identification of problems and corresponding solutions,” said Mark Stephens, GNI Board Independent Chair.
The Global Network Initiative (GNI), a multistakeholder organization composed of leading information and communication technology (ICT) companies, investors, academics, and digital rights and media freedom organizations, expresses profound concern about the expansive and hastily compiled Citizens Protection (Rules Against Online Harm) 2020 (the Rules), approved by the Government of Pakistan on 21 January 2020. The Rules have raised significant concerns both locally and globally, among internet companies, civil society, and the public, due to the complete absence of consultation with stakeholders and the sweeping scope of the regulations.[1] We acknowledge the decision by the government to hold an “extensive and broad based consultation process with all relevant segments of civil society and technology companies about [the Rules].” We are confident that an open, considered approach to concerns regarding online content, including alternatives to a regime under Section 37 of the Prevention of Electronic Crimes Act, which affords broad and discretionary powers to censor, posing risks for the rights of freedom of expression and privacy, will yield more legally-sound results that empower and protect Pakistani citizens and complement the government’s vision of a “Digital Pakistan.”
The Rules appear to have been passed quickly and without consultation with stakeholders, calling into question their legitimacy and legality under international human rights law.[2] By establishing broad and unchecked powers to censor a wide range of, in some instances vaguely defined, categories of content, the Rules are also difficult to reconcile with the principles of necessity and proportionality.[3] The Rules also challenge the ability of companies to provide encryption for their products and services, raising cybersecurity concerns. In addition, the Rules seem to grant powers that may be greater than the authorizing legislation they purport to implement. Finally, the Rules enhance the government’s authority to demand user data in a non-judicially-supervised manner, raising privacy concerns as well. The GNI calls on the Government of Pakistan to pull back these Rules and engage in broad, transparent consultation with legislators, civil society, social media companies, and other relevant stakeholders.
The Rules create a new Office of the National Coordinator and appear to vest a tremendous array of powers in the Pakistan Telecommunications Authority (the Authority), which would essentially become the prosecutor, judge, and enforcer of any perceived illegal content online. The Rules allow the Authority to receive complaints from the public or other ministries about, or identify on its own, any illegal content. They also give the Authority unilateral power to determine whether the content is in fact illegal, without providing sufficient guarantees of due process or guidance for balancing the rights of those responsible for the content. Finally, the Authority is empowered to demand that social media companies “remove, suspend, or disable” access to content within 24-hours (or six-hours in an “emergency”). In a significant assertion of global jurisdiction, the Rules explicitly extend to content “of citizens of Pakistan residing outside its territorial boundaries.”
The Rules require social media companies, which are defined broadly and without exceptions for smaller platforms, to: (i) register, establish permanent offices, and appoint a “focal person” in Pakistan within three months; (ii) establish “database servers in Pakistan … to record and store data and online content” within twelve months “for citizen data privacy,” despite the lack of data protection laws in the country; and (iii) deploy “proactive mechanisms” to prevent live streaming of illegal content. Social media companies are also mandated under the Rules to provide investigators any “any information or data or content or sub-content … in decrypted, readable and comprehensible format.” Failure to abide by these provisions can result in blocking of their services or fines of up to 500 million rupees (over US $3 million).
The proposed Rules create significant risks for the privacy and free expression rights of ICT users both within and outside of Pakistan. The Government of Pakistan should withdraw these Rules and engage in broad, transparent consultation with legislators, civil society, social media companies, and other relevant stakeholders.
[1] See., e.g., Statement form the Asia Internet Coalition, 13 Feb. 2020), https://aicasia.org/wp-content/uploads/2020/02/AIC-statement-on-Pakistans-Citizens-Protection-Rules-Against-Online-Harm-13-Feb-2020.pdf; Committee to Protect Journalists, “Pakistan government secretly passes strict social media regulations,” 13 Feb. 2020) https://aicasia.org/wp-content/uploads/2020/02/AIC-statement-on-Pakistans-Citizens-Protection-Rules-Against-Online-Harm-13-Feb-2020.pdf.; Media Matters for Democracy, et al., “Civil society declares the ‘rules against online harm’ a political move to control the Internet and silence critics; demands immediate de-notification,” 13 Feb. 2020, https://mediamatters.pk/mmfd-declares-the-rules-against-online-harm-a-political-move-to-control-the-internet-and-silence-critics-demands-immediate-de-notification/.
[2] Specifically, Article 19 (freedom of opinion and expression) of the International Covenant on Civil and Political Rights, which Pakistan has signed and ratified.
[3] These principles also stem from ICCPR, Article 19. We note, with particular concern, the definition of “extremism” in the Rules, which includes not only violent but also “vocal or active opposition to fundamental values of the state of Pakistan…,” and the references to “fake news,” which is not defined in the Rules but nevertheless is prohibited.