Authored By: Zainab Faheem Khan
Institute of Law - University of Sindh
Introduction
Pakistani law has always been comfortable moving slowly. Constitutions are written to endure, and courts, by temperament, prefer settled doctrine to sudden reinvention. That caution served the country reasonably well for decades. It does not serve it well now. Artificial intelligence has moved into hospitals, banks, newsrooms, police stations, and phones across Pakistan, faster than Parliament has moved to regulate it, and the gap between what the technology does and what the Constitution anticipates keeps widening.
This is not a uniquely Pakistani problem. But it is a uniquely urgent one here, because Pakistan combines three things at once: a written bill of rights that predates the internet by decades, a national identity and biometric infrastructure among the largest in the world, and no operative data protection statute at all. The Personal Data Protection Bill has sat in draft since 2023.1 The National AI Policy, approved by the federal cabinet only in July 2025, is a policy statement rather than binding law.2 Meanwhile, facial recognition, algorithmic credit scoring, and automated content moderation are already operating on Pakistani citizens, largely outside any dedicated legal supervision.
The argument of this article is straightforward. Fundamental rights in the 1973 Constitution were built for a world of physical intrusion, not algorithmic inference. Article 14 protects the dignity of man and the privacy of a person.3 The Supreme Court held that telephone tapping violated privacy, even though no one physically entered anyone’s house.4 This piece argues that courts should extend that same reasoning to data collection, profiling, and automated decision-making. Waiting for Parliament to respond is no longer a viable strategy, when technological developments transform rights more rapidly than legislation can be enacted.
1. The Constitutional Baseline, and Why It Is Not Enough
Pakistan’s Constitution already contains the raw material for an AI-era jurisprudence. Article 9 protects life and liberty, Article 14 protects dignity and privacy, Article 19 protects speech, and Article 25 guarantees equality before the law.5 None of these provisions, however, mention data, algorithms, or automated decisions. Despite this, the Supreme Court has previously extended the scope of Article 14 well beyond its literal wording. In Mohtarma Benazir Bhutto v President of Pakistan, the Court held that surveillance without statutory authorization was unconstitutional, reasoning that privacy attaches to the person and not merely to four walls.6 This establishes that Pakistani courts are willing to protect privacy interests the drafters never explicitly listed.
The trouble is that this reasoning has not been carried forward into the algorithmic context. Facial recognition trained on NADRA’s biometric database, credit-scoring models built on mobile wallet transaction histories, and content moderation systems run by social media platforms operating in Pakistan all raise privacy and dignity questions of exactly the kind Bhutto addressed. Yet none of them has been tested against Article 14 in a reported judgment. The right exists on paper, but its application to AI has not yet been seen.
2. Five Rights Under Quiet Pressure
Privacy and the collapse of the differential trail. Every interaction with a digital service leaves a digital footprint.7 Digital footprints are a semi-permanent record of the sites visited, the messages sent, and the choices made online.8 Once such data is public or shared with a platform, the individual has almost no practical control over how it circulates afterward.9 AI systems compound the problem, because they do not simply store this trail; they draw inferences from it, such as predicting income, health status, or political leaning from data the person never intended to reveal. Pakistan has no statutory right of erasure and no data protection authority to enforce one, even if it existed on paper.
Non-discrimination and the automation of old bias. Equality and non-discrimination anchor the entire human rights edifice, protected internationally through the ICERD and ICCPR.10 Article 25 of Pakistan’s Constitution must increasingly be read alongside Article 14’s guarantee of dignity when confronting algorithmic harm, given the ICERD Committee’s insistence that equality demands substantive parity, not merely formal recognition.11 In Pakistan, AI systems used in policing, credit scoring, or welfare targeting risk establishing indirect discrimination, as facially neutral algorithms produce starkly unequal outcomes along lines this framework was designed to prevent.12
This concern is not hypothetical: UN Special Rapporteur Ashwini K.P. warned in 2024 that generative AI reproduces racial bias through skewed or synthetic training data.13 This carries particular weight for a jurisdiction like Pakistan, where AI models deployed locally are frequently trained on datasets reflecting foreign demographic and linguistic assumptions.
