HTLAW Law, made legible.
HTLAW / ArticlesConstitutional LawJuly 26, 2026 · Hyder Talpur
ONE DEVICE
Conversations ↗
Movements ↗
Relationships ↗
Private records ↗
Access has a scope.
Authority must have one too.
Phone privacy & state surveillance

A phone is
a record
of a person.

The State’s power to obtain one piece of information does not answer every question about everything else on the device.

In this article 5 chapters + sources
01 / The protected interest

The right travels with the person.

Investigators need one conversation from a phone. The device also holds years of family messages, medical information and unrelated work.

Permission to investigate that conversation is not permission to inspect everything.

The protected interest is the person
Private lifeArticles 4 · 9 · 14
Communications Movements Relationships Personal records
Muhammad Nawaz concerned non-consensual DNA testing; Arshad Mahmood concerned a residential search. Their reasoning explains why a precise intrusion needs lawful authority. They are not a standalone surveillance code.
12345

Pakistan’s laws allow interception in defined circumstances. Articles 9 and 14 require attention to lawful authority, purpose and safeguards against arbitrary intrusion.1

Ask three practical questions: which data, under which power, with which limits?

A targeted investigation differs from treating everyone’s private life as available for general observation. The legal power and its conditions must do the work, not the usefulness of the data alone.

Privacy Follows the Person

Article 14 makes dignity inviolable and protects home privacy subject to law. Article 9 protects life and liberty.

Article 4 also requires lawful authority for detrimental action against life, liberty, body, reputation or property. Read together, these provisions protect more than a physical room.2

A message does not lose privacy because it leaves the house

In Muhammad Nawaz, the immediate issue was a non-consensual DNA test in civil proceedings. The Court required consent or a legal power authorising that intrusion.

Its reasoning addressed personal information, communications, family life and individual choice as well. Privacy forms part of life and liberty and has independent protection under Article 14.3

The application to a phone is this article’s explanation: storage on a server does not itself remove the privacy interest. The case was not a ruling about every kind of phone search.

An official’s presence is not a substitute for lawful process

In Arshad Mahmood, investigators searched a home on prior information without a warrant. A Magistrate accompanied the raid.

That presence did not cure the missing process. Investigators do not have unlimited power to disturb privacy and dignity.4

Where prior information allows prior authorisation, convenience is not an answer to the safeguard required by law.

Keep the telephone-tapping case in context

Mohtarma Benazir Bhutto arose from dissolution of the National Assembly. Telephone-interception material formed part of the majority’s assessment against the government.5

It was not a standalone surveillance code. Its constitutional importance should not be stretched into a detailed rule the case did not decide.

02 / Define the request

What, exactly,
is being accessed?

Select the categories in a hypothetical request. Each category adds a question the authority must answer.

Illustrative scope of access
Scope questions
  • Select a category to identify the questions that follow.

Three Statutory Routes, Three Different Thresholds

There is no single interception provision. Identify the route before assuming its conditions.

Choose the legal route before the data
  1. 01
    Telecom Act §54(1)Federal authorisation for national security or apprehension of an offence.
  2. 02
    Fair Trial ActScheduled offence → statutory screening → sworn application → judicial warrant.
  3. 03
    PECAPreservation, traffic data and real-time content each have their own court-control requirements.
One record+Repeated recordsRelationships and routines
Calling information “metadata” does not settle its privacy impact. The full text separates the statutory conditions and timelines.
678910

1. Telecom Act: federal authorisation

Section 54(1) allows the Federal Government to authorise interception of calls or messages, or call tracing, for national security or apprehension of an offence.6

Its wording is broad and has no express judicial-warrant threshold. That does not make every measure bearing a security label reasonable.

Section 8 requires policy directives to be consistent with the Act. Section 6 separately addresses transparent, non-discriminatory decisions and users’ interests.7

2. Fair Trial Act: a screened warrant application

The Investigation for Fair Trial Act 2013 concerns scheduled offences, offences included in the Act’s schedule.

An authorised official must follow the statutory hierarchy and ministerial screening, then make a written application supported by material and a sworn assurance against privacy abuse.8

The judge considers the statutory threat, the likely collection of relevant evidence and undue interference with privacy.

The warrant can reach calls, messages, electronic transactions, covert surveillance, specified equipment access and related data.

The judge can limit duration, modify implementation or refuse a request affected by bad faith. Misuse of material and surveillance outside the Act’s terms are penalised.9

3. PECA: preservation, traffic data and live content

The Prevention of Electronic Crimes Act 2016, or PECA, separates three tasks.10

Section 31: preserve or obtain specified data. A written notice requires the investigative need and statutory risk of loss, alteration, destruction or inaccessibility.

If data is acquired, the officer must notify the court immediately and within twenty-four hours. Do not confuse acquisition with a preservation notice alone.

