A Data Protection: A Comparative Legal Analysis between European Union & Pakistan

Abstract

This paper compares and contrasts General Data Protection Regulation of the European Union and the Pakistani Personal Data Protection Bill 2023 in the context of the law behind them, their scope, rights of the data subjects, enforcement provisions, and the regime of cross-border data transfer. The paper, based on a qualitative approach to doctrine, assesses the way both theories respond to the contemporary privacy issues and govern the processing of individual data in a growing interconnected digital world. Whereas the GDPR is a well-advanced rights-focused framework based on the core EU principles, the PDPA 2023 in Pakistan is an emerging framework with influences on international standards but shaped by the national security and sovereignty factors. Among the main areas of similarity, the analysis identifies the identification of core data-subject rights and the necessity of having a legal and transparent processing. But it also finds significant discontinuities especially on regulation independence, data localization requirements, adequacy evaluation, and the balance of state power and personal privacy. On the other hand, the paper suggests that the Personal Data Protection Bill 2023 shares several characteristics with the GDPR, but that the Bill's limitations on cross-border transfers and the wide discretion authorities given to the government in the exercise of its powers may be problematic for effective implementation. To build an effective and rights-protective data governance regime in Pakistan, institutions need to be able to have autonomy and interoperability with the rest of the world.