By Nimra Ishfaq
The internet is usually glorified as ‘the flattener’ of inequalities and ‘the microphone for the masses’. While 62 percent of the global population (and 54 percent in Pakistan) have access to the Web, governments all over the globe are trying to regulate how people interact in virtual spaces by passing bans on certain kinds of speech, demanding for stronger AI filters and pushing for data localization laws.
In September, Freedom House published a report affirming the global decline in Internet freedom due to unprecedented levels of interventions by governments. It was also reported that bans on speech were the strongest in the past year, as the Internet was shut down in 20 countries, and various social media applications were banned in 21 others. With about forty new laws introduced worldwide to regulate social media, it has been seen that governments like the UK, Russia, India, China and Pakistan, are planning to localize the storage and management of data on social media and e-commerce websites. This trend of data localization has the potential to not only restrict investors, but also have an adverse effect on personal freedoms by allowing unprecedented powers to governments to remove and block users and barring free exchange of ideas. Globally, as governments are trying to control the flow of data within and outside country borders, Pakistan has recently also joined the lineup.
Pakistani laws and freedom of speech
The current manifesto of the government focuses on Pakistan moving towards a ‘Digital Pakistan’ which will transform the social and economic lives of the country’s citizens parroting developments in more tech-advanced and neighbouring countries. However, the new legislation mimics the Chinese model, which heavily surveils users and restricts access to content that may go against ‘national interest’, the Chinese Communist Party’s policy on religion, allow space for protests or challenge CCP’s protectionist economic framework. On the ground, most Pakistanis are not aware of the resources they have been barred from viewing, including 980000 websites at the beginning of 2021.
The Snowden revelations affirmed that many governments are violating citizen privacy. The Pakistani government was also accused of using geo-fencing and call-monitoring software and the spyware system was later revealed to lack any legal regulation. Last year, the Pakistan Telecommunication Authority (PTA) also used tracking software to warn citizens about potential exposure to COVID-19. In 2019, the organization also purchased Canadian software that monitors online activity and web traffic.
The most recent draft of the “Removal and Blocking of Unlawful Online Content (Procedures, Oversight, and Safeguards) Rules 2021” seeks to regulate user activity online and requires social media companies to submit any information sought by investigative bodies. The Rules go beyond its parent act, Prevention of Electronic Crimes Act 2018, by ascribing PTA with powers to issue orders for removing content on any information system it deems illegal, and the only body that can review these decisions is the PTA, although appeal with High Court is possible. The undefined parameters of the power thus given to the entity leave immense room for exploitation and infringe the fundamental rights of citizens in the country. The Rules further make it obligatory for platforms to remove certain content, both before and after publication, within 48 hours. In cases of emergency, the content must be removed within 12 hours. The law makes it legally incumbent to stop the publication and access to certain types of content after, prior to and during publication (as in the case of live streaming) by not only removing individual pieces of content but also blocking entire information systems. This process also gives no space for appeal to content creators and publishers.
While some argue that the Rules will make social media companies more accountable to the government, the proposed rules violate the Article 19 and 19A of the Pakistani Constitution, which guarantee the right to freedom of speech and unhampered access to information respectively. It is notable that the Constitution makes an exception towards four kinds of content, which includes material that defies “the interest of the glory of Islam or the integrity, security or defense of Pakistan or any part thereof, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, commission of or incitement to an offence.” The vagueness of terms like “decency”, “morality” and “integrity” leaves unreasonable room for exploitation for realizing political and discriminatory ends.. This vagueness combined with the anonymity given to the complainant (which may include any government department, law enforcement official or aggrieved citizen) compromises the principles of transparency and reasonableness that must be practised for citizen-friendly legislation.
Furthermore, the Rules and PECA both criminalize content that may cause ‘interfaith disharmony’, with the latter even defining such material as an attempt at ‘cyberterrorism’. The law leaves a lot of room for interpretation, while punishing online activities.
This increase in censorious regulations coincides with mandates for Social Media Companies to register with the PTA, which can have excessive powers on removing content. Non-compliance with the Rules can also lead to a penalty of 500 million rupees. This compulsion requires that the individual compliance and grievance officers, who cannot practically handle the load of complaints from a country, address issues within a span of 7 working days. Inability to address these issues within the given timeline would guarantee punitive action from the PTA. Interestingly, this is a direct contradiction of PECA, which specifically gives protections to intermediaries (SMCs) against being held liable for regulating content posted on their platforms.
Regulations of Speech Abroad
With the unprecedented rise to power of Xi Jin Ping, China continued to worsen its repression of Internet freedoms in 2021, as the Chinese government cracked down on activists and journalists reporting on the pandemic, blocked social media apps (such as the encrypted social media app called ‘Signal’) and prevented any scrutiny into the country’s role in the spread of the Coronavirus. China is notorious for having some of the world’s most powerful censorship laws, also dubbed as the ‘Great Firewall’, which the US government has consistently critiqued for its control on any ideologies that may incite Chinese rebellion and regulation of foreign investors.
The Chinese Cybersecurity Law and Antiterrorism Law impose heavy fines and half month-long detentions for ISPs and officials for failing to remove particular content and block services against whom complaints have been lodged. The Cyberspace Administration of China regularly renews the guidelines for blocking content that may be ‘harmful’ for the moral fabric and national security of the country, which includes prosecuting protest organizers for ‘causing trouble’. Laws policing defamation and divulgence of state-secrets are used to punish Internet users, who may even be prisoned for three years under the former. China has also doled out life sentences to people who express heterodox religious beliefs. In 2015, however, the maximum prison sentence was limited to fifteen years. The same amendment also introduced the penalty of seven year-long jail terms for disinformation. 2021 has similarly seen bans against ‘defaming’ national heroes, martyrs and the military particularly.