Article 25’s guarantee of equal protection was not written with training data in mind, but a lending algorithm that systematically scores applicants from a particular district or gender lower is doing precisely what Article 25 forbids, only through a mechanism the drafters could not have imagined.
Expression and the moderation problem. Article 19 protects speech subject to reasonable restrictions. In Pakistan, PECA already gives the state considerable power to order content removed.14 Layer automated moderation on top of that framework, and a new difficulty appears. Platforms now make speech decisions at a scale no human reviewer could match, using systems that struggle with satire, regional idiom, and context. The result is over-removal of lawful speech alongside under-removal of genuinely harmful content, and no clear route for an ordinary user to challenge either outcome.
Dignity. Article 1 of the UDHR emphasizes equal rights and dignity for all human beings.15 Article 14 of the Constitution of Pakistan guarantees the same right to dignity.16 Generative AI has made the creation of deepfakes extremely accessible. Deepfakes have attracted widespread concern due to their use in non-consensual pornography, child sexual abuse material, misinformation, and financial fraud.17 These are, indeed, harms to human dignity. These concerns extend beyond the absence of consent. Another aspect of the violation of the right to dignity is that AI can reduce people to data points, ignoring their individuality and autonomy. Furthermore, AI can deceive or influence people’s decisions through personalized misinformation and synthetic content. This behavior violates human dignity by treating people as objects without their awareness.
Accountability and the black box. Perhaps the deepest problem is procedural rather than substantive. When a private algorithm makes or shapes a decision affecting a citizen — whether a loan, a parole recommendation, or a content strike — the citizen typically has no way of finding out why. Without that information, the right to be heard and the right to an effective remedy become theoretical.18 A rights framework that offers no visibility into the reasoning behind a decision is not offering much of a remedy at all.
3. Why the Legislative Response Has Stalled
Pakistan is not short of proposals. It is short of enacted ones. The Personal Data Protection Bill, first drafted in 2018 and substantially revised in 2023,19 would create a National Commission for Personal Data Protection, impose breach-notification duties, and give data subjects rights of access, correction, and erasure. Three years on, it remains a bill. Civil society submissions have flagged the same weaknesses repeatedly: the exemption-making powers given to the federal government under sections 31 and 38 are broad enough to swallow the protections the Bill otherwise creates, and terms such as “public interest” and “critical personal data” are left undefined, inviting inconsistent application.20 A statute with an escape clause this wide will not do much to discipline AI-driven data processing even after it is finally passed.
The National AI Policy, approved in July 2025, sits at a different level altogether. It sets ambitious targets, including training a million AI professionals and supporting thousands of AI-related projects by 2030, and proposes an AI Council chaired by the IT Minister. What it does not do is create enforceable rights. It is an industrial strategy, not a rights instrument, and its own legal status remains uncertain.21 Pakistan is, in effect, promoting AI adoption faster than it is building the legal guardrails around it, which is close to the opposite of the sequencing most comparative regulators recommend.
4. What Other Jurisdictions Suggest
Pakistan does not need to design an AI rights framework from nothing. The European Union’s AI Act takes a horizontal, risk-tiered approach, banning some uses outright, subjecting high-risk systems to mandatory impact assessments, and grounding the whole structure explicitly in the protection of health, safety, and fundamental rights.22 The UN Human Rights Office has distilled similar lessons into a shorter list: privacy protections must be built into AI systems from the design stage, not added afterward; people must be told when a consequential decision about them was made using AI; remedies must be accessible and timely; and the environmental cost of training large models deserves regulatory attention in its own right.23 India’s Supreme Court, for its part, has already read a free-standing right to informational privacy into a constitution that, like Pakistan’s, never mentions data protection by name.24 None of these models can simply be transplanted, but each shows that a rights-first sequencing — privacy protections designed in before deployment, rather than litigated in after harm — is achievable without waiting for a perfect, comprehensive statute.
5. A More Modest, More Achievable Path
Three changes would move Pakistan considerably further than either the stalled Bill or the aspirational Policy currently manage.
First, courts should read Article 14 to cover algorithmic inference explicitly, the same way Bhutto once extended it to cover telephone conversations.25 A single well-reasoned judgment recognizing that automated profiling engages the right to privacy would do more to discipline both state agencies and private platforms than years of policy consultation.
