TerraLex Cross-Border Guide to Global Crisis Management Regulatory Guide

In case of a data breach, the affected person should immediately report the incident to the National Response Centre for Cyber Crimes (NR3C) of the Federal Investigation Agency (FIA) (set to be replaced soon by the National Cyber Crime Investigation Agency) under the Prevention of Electronic Crimes Act, 2016 (“PECA 2016”). The report may be submitted in person at a regional office of FIA's Cyber Crime Wing, by post, via email ([email protected]), or through their website – https://complaint.fia.gov.pk/

Where the data breach incident involves a banking company, an electronic money institution, or a payment system operator, the matter should also be reported to the central bank, the State Bank of Pakistan (SBP). Similarly, in case of a data breach involving an insurance company or a non-banking finance company, the incident should be reported to the Securities and Exchange Commission of Pakistan (SECP). In the case of telecom companies, the incident should be reported to Pakistan Telecommunication Authority (PTA).

PECA 2016 i.e., the Prevention of Electronic Crimes Act, 2016. PECA 2016 mainly defines criminal offenses related to data breaches and punishments for these offenses. However, PECA 2016 empowers the court to make an order for payment of compensation to the victim for any damage or loss caused to the victim as a result of the commission of an offense defined in PECA 2016.

There is no specific legislation imposing liability for civil wrongs covering data breaches. However, in appropriate cases (for instance where a data breach has occurred due to negligence), the victim may claim compensation under the law of torts for any loss or damage caused to the victim. Similarly, where an entity is operating in a regulated industry, the relevant regulator may proceed against such an entity in case it fails to discharge any applicable data protection and cybersecurity requirements and may cancel its authorization or impose a fine.

Several agencies are empowered to conduct dawn raids either with or without obtaining search warrants. Below is a non-exhaustive list of such agencies and the laws under which they are empowered to conduct dawn raids:

• Securities and Exchange Commission of Pakistan (SECP)

  • Securities & Exchange Commission of Pakistan Act, 1997

  • Companies Act, 2017

  • Securities Act, 2015

• Competition Commission of Pakistan (CCOP)

  • Competition Act, 2010

• Provincial Labor Departments

  • Various provincial labor laws

• Environment Protection Agencies (EPAs)

  • Pakistan Environment Protection Act, 1997

  • Punjab Environmental Protection Act, 1997

  • Sindh Environmental Protection Act, 2014

  • KPK Environmental Protection Act, 2014

  • Balochistan Environmental Protection Act, 2012

• Federal Board of Revenue (FBR)

  • Income Tax Ordinance, 2001

  • Sales Tax Act, 1990

  • Customs Act, 1969

  • Federal Excise Act, 2005

  • Code of Criminal Procedure, 1898

• Provincial Revenue Authorities

  • Provincial fiscal laws including Sindh Sales Tax on Services Act, 2011, Punjab Sales Tax on Services Act, 2012, KPK Sales Tax on Services Act, 2013, and Balochistan Sales Tax on Services Act, 2013.

• Federal Investigation Agency (FIA)

  • Federal Investigation Agency Act, 1974

  • Anti-Money Laundering Act, 2010

  • Foreign Exchange Regulation Act, 1947

  • Prevention of Electronic Crimes Act, 2016

  • Code of Criminal Procedure, 1898

• National Accountability Bureau (NAB)

  • National Accountability Ordinance, 1999

  • Anti-Money Laundering Act, 2010

• The Police

  • Code of Criminal Procedure, 1898

• Provincial Food Authorities

  • Punjab Food Authority Act, 2011

  • Balochistan Food Authority Act, 2014

  • KPK Food Authority Act, 2014

  • Sindh Food Authority Act, 2016

A company may not be compelled to disclose to any court, tribunal, or other authority exercising judicial or quasi-judicial powers any confidential communication with its legal professional advisors unless such company offers itself as a witness. A company may also resist the seizure of any documents outside the scope of the search warrant.

