IT has been two decades since British mathematician Clive Humby coined the phrase ‘data is the new oil’. The world’s largest companies — from Google to Facebook and Apple — were amassing large amounts of data on user desires and behaviour. This meant that these companies increasingly had more and more power to predict how people would behave. Think of it like a massive intelligence network to which users were willingly giving information about themselves all day.
In Pakistan, people do not always take these risks seriously. The assumption is that because Pakistan is not as heavily digitised as the West, there is less reason to worry about who has your data and what they do with it. The idea that one’s identity and the data attached to it is accessible to someone else is not something that has worried a lot of Pakistanis. Companies like Apple and Amazon that together have so much data on so many consumers in the West do not yet have that kind of penetration in Pakistan. As a result, these two behemoths, who have information on everything from a consumer’s heartbeat and activity and sleeping habits to the food present in his refrigerator, do not dominate the Pakistani consumer’s life.
However, Pakistan is fast moving towards digitisation and connecting identity to behaviour. One of the earlier examples of this is the Computerised National Identity Card (CNIC), which, today, is necessary for everything — from owning a cellular phone to opening a bank account. A couple of decades ago, the shanakhti card was rarely used unless one had to get a driving licence or register a marriage, or do something similar. Now a CNIC number is required across the board for banking, travel, buying property, university admissions, etc.
Pakistanis are increasingly turning to electronic banking and entrusting their data to networks and servers to access their money. However, according to at least one cybersecurity analyst the systems used by even some top financial institutions can be hacked. A password system was tested to reveal how reliance on old-style passwords, instead of passphrases, could constitute a vulnerability in the system. This is because AI-fuelled and OSINT (Open Source Intelligence) credential guessing make it easy to crack passwords.
Pakistan hasn’t kept pace with the demands of data protection.
Furthermore, the absence of two-factor authentication — which “verifies a user’s identity by asking for two pieces of proof, such as an online account password and a one-time passcode” — is not routinely enforced across many digital platforms, including apps and websites, in the country. This means that it is easy for someone else to log into your account and potentially steal your money. It is especially easy for criminal elements who use unsecured Wi-Fi networks to harvest data which is being transmitted.
The point is that data is increasingly important and Pakistan is behind the times when it comes to its protection. CNIC numbers can be fraudulently utilised by criminals — who are guilty of stealing one’s legal identity — for all kinds of unlawful activities.
At the moment, Pakistan has not legislated on data protection. As lawyer Salma Khan noted in her article earlier this month, the Personal Data Protection Bill has been languishing in parliament since 2018. Consequently, there are no minimum standards with which financial institutions and utility companies that have your data must comply in order to protect your information. This means that, in the absence of a set policy of compliance, companies have no incentive to invest in foolproof cybersecurity for their customers.
Fortunately, the courts have given us some hope. In a recent landmark decision pertaining to bank fraud, the Lahore High Court ruled, according to a report, that “customer data entrusted to a bank constitutes ‘property’ under the law and its dishonest misuse may amount to criminal breach of trust”.
According to the court, bank employees who had access to sensitive financial information could be held liable for its misuse. While this is helpful, it still leaves consumers very vulnerable to someone other than bank employees misusing that data.
As Pakistan digitises and data becomes a powerful resource (like oil) it is imperative that people understand the consequences of the information they transmit, enter and freely provide to companies via the internet. Knowing who you are, what you do, where your money is and what you desire is all possible just by looking at your phone. And those who know everything about you can, in the end, control what you do.
The writer is an attorney teaching constitutional law and political philosophy.
rafia.zakaria@gmail.com
Published in Dawn, August 22nd, 2026