Second, whatever version of the Personal Data Protection Bill is eventually passed needs narrower exemptions and defined terms. An enforcement body that the federal government can override through broad discretionary exceptions is not really an enforcement body.26
Third, any high-risk AI use — facial recognition by police, automated credit or welfare scoring, algorithmic content removal — should carry a statutory duty to disclose its use and a genuine avenue of appeal. This does not require a full EU-style regulatory architecture. It requires transparency and a right to be heard, both of which already sit inside Pakistan’s existing constitutional text, waiting to be applied to a new set of facts.
Conclusion
Rights endure not because they are frozen, but because they are capable of being read onto new facts. Pakistan’s Constitution was not written with AI in mind, and it did not need to be. What it needs now is a judiciary willing to extend the reasoning it has already used once, a legislature willing to close the gaps it has already identified in its own draft bill, and a policy establishment willing to treat rights protection as a precondition for AI adoption rather than an afterthought. None of that requires a new constitution. It requires taking the old one seriously.
Note(S):
1. Ministry of Information Technology and Telecommunication, Personal Data Protection Bill 2023 (final draft, May 2023), introduced in the Senate of Pakistan, February 2023.
2. ‘AI at the Crossroads: Pakistan’s Regulatory Challenge’ (Courting The Law, 3 October 2025) courtingthelaw.com, accessed 8 July 2026.
3. Constitution of Pakistan 1973, art 14.
4. Mohtarma Benazir Bhutto v President of Pakistan PLD [1998] SC 388, [43]; Manzoor Ahmad v The State [1990] MLD 1488, [5].
5. Constitution of Pakistan 1973, arts 9, 19, 25.
6. Mohtarma Benazir Bhutto v President of Pakistan PLD [1998] SC 388.
7. ‘What is a Digital Footprint? And How to Protect it from Hackers’ (Kaspersky) kaspersky.com, accessed 8 July 2026.
8. ibid.
9. International Bar Association, ‘The Right to be Forgotten in Pakistan’ ibanet.org, accessed 8 July 2026.
10. UN Committee on Economic, Social and Cultural Rights, General Comment No 20: Non-Discrimination in Economic, Social and Cultural Rights (2 July 2009) UN Doc E/C.12/GC/20, para 2; UN Human Rights Committee, General Comment No 18: Non-Discrimination (1989) UN Doc HRI/GEN/1/Rev.9 (Vol I) 95, para 1.
11. Committee on the Elimination of Racial Discrimination, General Recommendation No 32 (24 September 2009) CERD/C/GC/32, para 6.
12. The prohibition on racial discrimination is a peremptory norm of customary international law (jus cogens), applying to all states independently of treaty obligations and giving rise to obligations erga omnes. Case Concerning the Barcelona Traction, Light and Power Company, Limited (Belgium v Spain) (Judgment) [1970] ICJ Rep 3, paras 33–34; International Law Commission, ‘Draft Conclusions on Identification and Legal Consequences of Peremptory Norms of General International Law (Jus Cogens)’ (2022) II(2) Yearbook of the International Law Commission, Conclusion 23 and Annex; ICERD, art 1(1); CERD Committee, General Recommendation No 32 (previously cited) para 6; see also ICCPR, CEDAW, and the Declaration on the Elimination of All Forms of Intolerance and Discrimination Based on Religion or Belief; UN Human Rights Committee, General Comment No 18 (previously cited) para 7; Daniel Moeckli and others (eds), International Human Rights Law (3rd edn, OUP 2018) 151; Malcolm Shaw, International Law (8th edn, CUP 2017) 287.
13. OHCHR, ‘Ms Ashwini K.P., Special Rapporteur on Contemporary Forms of Racism’ ohchr.org, accessed 21 May 2026; Report of the Special Rapporteur on Contemporary Forms of Racism, Racial Discrimination, Xenophobia and Related Intolerance (3 June 2024) UN Doc A/HRC/56/68.
14. Prevention of Electronic Crimes Act 2016, secs 14, 29, 31.
15. Universal Declaration of Human Rights, art 1.
16. Constitution of Pakistan 1973, art 14.
17. Heather Chen and Kathleen Magramo, ‘Finance Worker Pays Out $25 Million After Video Call With Deepfake Chief Financial Officer’ (CNN, 4 February 2024) cnn.com.
