Customer data in bank is property, its misuse may be a crime: LHC

LAHORE: The Lahore High Court (LHC) has declared customer data entrusted to banks as "property" under the law, and its wrongful handling can be deemed criminal breach of trust. Justice Tariq Saleem Sheikh made this ruling while granting bail to a telecom franchise operator accused of a large-scale SIM-swap fraud, but denying bail to a former private bank employee.

The National Cyber Crime Investigation Agency (NCCIA) filed charges against both individuals for allegedly creating fake SIM cards using victims' personal information, resulting in the unauthorized transfer of Rs10.45 million from six private bank accounts.

Justice Sheikh emphasized that customer data, including account details and registered mobile numbers, is protected by the Prevention of Electronic Crimes Act (Peca) and treated as "property" under the Pakistan Penal Code (PPC). According to Section 27(2) of Peca, such data is considered "property" when used in property-related offenses.

He also noted that when customer data is under a bank employee's control, dishonestly disclosing or using it for fraudulent purposes could amount to criminal breach of trust, and may violate banking employees' confidentiality obligations under the Banking Companies Ordinance, 1962.

In the case of Muhammad Atif, the bank employee, the judge examined the investigation records, internal fraud reports, and account-access logs, which collectively supported the allegations against him. The judge determined that Section 409 of the PPC applied, as Atif had access to, verified, and managed banking transactions. Consequently, the bail plea of the bank employee was denied.

However, the judge reached a different conclusion for the second suspect, Muhammad Usman, who was accused of operating the cellular company's franchise where the fraudulent SIMs were issued. While prosecutors claimed Usman managed the franchise, the evidence did not strongly link him to the SIM activations, BVS manipulation, or the theft of banking property. The judge deemed further investigation necessary and granted Usman bail with a Rs1 million surety bond.