Section 32: traffic data. Retention and disclosure are different steps; disclosure requires a court warrant.

Section 39: real-time content. A court may order collection for a specific criminal investigation, for no longer than necessary and initially no more than seven days.

Continuation needs a further application and judicial extension. The application must identify the offence and information, explain necessity and specify privacy measures for uninvolved users and third parties.

“Metadata” can still reveal a private life

Metadata describes a communication rather than its words: for example, origin, destination, time, route and duration.

One entry may reveal little. Repeated entries can disclose relationships, routines and movements.

The privacy question is what the records reveal together, not merely what each field is called.

What “subject to law” actually requires

A broad argument runs like this: home privacy is subject to law; section 54 is law; therefore an authorisation under it is enough.

Two questions remain.

The article’s five-question constitutional test
This target.
This purpose.
This scope.
Power
Which enacted provision authorises this intrusion?
Connection
What links the target or account to the purpose?
Necessity
Why would a less intrusive method be inadequate?
Oversight
Who authorises scope, duration and use?
Accountability
What permits later review and correction?
This is the article’s proposed framework for applying the authorities. A statutory label alone does not answer whether the measure is arbitrary.
11

First: did this action satisfy the law? Identify the exact power, purpose, decision-maker and procedure.

Muhammad Nawaz required authority for the particular intrusion. Arshad Mahmood required compliance with the search process. An informal request or unrelated purpose cannot borrow validity from general statutory wording.

Second: was the scope arbitrary? A lawful power can still be exercised too broadly.

The Human Rights Committee’s General Comment on ICCPR Article 17 explains that electronic surveillance and interception require law and safeguards against arbitrariness.11

That material helps explain the distinction; it does not replace Pakistan’s Constitution.

Five questions for the proposed privacy assessment

  1. Power: which enacted provision authorises this precise intrusion?
  2. Connection: what links the target, account or device to the statutory purpose?
  3. Necessity: why would a less intrusive method be inadequate?
  4. Limits: who independently authorised duration, scope, retention and sharing?
  5. Accountability: what record allows review, correction, deletion or other relief?

This is the article’s proposed framework, not a verbatim statutory checklist.

It tests legality, connection, necessity and oversight. Bulk collection is especially difficult to justify where the authority cannot connect the affected people or selectors to its authorised purpose.

04 / The life of the collected data

The intrusion continues
after collection.

  1. Collect
  2. Inspect
  3. Share
  4. Retain
  5. Return / destroy

Define the target, data category, period and connection to the lawful purpose.

A sequence of legal questions, not a statutory retention timetable.

A warrant must control the whole data lifecycle

Return to the one conversation. Collecting it may also capture a contact list, cloud backup, privileged advice or someone else’s messages.

Privacy does not stop mattering once collection is complete.

Collection is not permission to use everything
Collected materialRelevant records + incidental third-party data + privileged communications
Minimise
Controlled useSeparate irrelevant material. Protect privilege. Log sharing. Limit retention.
The warrant should control acquisition, analysis, sharing, retention and destruction. Safeguards protect uninvolved people as well as the target.
12

The proposed safeguards follow the information through each stage:

  • Acquire: identify the person, service, account or device, data category, offence and period.
  • Search and analyse: separate irrelevant third-party material and give privileged material special treatment.
  • Retain: tie continued storage to the investigation and litigation.
  • Share: record who received what and why.
  • Stop and dispose: end collection when its objective is achieved; provide review of retention, return or destruction.

This is what minimisation means here: limit the intrusion to what the authorised task actually needs.

Where notice would no longer prejudice the investigation, this article argues for delayed notice allowing the affected person to challenge illegality and seek deletion or other relief.

Existing statutes already contain relevant safeguards. The Fair Trial Act requires a sworn privacy assurance, judicial scrutiny and controls on misuse. PECA section 39 requires privacy measures for uninvolved people.12

Enforce those requirements; do not treat them as optional additions to the power.

05 / What follows from a breach

Identify the wrong.
Then justify the remedy.

The legality of access, the fairness of the trial and the treatment of the resulting evidence require connected but distinct reasons.

What happens to unlawfully obtained evidence?

Lawful access and reliable proof are different questions.

In Khalid Mahmood, phone images and footage had not been displayed and proved at trial. The Lahore High Court also found no consent or demonstrated judicial permission for extraction.

Separate the wrong from the remedy
Was access lawful? Is the material reliable? Is trial fairness affected?
Then justify the response

Evidence treatment · deletion · damages · discipline · prosecution where authorised

The article does not claim a universal rule of automatic exclusion. The breach, governing law and circumstances determine the available remedy.
131415

It excluded the material while discussing privacy and self-incrimination.13

Outcome: the appeal was allowed and the accused acquitted on the combined evidential deficiencies. This was a particular High Court case, not a Supreme Court ban on all phone evidence.

