Explainer: Pakistan’s new social media rules

Social media companies have reacted against them
Nov 22, 2020
Photo: Samaa Digital
Photo: Samaa Digital

The government has just passed social media regulation rules, which have already attracted controversy. For example, now the government can get access to your WhatsApp conversations, if WhatsApp agrees to sharing your data.

They are called the Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards), Rules 2020. You can find them on the Ministry of Information Technology and Telecommunication’s website.

The Pakistan Telecommunication Authority has made these rules. It has the power to do this under Sub-section (2) of Section 37 of the Prevention of Electronic Crimes Act, 2016, which talks about “unlawful online content”.

The rules have come into force immediately.

Here are the important points and what they can mean for people who use the internet in Pakistan.


The rules say that no user or social media company, service provider, information system or a website owner can host, display, upload, modify, publish, transmit, update or share an online content that:

  • Belongs to another person or to which the user does not have any right to
  • Is blasphemous, defamatory, obscene, pornographic, pedophilic, invasive of another’s privacy
  • Violates or affects religious, cultural, ethnical sensitivities of Pakistan
  • Harms minors in any way
  • Impersonates someone
  • Threatens the integrity, security or defence of Pakistan or public order or causes incitement to any offence under the Act

The first point is vague and stops anyone from uploading basically any information about another person. No exceptions have been made for information that could be important for public knowledge, public interest journalism, etc, according to Digital Rights Founder Nighat Dad.

“…invasive of another’s privacy” is vague in the absence of a data protection law in Pakistan. Digital rights activists have repeatedly asked successive governments to make laws on data privacy, but no significant progress has been made. The law is supposed to say what is personal data for a person and what are the rules for who owns it and how and if government and private institutions can use this data.

According to the European Union’s General Data Protection Regulation definition, personal data is “any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.”

This means someone you can identify with a name, an identification number, location data, an online identifier or one of several special characteristics, which express the physical, physiological, genetic, mental, commercial, cultural or social identity of these people. For example, someone’s telephone number, credit card or personnel number, account data, number plate, appearance, customer number or address are all personal data.  

24-hour notice to remove content

Social media companies, service providers, owners of information systems or owners of websites have to remove any content within 24 hours of the PTA’s notice. In case of an “emergency”, they have six hours to remove the content.

The PTA rules say that community guidelines take precedence over any introduced by a social media company. It could also block an entire online system or any service provided by them.

The PTA may impose a penalty of Rs500million if there is no compliance.

Asad Baig, founder of Media Matters for Democracy, told Samaa Digital that the parent act, The Prevention of Electronic Crimes Act, 2016, has limited intermediary liabilities on social media companies. This means it does not implicate the social media company for the existence of objectionable content on its platform. But the new rules put criminal liability on the companies.

“A major company’s decision to come to a market depends on its potential and how much can the company earn from it,” he said. “In their statements in response to the rules, the social media companies have made it clear that they do not think Pakistan is such a market.”

Baig said that instead of introducing such rules, Pakistan should figure out ways to appease them to establish their offices here, considering this region has major economies such as India and China.

Social media companies told to establish a Pakistan office

The rules say that a service provider with more than half a million users in Pakistan shall

  • Register with the PTA within nine months of these rules coming into force
  • Establish a permanent registered office in Pakistan with a physical address, preferably in Islamabad, within nine months
  • Appoint a focal person based in Pakistan for coordination with the PTA to ensure compliance of its orders or directions and to receive any notices on behalf of the service provider or social media company in Pakistan within three months

The social media companies have already refused to open offices in Pakistan, when an initial draft of the rules was approved by the government in February.

In a statement Thursday, the Asia Internet Coalition, the technology company which speaks on behalf of major technology companies in Asia, said that the members are “alarmed by the scope of Pakistan’s new law targeting internet companies, as well as the government’s opaque process by which these rules were developed. The consultation that was announced in February never occurred.”

It said that the rules would make it “extremely difficult for AIC Members to make their services available to Pakistani users and businesses… we urge the Government to work with industry on practical, clear rules that protect the benefits of the internet and keep people safe from harm.”

Handing over data, opening data centres in Pakistan

The rules ask social media companies to provide subscriber information, traffic data, content data and any other information data in decrypted and readable formats.

WhatsApp chats, for example, are encrypted end-to-end. But under the rules, the social media companies will have to provide all details of a user’s data, chats, etc.

Social media companies have been asked to establish their data centre(s) in Pakistan, and store data within the territorial boundaries of Pakistan. A data centre is a network of computers and associated systems that store digital information of a particular company. A data centre outside Pakistan means the country’s law do not apply to the company. It also means that a limited amount of details about a user’s internet traffic and other data, even if they reside in Pakistan, will be available to Pakistan government.

This is why Pakistan asked users in June to register with their internet service providers if they wish to use VPNs. VPNs mask a user’s internet traffic so that information like their computer or mobile’s location is not visible even to the ISP.   

PECA Vs new rules

According to Nighat Dad, the rules go against their parent act, PECA. It bypasses the judicial authority, which has to provide a warrant for the Federal Investigation Agency to approach social media companies to procure data about a user. The new rules allow for direct complaints or requests for data to the companies.

The rules also include “intimidation” or any harm to the reputation of federal or provincial government or a public office holder, as objectionable content. This goes against Article 19 of the Constitution, said Nighat Dad. The Article 19 deals with the freedom of speech.

“Everything in the rules is vague,” says Asad Baig of Media Matters for Democracy. “They have tried to bring something parallel to PECA, to bring a new legal framework.”

Tabool ads will show in this div