The inviolability of fundamental rights is asserted as a given when considering the social contract between franchised adults of a country and its governing class. Unfortunately though, this has remained more of an urban myth as across governments and decades, the shift to digital authoritarianism has been clear, heavy-handed and hostile. A clear example is the recent spate of cases registered with FIA under Pakistan’s PECA law, including that against singer Salman Ahmad, formerly of PTI and Junoon, for sharing content against state institutions, and the arrest of the activist Jalila Haider.

Civil society and activists have waxed poetic about the shrinking of civic spaces, a subtle way really, to name the suffocation felt across the board due to the ever-increasing curbs on free speech and expression.

Attempts at regulating online spaces have been chaotic, to say the least. The state’s approach, since the naughts, has been to hunker down, pull up a draft that one only hears about but cannot seem to find as a matter of public record, and push for impractical timelines that do not make room for any progressive manner of consultation with the necessary stakeholders. Any calls for feedback or dates set for meetings to gather input have resulted in what can only be described as a pattern of performative eyewash.

It can be said that lawmaking in Pakistan is a prolific business; however, it is not always a democratic one.

This sentiment, particularly the latter end, is echoed in the hullabaloo surrounding the recently tabled and widely protested Prevention of Cyber Crimes Ordinance 2025, a heavyweight development in the digital rights landscape of the country.

While its predecessor, the Prevention of Electronic Crimes Act (PECA) 2016 was deemed the mainstay of cybercrime governance in Pakistan until now, it too was certainly not the first on the scene, having been preceded by the Electronic Transactions Ordinance (ETO 2002) and the Monitoring and Reconciliation of Telephony Traffic Regulations 2010. In fact, PECA 2016 itself was the second cybercrime framework, having followed the PEC Ordinance 2007, which lapsed in 2009. The re-promulgation of PECO 2009 was, ironically enough, opposed by MNAs from what is now the current ruling party (PML-N) as their fear was adequately encapsulated in an article titled ‘Peco to turn Pakistan into police state`.

We seem to have moved leaps and bounds ahead of this sense of trepidation, having seen the consequences of unmitigated control and nearly boundless power being accorded undemocratically, in real time, over the past 8 years since PECA has been in effect.

The primary concerns with the law rest in its status as a double-edged sword, simultaneously purporting to afford protection whilst wresting away citizens’ access to their fundamental rights, primarily pertaining to their privacy and freedom of expression, as evidenced by the recent arrest of journalist Farhan Mallickwho runs the online platform Raftar Media. Key provisions of the law that were opposed by activists and civil society foremostly include the infamous section 37 which allows for removal or blocking of whatever is considered to be ‘unlawful online content’ by the Pakistan Telecommunication Authority (PTA), the parent authority for PECA. This vague and overreaching classification has done exactly what was hypothesized and raised as the rationale for its revocation: it has allowed the state to exercise the most arbitrary set of controls over Pakistani citizens’ use of the vast playground of the internet. The most obvious example is the now 1 year-old ban on X, a platform known widely for its impact on the amplification of social justice movements and being an alternative to censorship faced by traditional media.

A close second, in terms of grave concerns flagged by international watchdogs as well, is Section 32 which directs service providers (including telephonic and internet) to retain traffic data of citizens for a minimum of one year, or more as per the directions of the Authority (PTA). The abject lack of transparency and a complete absence of the concept of open governance bookends the existing and obvious concerns about data privacy, the reconciliation of which interestingly enough does not come up in the 2025 draft of the Personal Data Protection Bill put forth by the Ministry of IT, save for a vague provision in section 75 which does away with the responsibility of ensuring jurisdictional harmony by allocating it to be solved by a Joint Working Group.

The period between the two controversial cybercrime legislations was itself fraught with numerous attempts and unfortunate successes in the field of so-called digital governance. 2018 brought about the first iteration of the Personal Data Protection Bill, which was so rife with incompetent drafting that the term consent, one of the main legal basis for processing personal data, was not defined within it. Once again, this draft showcased the will or lack thereof, of the policymakers in protecting critical personal data of Pakistani citizens as did its succeeding versions which came in with minor improvements while avoiding bequeathing actual autonomy to the proposed National Commission for Personal Data Protection (NCPDP) (now the Personal Data Protection Commission) and allowing ultra vires powers to the federal government which have come through in the current version as well.

