Lawless digital dreams

What good is a digital revolution if the law never arrives?

Pakistan speaks with urgency about building a technology-driven economy. It sets ambitious export targets, hosts tech summits, and courts foreign investment. Yet behind this narrative lies a stark and uncomfortable truth: the legal and institutional infrastructure needed to sustain digital growth is fragmented, outdated, or in some cases, absent entirely.

That absence is not abstract. It has measurable consequences.

The technology sector has shown promise. IT exports have crossed three billion dollars in just ten months. The government hopes to triple that figure within five years. Startups are emerging with confidence. Venture capital interest, though cautious, is returning. Global companies are evaluating opportunities. On paper, it all looks like momentum.

But that momentum is fragile.

Multinationals are not just hesitating. They are leaving. Microsoft has quietly relocated its regional operations to jurisdictions with clearer regulatory regimes. Uber has exited. Careem is discontinuing its ride hailing services. These decisions are not anecdotal. They reflect systemic discomfort with Pakistan's regulatory climate: unclear licensing frameworks, inconsistent policy enforcement, foreign exchange restrictions, and delays that outlast business cycles. Regulatory opacity has become an operational risk.

When the system does work, it feels like a favour rather than a norm. The entry of Starlink into Pakistan is being cited as a breakthrough. But even that required direct intervention by the Prime Minister's Office. The project was approved through cooperation between PTA, SECP and SUPARCO. These permissions were granted under the National Satellite Policy 2023 and the Space Activities Rules 2024. It worked. But the lesson here is not just about success. It is about how much political capital is needed to make the system function.

Personal data protection remains another glaring void. After years of public consultation and multiple bill drafts, Pakistan still lacks a comprehensive data protection law. As a result, citizens' data is collected, shared, and sometimes misused without recourse. Businesses operate in a grey zone. There are no statutory rights, no oversight authority, and no clear obligations.

Contrast this with the European Union's General Data Protection Regulation (GDPR). That law grants enforceable rights to data subjects, creates independent data protection authorities, and imposes steep penalties for noncompliance. Even India, often a regulatory peer, enacted the Digital Personal Data Protection Act, 2023, marking a clear move toward rights based governance of data. Pakistan, by comparison, has made little progress. The delay is no longer technical or procedural. It is political.

Legal inertia also undermines the constitutionally mandated principle of lawful executive discretion. The Supreme Court has held that even in matters of national security, executive action must be grounded in valid legal authority. Surveillance, data collection and algorithmic profiling in Pakistan occur without this foundation. That alone should worry us.

Artificial Intelligence is no longer theoretical. Banks are using it to score credit. Employers rely on it for screening applicants. Government agencies experiment with predictive surveillance. And yet, there is no regulatory framework governing AI use. No law demands algorithmic transparency. No tribunal hears complaints about machine made decisions. No requirement exists for public agencies to explain how these tools are used or why.

This legal silence has human consequences. A qualified applicant may be rejected due to a flawed algorithm. A facial recognition tool may misidentify a protester. A credit scoring system may entrench bias. Without legislative guardrails, these systems operate without scrutiny or remedy.

The global contrast is stark. The EU AI Act, passed in 2024, categorises AI systems based on risk and imposes obligations accordingly. In the United States, federal agencies have issued AI risk management frameworks that prioritise civil liberties. Pakistan, meanwhile, has not even initiated a public consultation process. The legal vacuum is complete.

Then there is intellectual property. It is an area rapidly destabilised by generative AI. Tools can now produce music, images, film scripts and software code. But Pakistan's Copyright Ordinance, 1962 offers no guidance on authorship, originality or infringement in AI generated content. The law predates digital technology. It is silent on questions now central to creative economies.

Compare this with the position in the United States, where the Copyright Office has clarified that purely AI generated works are not protectable unless there is substantial human input. That principle may evolve, but at least there is one. In Pakistan, the absence of legislative debate leaves creators, platforms and investors in legal limbo.

Reform is overdue. The Copyright Board, empowered under the Ordinance, must be reconstituted with expertise in digital innovation. The legislature must define "authorship" and "originality" in light of evolving technologies. Without it, innovation will migrate elsewhere.

Even the judiciary, which should lead in defending constitutional rights and settling digital disputes, remains underprepared. Some high courts experimented with video link hearings during Covid-19. But most courts still rely on paper files, face logistical backlogs, and operate without digital case management systems.

This is not just a matter of convenience. It affects access to justice. Legal challenges involving cryptocurrency fraud, data privacy breaches or AI based discrimination require fast, informed adjudication. Judges need training. Courts need infrastructure. And citizens need a system that understands the complexity of digital disputes.

Other jurisdictions have shown what is possible. Singapore's judiciary is fully digitised. Kenya and Romania have introduced hybrid models with remote proceedings and online document submission. These are not tech utopias. Just examples of what political will can achieve.

What, then, must be done?

Parliament must enact a strong and enforceable data protection law, overseen by an independent data authority. It must initiate AI legislation that mandates transparency, accountability and redress. The Copyright Ordinance must be modernised to reflect 21st century realities. Courts must be digitised as part of a coordinated national justice reform programme.

Most importantly, digital governance must be coherent. It cannot be cobbled together through ministerial memos or ad hoc taskforces. The federal cabinet, judiciary, regulators and provincial assemblies must align on a national legal roadmap.