In late January 2025, Pakistan's parliament rushed through the Prevention of Electronic Crimes (Amendment) Act, expanding the country's already controversial cybercrime regime. The amendment criminalises the spread of online 'fake news' with up to three years' imprisonment and a PKR 2 million fine, and creates a new Social Media Protection and Regulatory Authority (SMPRA) empowered to order takedowns, block platforms, and refer cases for prosecution. Sixteen months on, the law has become a live test case for Brussels — not of digital policy, but of whether the EU's trade conditionality regime means what it says.
What PECA 2025 actually does
The amendment broadens the definition of unlawful online content well beyond the 2016 original. The newly inserted Section 26A criminalises 'intentionally disseminating' information the speaker 'knows or has reason to believe' is false and 'likely to cause fear, panic, disorder, or unrest'. The thresholds are subjective; the penalties are not. Bail provisions were tightened, and the SMPRA was given authority to order platforms to remove content within 24 hours or face blocking — a structure modelled loosely on India's IT Rules 2021 but with materially weaker procedural safeguards.
Pakistan's journalist unions, the Human Rights Commission of Pakistan, and the country's own bar councils filed constitutional challenges within weeks of the law's passage. Reports from Reuters and Dawn through 2025 documented arrests of journalists, YouTubers, and TikTok creators under the new provisions, alongside temporary platform throttling. The Islamabad High Court has heard preliminary arguments on the amendment's constitutionality but has not yet ruled on the core free-expression questions.
Why this is a Brussels problem
Pakistan is one of eight current beneficiaries of the EU's GSP+ scheme, which grants duty-free access to the European market on roughly two-thirds of tariff lines. The arrangement is not unconditional. Beneficiaries must ratify and 'effectively implement' 27 international conventions covering human rights, labour rights, environmental protection, and good governance — including the International Covenant on Civil and Political Rights, whose Article 19 protects freedom of expression.
The European Commission's biennial GSP+ monitoring report, published in late 2023, had already flagged concerns about the original PECA framework and the criminalisation of online speech. The 2025 amendment makes those concerns considerably harder to wave away. In March 2025, the European Parliament's subcommittee on human rights raised PECA explicitly in its review of Pakistan's GSP+ compliance, and a joint statement from EU rights rapporteurs warned that the vague 'false information' offences and expanded police powers 'risk being incompatible with ICCPR Article 19'.
The economic stakes are real. EU-Pakistan trade in goods exceeded EUR 12 billion in 2023, with textiles accounting for the overwhelming majority of Pakistan's exports — a sector that runs on thin margins and would be acutely sensitive to the loss of duty-free treatment. Suspension would not be automatic or immediate; the GSP regulation requires a formal Commission investigation, a delegated act, and Council/Parliament scrutiny. But the political pressure is now sustained enough that suspension has moved from a theoretical possibility to a credible policy option.
The proportionality problem
From a pro-innovation, pro-speech perspective, the case against PECA 2025 is not that Pakistan should tolerate genuinely harmful online content. Incitement to violence, doxxing, and coordinated fraud are legitimate targets of law enforcement, and most democracies regulate them. The problem is the design of the instrument.
- Vagueness: 'False information likely to cause fear or unrest' is the kind of standard that, in practice, criminalises political criticism. The UN Human Rights Committee has repeatedly held in its General Comment 34 that such provisions are incompatible with ICCPR Article 19.
- Procedural shortcuts: 24-hour takedown windows with no independent judicial review invert the ordinary burden of proof and chill legitimate platform speech.
- Concentration of authority: the SMPRA fuses regulatory, investigative, and quasi-prosecutorial functions in a single body whose members are appointed by the executive.
Compare this to the EU's own Digital Services Act. The DSA is itself a substantial regulatory intervention, but it preserves judicial oversight, requires transparency reporting, distinguishes illegal content from 'lawful but awful' speech, and explicitly protects users' fundamental rights. Whatever one thinks of the DSA's scope, it is a categorically different instrument from PECA 2025.
What Brussels should do
The EU's leverage here is genuine but blunt. Full GSP+ suspension would punish Pakistani garment workers more than it would punish the officials who drafted the amendment. A smarter approach would be the one Brussels has begun to signal: condition the next GSP+ scorecard explicitly on measurable PECA reform — narrowing Section 26A, restoring judicial review of takedowns, and unbundling the SMPRA's overlapping functions.
This is the form of conditionality that works. It gives Islamabad a face-saving reform path, it gives the Commission a clear benchmark, and it signals to other beneficiaries that the 27 conventions are not box-ticking. The alternative — quiet acceptance — would hollow out GSP+ and make every future human-rights clause in an EU trade agreement easier to ignore.
The internet is global, but the rules that govern it are not. When a country uses cybercrime law to criminalise speech, the question for liberal democracies is not whether to care, but how to push back without breaking the trading system in the process. Pakistan's PECA amendment is the test. Brussels should pass it.