The Global Network Initiative (GNI), a global, multistakeholder organization focused on freedom of expression and privacy, expresses deep concern about Pakistan’s Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguard) Rules 2020 (“the Rules”), which were notified in November 2020. The Rules grant the government broad authorities to pressure companies to restrict access to content and facilitate exceptional access to user data. With a number of vaguely worded provisions and serious legal penalties for noncompliance, the Rules pose significant risks for freedom of expression and privacy. They also undermine the government’s vision for a Digital Pakistan. GNI encourages the government to rescind the Rules and undertake open, transparent, and multistakeholder deliberations to inform effective, fit-for-purpose, and rights-enhancing regulation.
Following the notification of the first version of the Rules in January 2020, GNI and other stakeholders expressed concerns about the “complete absence of consultation.” Prime Minister Imran Khan ordered the Pakistan Telecommunication Authority (PTA) to undertake “extensive and broad-based consultations with all relevant segments of civil society and technology companies.” In July, GNI facilitated a multistakeholder roundtable on the Rules, articulating many of the same concerns below, with limited government participation. Requests from civil society to clarify the interim legal status of the Rules were insufficiently addressed, and the government failed to honor its stated commitment to share draft copies of the Rules. Despite this lack of consultation, updated rules were published on the Ministry of Information Technology and Telecommunication (MoITT) website on 18 November without advance notice or acknowledgement of stakeholder input. Adding to the opaque process, a third change to the Rules was first announced on a television program on 27 November. Collectively, these procedural flaws undermine the legality and legitimacy of the Rules under international human rights law.
The Rules continue to be difficult to reconcile with internationally recognized principles of necessity and proportionality. Article 19 of the Constitution of Pakistan outlines certain reasonable restrictions on freedom of expression that can be imposed by law. The Rules purport to detail specific interpretations of some of these restrictions, citing the criminal code, and grant the PTA broad authority to enforce these interpretations without any role for the judiciary. Under the Rules, within 24 hours, companies must comply with removal orders for content the PTA deems illegal, or within six hours for an (undefined) emergency, with no differentiation between the orders warranting the most urgent responses.
Companies are now required to enact updates to their terms of service prohibiting a broad range of difficult-to-define content, including content that “violates religious, cultural, or ethnic sensitivities” or “causes incitement to any offence under the Act,” among other categories, and to monitor their services accordingly. Certain companies are also expected to establish local representation, store data in Pakistan, and provide data in a “decrypted, readable, and comprehensible” format to the Federal Investigation Agency, without any requirement for a court order.
As with the previous version, companies continue to face significant legal pressures to remove content and share access to user data. The Rules grant the PTA broad enforcement powers when companies fail to comply with removal orders, including potentially blocking access to a service altogether. In addition, the PTA can fine companies up to 500 million rupees (over US $3 million) for failure to abide by any provisions in the Rules. As such, the Rules appear to exceed the authorities granted to the PTA under its parent legislation, the Prevention of Electronic Crimes Act (PECA), and may undermine the existing liability protections for companies under section 38 of PECA.
The substantial requirements the Rules place upon companies may also pose significant risks for the digital development of Pakistan. In a country where small and medium-sized enterprises (SMEs) play a significant role in the economy, these onerous requirements could be difficult to manage for the growing number of digital SMEs. In addition, the Rules will make it difficult for companies to make existing services available in Pakistan and may discourage foreign investment into the technology sector in Pakistan, slowing an important contributor to the country’s growing digital sector.
When PECA was first passed in 2016, section 37(2) called on the PTA to work with the federal government to adopt rules for, “among other matters, safeguards, transparent process and effective oversight mechanism” for the PTA’s authority. Instead of meeting these admirable aims, the Rules instead reaffirm and even augment overly broad authorities for the PTA to block or remove content, and place onerous, privacy-infringing requirements on companies. In combination with excessive legal penalties, the Rules pose significant risks for freedom of expression and privacy and digital development in Pakistan. We reaffirm our call for the government to revise these rules, engage in proper consultation, and consider our recommendations for rights-enhancing content regulations.