Recently, Russia reaffirmed the strength of its strict censorship laws by banning the media outlet whose journalists were involved with the Pandora Papers. The country has multiple censorship laws that also police any ‘act of disrespect’ against the government, judiciary or other justice officials and content judged to spread hatred, false information and defamatory accusations, with particular mention of the Soviet Union’s position in the Second World War. Russian laws also impose hefty fines (78,000 dollars) on media outlets spreading ‘false’ information. The country also proscribes the dissemination of ‘extremist’ and ‘separatist’ statements. Those found engaged in ‘extremist activities’ may find a place on a federal monitoring list and might be banned from pursuing particular careers. The state is also empowered to block websites which do not address its concerns regarding content published online within the span of 24 hours. Recently, the Yarovaya Law introduced an amendment that imprisons users posting calls for or justifying terrorism. The change effectively threatens nonviolent online expression.
India also uses spyware to monitor and censor journalists, social workers and members of the opposition. Aside from employing the Israeli surveillance software Pegasus, it has also developed a Central Management System that can obstruct online activity. The state continues to ban Chinese apps and shut down access to the Internet purportedly for maintaining public safety and preventing cheating in exams. It is notable that the Internet was also cut off during farmers’ protests in Delhi. In 2020, the government revealed plans to build a database of citizen’s status of employment, number of children, landholdings and so on, raising concerns regarding privacy and data protection.
Interestingly, India has a strong commitment to preserving net neutrality. However, Indian Internet users are still affected by existing laws that criminalize certain kinds of speech. Individuals often suffer at the hands of anti-defamation laws, laws designed to curb ‘obscenity’ and ‘curb enmity’ between religious, ethnic and racial groups, sometimes leading to imprisonment for two years, fine or both. Similar laws also police statements that may cause public unrest. Both Pakistan and India are yet to overturn colonial era sedition laws, which police dissent against the state, and anti-espionage laws, which were also introduced by the British to protect state secrets.
Data Localization and Privacy
In August of 2021, Pakistan’s Ministry of Information Technology and Telecommunication released the fifth draft of the Personal Data Protection Bill 2020 (“PDPB”), which requires localization of user data and grants broad discretionary powers to the government and law enforcement for accessing the same. While PECA contains certain clauses proscribing unauthorized access to user data, it does not recognize the fundamental right to privacy. Simultaneously, the Rules reinforce the breach of citizen privacy enabled by the PDPB by requiring Social Media Companies to create local server databases for the storage and management of user data. Firstly, this mandate is a potential setback for the country’s digital economy, as companies are reluctant to create offices amidst circumstances that create uncertainty, particularly through arbitrary blocking of information systems. Secondly, it creates a serious challenge for citizen safety in a country where online presence can lead to harassment and violence from both society and the state.
Like its Pakistani counterpart, Indian Personal Data Protection Bill 2019 grants access to law enforcement agencies to data that may aid ‘criminal investigations’. In 2018, when the laws were first presented publicly, they required all data to have live copies on local storage. However, later, this was amended to require the storage of only particular ‘sensitive data’ with the consent of the user. The government has full authority of defining what constitutes ‘critical’ or ‘sensitive’ data in this context. This requirement disregards the fact that users usually are unaware of the actual scope of how their data may be used after they give ‘informed’ consent. Users are also largely unaware of any technical or policy changes that may impact them.
Simultaneously, the China Cybersecurity Law 2017 exercises unconditional control on all types of ‘critical’ and personal information, which must be processed and stored within the country. While there is no national definition of what constitutes ‘critical’ information, there have been some efforts at the provincial level to include state and military secrets as subjects of concern. The Data Security Law passed in 2021 further defines the concept of ‘national core data’, which includes data related to matters of public interest and will be regulated more strictly than other types of data. It also empowers local governments to create catalogues of significant data and imposes penalties (1 million yuan or 156438 dollars) on third parties who fail to process data within Chinese borders. Interestingly, the Hainan government has recently proposed to reduce the rigidity of data localization laws in certain sectors to encourage free trade. This proposal is the result of the 6.8 percent decline China’s GDP suffered due to COVID-19.
While China’s data localization laws receive heavy censure worldwide, the EU is lauded for creating a ‘gold standard’ for laws in this context. Aimed at maintaining the right to privacy, the European Union passed the General Data Protection Regulation (GDPR) in 2018. The GDPR restricts the transfer of personal information only to those non-EU countries who mirror EU standards for data processing – an approval subject to periodic review. It requires that third party countries maintain confidentiality and transparency, while only processing information for the purpose agreed on. In case of failure to comply with set standards, the GDPR imposes a high penalty, which may go up to 20 million euros or 4% of global revenue, whichever is higher. Access to this data is given based on unambiguous consent, which again places an immense burden of knowledge on the user. These laws can also curtail trade with other countries, especially the US, by creating a riskier economy for third countries.
The way forward
We currently live in a world where companies like Facebook have been neglecting the socio-political and mental health turmoil caused by algorithms, and states are trying to surveil at the expense of personal freedoms. So far the laissez-faire approach has done nothing to curb trends that can lead to violence in real life, it is important for people to ask for more policies that define specific contexts, illegalize spyware and start discourse around a data economy they are just beginning to understand. It is also requisite to uphold internationally agreed upon right to privacy and freedom of thought and expression in virtual spaces if we are to protect the intended purpose of the Internet as an equalizer, and not a tool of authoritarian and postcolonial states.