18. ‘What is a Digital Footprint?’ (previously cited).
19. Ministry of Information Technology and Telecommunication, Personal Data Protection Bill 2023 (final draft, May 2023), introduced in the Senate of Pakistan, February 2023.
20. Digital Rights Foundation, ‘Legal Analysis: Statement on the Personal Data Protection Bill 2023’ (July 2023) 3, 6.
21. ibid.
22. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), recitals 1–3.
23. Office of the United Nations High Commissioner for Human Rights, Key Asks for State Regulation of AI (February 2025) ohchr.org, accessed 8 July 2026.
24. K.S. Puttaswamy v Union of India (2017) 10 SCC 1 (SC).
25. Mohtarma Benazir Bhutto v President of Pakistan PLD [1998] SC 388.
26. Digital Rights Foundation, ‘Legal Analysis: Statement on the Personal Data Protection Bill 2023’ (July 2023) 3, 6, commenting on the exemption-making powers vested in the federal government under sections 31 and 38 of the draft Bill.
Bibliography
Table of Cases
Case Concerning the Barcelona Traction, Light and Power Company, Limited (Belgium v Spain) (Judgment) [1970] ICJ Rep 3
K.S. Puttaswamy v Union of India (2017) 10 SCC 1 (SC)
Manzoor Ahmad v The State [1990] MLD 1488
Mohtarma Benazir Bhutto v President of Pakistan PLD [1998] SC 388
Table of Legislation and International Instruments
Constitution of Pakistan 1973
International Convention on the Elimination of All Forms of Racial Discrimination 1965
Personal Data Protection Bill 2023 (Pakistan) (Ministry of Information Technology and Telecommunication, final draft, May 2023)
Prevention of Electronic Crimes Act 2016 (Pakistan)
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act)
Universal Declaration of Human Rights (adopted 10 December 1948) UNGA Res 217 A(III)
Secondary Sources
‘AI at the Crossroads: Pakistan’s Regulatory Challenge’ (Courting The Law, 3 October 2025) courtingthelaw.com, accessed 8 July 2026
Chen H and Magramo K, ‘Finance Worker Pays Out $25 Million After Video Call With Deepfake Chief Financial Officer’ (CNN, 4 February 2024) cnn.com, accessed 8 July 2026
Committee on the Elimination of Racial Discrimination, ‘General Recommendation No 32: The Meaning and Scope of Special Measures in the International Convention on the Elimination of All Forms of Racial Discrimination’ (24 September 2009) UN Doc CERD/C/GC/32
Digital Rights Foundation, ‘Legal Analysis: Statement on the Personal Data Protection Bill 2023’ (July 2023) digitalrightsfoundation.pk, accessed 8 July 2026
International Bar Association, ‘The Right to be Forgotten in Pakistan’ ibanet.org, accessed 8 July 2026
International Law Commission, ‘Draft Conclusions on Identification and Legal Consequences of Peremptory Norms of General International Law (Jus Cogens)’ (2022) II(2) Yearbook of the International Law Commission
Kaspersky, ‘What is a Digital Footprint? And How to Protect it from Hackers’ kaspersky.com, accessed 8 July 2026
Moeckli D and others (eds), International Human Rights Law (3rd edn, OUP 2018)
Office of the United Nations High Commissioner for Human Rights, Key Asks for State Regulation of AI (February 2025) ohchr.org, accessed 8 July 2026
Office of the United Nations High Commissioner for Human Rights, ‘Ms Ashwini K.P., Special Rapporteur on Contemporary Forms of Racism’ ohchr.org, accessed 21 May 2026
Shaw M, International Law (8th edn, CUP 2017)
UN Committee on Economic, Social and Cultural Rights, ‘General Comment No 20: Non-Discrimination in Economic, Social and Cultural Rights’ (2 July 2009) UN Doc E/C.12/GC/20
UN Human Rights Committee, ‘General Comment No 18: Non-Discrimination’ (1989) UN Doc HRI/GEN/1/Rev.9 (Vol I)
UN Human Rights Council, ‘Report of the Special Rapporteur on Contemporary Forms of Racism, Racial Discrimination, Xenophobia and Related Intolerance’ (3 June 2024) UN Doc A/HRC/56/68