Do not invent an automatic exclusion rule

Arshad Mahmood also involved missing proof connecting the accused to contraband, alongside the unlawful residential search.14

Its outcome therefore should not be presented as establishing that every unlawfully obtained item must always be excluded.

The statutes also support admission

Under Fair Trial Act section 24, a warrant produced in court is presumed validly and lawfully issued. Material obtained pursuant to it, and the application’s supporting material, is admissible.

Section 25 addresses qualified analysis and expert reports. PECA section 39(2) separately provides for admission of information collected under that section.15

Admission does not settle weight. Identify the actual statutory route, then ask what the evidence proves about the accused and how much reliance it deserves.

Match the remedy to the wrong

This article proposes examining the breach’s seriousness, deliberateness, bypassing of available warrants, reliability, trial prejudice, third-party intrusion and the risk of rewarding systematic illegality.

Exclusion, deletion, damages, discipline or prosecution under the Fair Trial Act address different problems. Their availability depends on the applicable law and facts; this is not a claim to an automatic remedy in every case.

What follows

For the phone containing one relevant conversation, the useful questions are now specific.

May investigators take the device? May they extract these files? Can they prove what those files show?

The State has significant surveillance powers, but they have purposes and conditions. Targeted investigation needs lawful authority and justified limits throughout collection, use and retention.

General, undocumented or purpose-free observation cannot be justified simply because it might be useful.

A reason to investigate is the beginning of the legal inquiry, not the end of privacy.

One phone. Three separate legal questions.

  1. Seize the device

    What power permits taking possession?

  2. Extract the data

    What authorises access, and what limits the search?

  3. Prove the material

    Was it properly presented, connected to the allegation and tested?

In Khalid Mahmood, extraction and proof were both problematic. Acquittal followed the whole deficient record. Read the judgment citation.

The source record

Bibliography

Cases

  • Arshad Mahmood v State PLD 2008 SC 376.
  • Khalid Mahmood v The State and another, 2024 LHC 2029.
  • Mohtarma Benazir Bhutto v President of Pakistan 1997 SCMR 353.
  • Muhammad Nawaz v Additional District and Sessions Judge PLD 2023 SC 461.

Legislation

  • Constitution of Pakistan 1973, arts 4, 9, 13(b) and 14.
  • Investigation for Fair Trial Act 2013, ss 4, 8-11, 15-16, 24-25 and 34-35.
  • Pakistan Telecommunication (Re-organization) Act 1996, ss 6, 8 and 54.
  • Prevention of Electronic Crimes Act 2016, ss 31-32 and 39.

Other Materials

  • Human Rights Committee, General Comment No 16: Article 17, 8 April 1988.
  • Ministry of Law and Justice, Pakistan Code.

Footnotes

  1. Constitution of Pakistan 1973, arts 9 and 14. ↩

  2. Constitution of Pakistan 1973, arts 4, 9 and 14. ↩

  3. Muhammad Nawaz v Additional District and Sessions Judge PLD 2023 SC 461, paras 5-10. ↩

  4. Arshad Mahmood v State PLD 2008 SC 376, paras 8-11. ↩

  5. Mohtarma Benazir Bhutto v President of Pakistan 1997 SCMR 353. The telephone interception finding formed part of the majority’s assessment of the dissolution material, rather than a standalone surveillance claim. ↩

  6. Pakistan Telecommunication (Re-organization) Act 1996, s 54(1). ↩

  7. Pakistan Telecommunication (Re-organization) Act 1996, ss 6 and 8. ↩

  8. Investigation for Fair Trial Act 2013, ss 4 and 8-11. ↩

  9. Investigation for Fair Trial Act 2013, ss 15-16 and 34-35. ↩

  10. Prevention of Electronic Crimes Act 2016, ss 31-32 and 39. ↩

  11. Human Rights Committee, General Comment No 16: Article 17, 8 April 1988, paras 3, 8 and 10. ↩

  12. Investigation for Fair Trial Act 2013, ss 8, 10-11, 15 and 34-35; Prevention of Electronic Crimes Act 2016, s 39(5)(e). ↩

  13. Khalid Mahmood v The State and another, 2024 LHC 2029, paras 16-17 and 19-21 (LHC). Appeal allowed; convictions and sentences set aside and acquittal on the combined deficiencies. Paragraph 17 discusses proof of extracted media, consent, judicial permission and Article 13(b); it should not be presented as a universal exclusion rule. ↩

  14. Arshad Mahmood (n 4), paras 10-14. ↩

  15. Investigation for Fair Trial Act 2013, ss 24-25; Prevention of Electronic Crimes Act 2016, s 39(2)-(3). ↩