Daily Times

According to a Press report, in a recent meeting between Federal Board of Revenue (FBR) and National Database and Registration Authority (NADRA), the issue of sharing data about taxpayers/citizens was discussed. This issue is very vital from the perspective of protection of privacy of citizens’ data which, unfortunately has not been debated. The failure to ensure data protection/privacy will certainly be violation of fundamental right(s) of the citizens under the Constitution of Islamic Republic of Pakistan (“the Constitution). The debate was restricted only to technicalities and requirement of a special law allowing FBR for sharing of data with NADRA in terms of section 216 of the Income Tax Ordinance, 2001.

Through the Finance Act 2020, amendments have been made in Income Tax Ordinance, 2001, Sales Tax Act 1990, Federal Excise Act 2015,empoweringFBR for real-time access to certain information/databases of various authorities including NADRA, Federal Investigation Agency, Bureau of Emigration and Overseas Employment, all provincial revenue authorities and of Islamabad Capital Territory, local and development authorities, ,Excise and Taxation Departments, electricity suppliers and gas transmission and distribution companies etc with the restriction that it”shall be used only for tax purposes and kept confidential”. In addition, FBR has notified rules for 8 citiesmaking it compulsory for various services sectors and retailers to integrate online with its computer system for online sharing of transactions to determine their income and tax liability. Hopefully, in respect of medical sector, confidentiality of identity and details of patients shall be respected.

NADRA has developed ‘Tax Evasion Model (TEM)’ that is based on mathematical models and through data analytics can helpin broadening the tax base and detecting tax evasion or avoidance. The FBR in response to NADRA’s request to provide data regarding ownership of immovable properties, vehicles, bank accounts, investment in stock market and information of payment of utility bills etc, quoted restrictions in tax codes regarding confidentiality. After briefing by NADR Aabout TEM, FBR asked for improvements in the model and suggested seeking opinion from its legal department regarding permissibility of use of third-party data utilisation for broadening of tax base and identify tax payable by them.

The TEM developed by NADRA, covering 119 million Computerised National Identity Card(CNIC) holders of the country, uses main variables of vehicles, utilities, data ofPakistan Telecommunication Authority (PTA), travel history, arms licenses, and property purchases. It creates results in four different income categories and the estimated amount of tax the constituents in each category should pay. NADRA was told by FBR that section 216 of the Income Tax Ordinance, 2001 and other provisions of tax laws debar sharing data with it and for this a law would be required to create a waiver.

FBR and NADRA did not discuss the issue of data protection law that has yet not been presented before federal and provincial legislators. In the absence of data protection law in thecountry, even if a waiver is created for NADRA to get data from FBR, as created for various other authorities mentioned in section 216 of the Income Tax Ordinance, 2001, it will be in violation of the Constitution.

On the website of Ministry of Information Technology and Telecom, the text of Personal Data Protection Bill, 2020 [Consultation Draft V.09.04.2020] is available. Its preamble says:”A Bill to govern the collection, processing, use and disclosure of personal data and to establish and making provisions about offenses relating to violation of the right to data privacy of individuals by collecting, obtaining or processing of personal data by any means. Whereas it is expedient to provide for the processing, obtaining, holding, usage and disclosure of data while respecting the rights, freedoms and dignity of natural persons with special regard to their right to privacy, secrecy and personal identity and for matters connected therewith and ancillary thereto…”

It is essential to first create the infrastructure/capacity dealing with offences relating to violation of privacy, secrecy and personal identity and all ancillary and connected matters, provided in draft Personal Data Protection Bill, 2020 that needs further refinement

Sections 5, 6, 7 and 8 of the Personal Data Protection Bill, 2020 provide that the data collectors will have to communicate the purpose of sharing the data with the subject person. However, section 30 of this Bill provides exemption from such sharing, if the information is required for tax purposes. It is thus clear that both NADRA and FBR can only access/collect data after the passage of the Personal Data Protection Bill and establishment of Personal Data Protection Authority of Pakistan to regulate it as provided therein. This Authority shall have the responsibility to protect the interest of the data subject and enforce protection of personal data, prevent any misuse of personal data and promote awareness of data protection.

There are bona fide apprehensions that what is the guarantee of protection of personal data by FBR and NADRA? Usman Khilji, director of an advocacy forum for digital rights in his article, Data protection law,published on January 7, 2020, raised the following important issues/questions:

“The NADRA database, which holds the identity information of all citizens, has been subjected to hacking many times in the past, but there has been little transparency on the investigation of these hacks, whether an official was held responsible, and any consequences for those who failed in their responsibility of protecting citizens’ data.

This [Personal Data Protection Bill, 2020] should also cover protections against leakage of personal data of citizens, including of families of public officials such as judges, ministers and generals, which is abused for political purposes. Such breaches often occur through connivance of officials in public bodies.

The Bill also gives broad discretionary powers to the federal government whereby it can grant or revoke exemptions to data controllers, without a specified procedure. This also goes against the spirit of protecting data of citizens fairly”.

He suggested that instead of establishing a separate Personal Data Protection Authority of Pakistan, “The government would be better off using the already existing information commission, which functions to administer appeals under the right to information law, as is the practice in the UK under the Data Protection Act. This way, the government can utilise an existing body already working on a related matter-information requests-and legislate on its independence to avoid conflict of interest”.

In the light of above grounds (legal, technical and ethical), powers give to FBR, NADRA or any other department or agency to obtain or have real-time access of the personal data of citizens without first passage of Personal Data Protection Bill, 2020 are in violation of Article 14 of the Constitution. It is essential to first create the infrastructure/capacity dealing with offences relating to violation of privacy, secrecy and personal identity and all ancillary and connected matters, provided in draft Personal Data Protection Bill, 2020 that needs further refinement. The federal and provincial governments in the meantime must suspend the unbridled powers available to any authority working under them till the time the Personal Data Protection Bill, 2020 for protecting the privacy, security, abuse of data of citizens and all related aspects discussed aboveare debated publicly, before finallythis law is presented to the legislators for passing in accordance with the procedure provided in the Constitution.

The writer, Advocate Supreme Court, is Adjunct Faculty at Lahore University of Management Sciences (LUMS)