IT ministry coy as Asia Internet Coalition raises red flags on govt’s data localisation plans

ISLAMABAD: The Asia Internet Coalition (AIC), a regional ICT policy group, has said the government’s plans for data localisation will do more harm than good.

The coalition presented its report ‘Data Localisation in Pakistan’ at a round table on data protection & digital economy held at the Ministry of IT and Telecommunication on Thursday.

The ministry’s statement issued after the meeting, attended by representatives of AIC, Google and Meta, made no mention of the report or its contents but said that a discussion was held on data localisation with the participants giving recommendations for data hosting and data sensitivity.

Minister of State for IT and Telecommunication Shaza Fatima Khawaja called data regulation and cybersecurity “topmost priorities of the present government” and expressed commitment to achieve the $25 billion IT exports target, the ministry’s statement added.

Official statement skips mention of risks highlighted in coalition’s report

Ms Fatima added that the private sector is being “fully supported and facilitated” and that steps are being taken to transform Pakistan into a digital economy. However, the AIC report exuded less optimism about the government’s plan of binding IT companies to have local data centres.

The move is expected to lower productivity, increase the cost of doing business for IT companies, and lead to unemployment, the report warned.

While talking to journalists after the roundtable, the report’s author, Rohan Samarajiva, said data localisation has serious implications for the industry as local companies cannot compete with the cloud services of global giants like Google and Amazon.

Lower productivity and threats

The report estimated that data localisation will reduce labour productivity by 4.7pc in 2025 if the Personal Data Protection Bill based on its May 2023 draft is enacted this year.

The restriction of cross-border data transfer will result in a potential loss of 3.2 million jobs and a GDP loss of $16.5 billion in the year after the enactment.

If forced to come to Pakistan, the global cloud service operators would face a shortage of human resources skilled in data handling and management as there was a skill gap in the local market.

“[The] competence required for running data centres is currently missing in Pakistan. Establishing and operating data centres requires significant levels of competence for various tasks such as ensuring security and handling demand surges,” the report noted.

Another concern expressed in the report, and also raised by its author, Mr Samarajiva, was the threat of cyber attack.

“[T]he most serious issue of forcing data localisation would be vulnerability to cyber threats as all key public and private data will be stored in a single location — making it a lucrative target for the hackers,” he added.

The report referred to Pakistan’s public IT structure’s vulnerability to cyber attacks, with key organisations, including Nadra and FBR, being targeted in coordinated cyber attacks which compromised the data of millions of Pakistani citizens.

Published in Dawn, August 2nd, 2024