The Federal Government has proposed the establishment of a National Commission for Personal Data Protection (NCPDP) and Personal Data Protection Fund. This new framework is included in the proposed Personal Data Protection Bill.
The commission shall be responsible for protecting the interest of the data subject and enforcing the protection of personal data, preventing any misuse of personal data, promoting awareness of data protection, and shall entertain complaints against the misuse of data. Along with receiving and deciding complaints, creating public awareness, and providing training, the commission will also monitor the cross-border transfer of the data.
The commission will comprise five members — an expert from the data protection field, a legal expert, a strategic interest expert, a representative of civil society, and a financial or accounting expert.
The Federal Government will appoint members of the commission for a term of four years. Furthermore, the commission would have the authority to set up its sub-offices in provincial capitals and other places as it may deem necessary.
The commission will also be responsible to advise the Federal Government and any other statutory authority on measures that must be undertaken to promote the protection of personal data and ensure consistency of application and enforcement of the Personal Data Protection Bill.
Furthermore, engaging, supporting, guiding, facilitating, training, and persuading data controllers, and data processors to ensure the protection of personal data shall also fall under the responsibilities of the commission. It shall take prompt and appropriate action in response to a data security breach.
The federal commission, along with monitoring the cross-border transfer of personal data, would also be responsible to advise the Federal Government or any other authority on data protection.
Moreover, the formulation of a registration framework for Data Controllers and Data Processors, in accordance with the Personal Data Protection Act, shall also fall under the responsibilities of the commission. If the commission requires any information from the data controller or data processor, the concerned officer of the commission shall provide a written notice to the data controller or the data processor stating the reason for such requisition in a specified manner and the form in which such information may be provided.
For the functioning of the National Commission, a fund called the “Personal Data Protection Fund” shall be created. This fund, established under NCPDP, shall be utilized by the federal commission to meet its expenses and will be financed by loans and grants from the Federal Government. In addition, the commission can take foreign aid, loans, and grants, with the approval of the Federal Government.
