LHC Rules Bank Customer Data Is Legal Property

In a significant judicial precedent regarding digital privacy and financial security, the Lahore High Court has declared that personal customer information entrusted to banking institutions qualifies as legal property under Pakistani law. Consequently, any unauthorized sharing or deceptive exploitation of these sensitive records by bank staff can be prosecuted as a criminal breach of trust.

The landmark observation was delivered by Justice Tariq Saleem Sheikh during a bail proceeding linked to a high-value SIM-swap scam. The court granted post-arrest bail to a telecommunications franchise manager implicated in the scheme, while rejecting a similar request from a private bank employee accused of facilitating the breach.

The matter stems from an investigation conducted by the National Cyber Crime Investigation Agency, which uncovered a fraudulent network that illicitly siphoned off Rs 10.45 million from six separate account holders. Investigators revealed that the perpetrators generated duplicate mobile SIM cards using stolen national identity card numbers and biometric fingerprints, enabling unauthorized fund transfers from the victimized accounts.

In his ruling, Justice Sheikh emphasized that account specifics and registered mobile contact details maintained by financial institutions fall squarely under the definition of digital data within the Prevention of Electronic Crimes Act. He highlighted that statutory provisions specifically treat such electronic information as property when adjudicating penal offenses involving property rights.

The bench noted that when an insider is entrusted with managing confidential client data, intentionally leaking or misusing those records violates their professional duty. This precedent establishes a legal standard that treats cyber data breaches involving insider complicity with the same severity as traditional physical theft or embezzlement.