This was followed by the launch of the Citizens Protection (Against Online Harm) Rules, 2020, a largely criticised proposal created under the auspices of PECA 2016 and PTA (Re-organization) Act 1996, that made a bid to control popular social media platforms utilized by Pakistani citizens. One of the key concerns was the assault on free speech and Article 19 of the Constitution made actionable by Rule 4 which set out conditions bound by the aforementioned section 32 of PECA, in essence asking social media companies to ‘remove, suspend or disable access to such online content’ which is ‘in contravention of any provision of the Act, or any other law, rule, regulation for the time being in force’.

The Rules made way for the next installment of unhinged regulatory practices, the Removal and Blocking of Unlawful Online Content (RBUOC) Rules 2021, whilst the 2020 Rules were never officially denotified. These Rules were once again posited to go beyond the ambit of PECA and challenged as unconstitutional in court, with specific references to the right to access to information and freedom of expression. A key concern, as had and has been the case with lawmaking in the country, was the dubious nature of the consultative process. To put a finer point on it, it was at best, an eyewash to quell the backlash being raised by concerned citizens and activists.

A pattern then, is easily discernible here; one of control.

The shiny new vehicle for the state’s clampdown on civic rights comes dressed as a saviour for the catchall term of “fake news”, as criminalized under section 26A. The Ministry of IT worked in what for them is record time to first vow to amend the existing cybercrime law, and then actually table the Bill in the National Assembly within the month, having passed through both legislative rounds a mere week later. It is pertinent to note that this is the same authority that has been debating the legislation of the personal data protection framework for over 7 years while crucial personal data of citizens remains unprotected and largely at risk.

Just as with the current U.S President’s notorious use of condemning unfavourable media coverage under the same moniker - “fake news”- there are glaringly problems with allowing such an ambiguous term to carry such weight in terms of sentencing (three years) and fines (up to 2 million rupees).

It is then vitally important to recognize the impact that arbitrarily purposed, understood or adjudicated content can have on civic spaces, media freedoms and the overall progress of the country at large, especially in terms of its international obligations, such as those imposed by its ratification of the International Covenant on Civil and Political Rights (ICCPR).

The law contains many other worrying provisions, including the addition of the term “aspersion”, which is a return to the criminalization of defamation, deemed unconstitutional when section 20 of PECA was struck down on account of carrying the same subject matter. Additionally, the law goes on to reiterate the power to ban social media platforms (which has now been expanded to include “communication channel” and “tools to access social media” as well) and establish yet another authority, the Social Media Protection and Regulatory Authority, adding to the already rampant confusion on ambit and jurisdiction created between the numerous legislative onslaughts the country has seen in the past few years. This is heightened in the face of frankly ludicrous instances, such as the filing of a case under PECA’s hate speech clause (section 11) against a social media user from Bannu, who expressed an opinion critical of those scholars and/or officeholders who determined the announcement of the commencement of Ramzan, as reported by BBC Urdu. Or the equally confounding incident leading to the booking of a shop owner in Rawalpindi for filming a video that was purportedly ‘shared to incite public hatred against the traffic police’ as per the FIR, reported by Geo News.

It is all too well that lawmakers in Pakistan purport to emulate global standards in pursuing national legislation. However, just as with the European Union’s GDPR and the various iterations of our Personal Data Protection Bill, it is not enough to simply slap on similar text to our own drafts, while excluding key rights, customarily trampling on fundamental freedoms, excluding stakeholder involvement and consultation in lawmaking, or ignoring the lack of infrastructure present to practically ensure the deliverance of those very rights.

For a law and its every iteration to be branded as restrictive, draconian and an abuse of power, especially as evidenced in the state’s actions these past few months since the passing of the 2025 PECA Amendment, not much can be said in the way of its saving grace. It is a somber moment in this country’s history, buoyed only by the resistance of a select few. It is critical now more than ever for our history lessons to kick in and afford us all a collective conscience and a united front in the face of this dystopia.