Pakistan does not have comprehensive legislation at the national level for the protection of whistleblowers. A bill to enact permanent legislation in this regard, the Whistleblower Protection and Vigilance Commission Act, 2019 (“WPVCA 2019”), was introduced in the Parliament in 2019. However, it has not yet been enacted. The WPVCA 2019, upon its enactment, will protect an employee reporting alleged wrongdoing by the holder of a public office in Pakistan.

Under the draft WPVCA 2019, to be entitled to the statutory protection provided thereunder, the whistleblower must make a personal declaration stating that he or she reasonably believes that information disclosed by him or her and allegations contained therein are true to the best of his or her knowledge and belief. The whistleblower should disclose his or her identity. Furthermore, the disclosure of information must be made in writing or by electronic mail or electronic mail message and must be accompanied by all supporting documents or other material, if any.

Certain regulations issued by the corporate regulator, the Securities and Exchange Commission of Pakistan (SECP), cast an obligation on each listed company to adopt comprehensive whistleblowing policy and establish a mechanism to receive and handle complaints fairly and transparently while protecting the complainant against victimization. The circumstances under which an employee of a listed company may be entitled to protection will depend on the whistleblowing policy adopted by that listed company.

Competition Commission of Pakistan (CCOP) has also made certain regulations which require that the identity of an informant who informs it about a prohibited activity will be kept confidential.

After enactment of the WPVCA 2019, a whistleblower will be entitled to the following statutory protections: - The identity of the whistleblower shall not be disclosed to anyone except with his or her written consent;

• In the event of recovery as a result of the information disclosed by the whistleblower, he or she shall be rewarded with 20% of the recovered amount and a certificate of appreciation; and

• A whistleblower shall not be victimized by any Disadvantageous Measures or otherwise solely because he or she had made a disclosure or assisted the investigating agency. Disadvantageous Measures include: (i) removal from office, dismissal, or other penal action equivalent to the loss of status at work; (ii) disciplinary action, suspension from office, reduction in pay, demotion, or other similar personal action; (iii) work reassignment, transfer, denial of duties; (iv) discrimination in performance evaluation, payment of wages and bonuses, etc.; (v) intimidation; and (vi) bullying, use of violence or abusing language, and threatening with the Disadvantageous Measures.

The Pakistan Penal Code, 1860, the Prevention of Corruption Act, 1947, and the National Accountability Ordinance, 1999.

Yes, but only in relation to the citizens of Pakistan.

National Accountability Bureau (NAB) Federal Investigation Agency (FIA)

In general, a company is not under a legal duty to report the issue to the regulator or the relevant law enforcement agency. However, while deciding whether to report the issue, the company must consider the consequences of non-reporting the issue, in particular, whether its decision not to report the issue could be construed as an attempt to conceal an offense, or abatement of an offense, or an attempt to destroy the evidence.

The companies operating in certain regulated industries such as banking and financial services may be required to report certain issues to the relevant regulator. For instance,

• Under the Anti-Money Laundering Act, 2010, certain regulated entities must report to Financial Monitoring Unit (FMU) transfers of funds exceeding a specified limit or submit a suspicious report where there is suspicion that a transaction is related to criminal activity.

• Banks and financial institutions regulated by SBP must report any incidents of fraud, theft, breach of security or data, etc. to SBP through certain statutory returns to be filed at regular intervals.

• The provincial occupational health and safety laws require the employers to notify the provincial labor department of the safety incidents, such as the death of a person.

• The listing regulations of the Pakistan Stock Exchange contain certain reporting requirements for the listed companies.

The documents generated as part of an investigation will be protected from disclosure if they are covered by the legal professional privilege, i.e., any confidential communication between authorized representatives of the company and its legal professional advisors during the investigation. However, the privilege may not be extended to any confidential communication exchanged with an in-house counsel.

The legal professional privilege extends only to legal professional advisors i.e., the persons legally entitled to practice the profession of law. In Pakistan, only the advocates are entitled to practice the profession of law. However, an advocate is prohibited from engaging in any other profession, business, or employment. Since an in-house lawyer is a full-time employee of the company, he cannot simultaneously be an advocate and may not be deemed the legal professional advisor of the employer company. Therefore, it appears unlikely that the legal professional privilege will extend to the advice given by an in-house lawyer. However, there is no definitive court judgment on this issue.