The Executive Regulations are yet to be issued, allowing data controllers ample time to adapt to the law, but in their absence, the transition may be incomplete and counterproductive.
The UAE legislator was among the first in the region to introduce a standalone data privacy law in September 2021, Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (the PPD).
The PPD is a relatively succinct law comprising 31 articles, most of which refer to the PPD’s Executive Regulations (ER) for further clarity. The expectation has been that the ER would be issued within six months from the date of the issuance of the PPD, however this has taken longer than expected.
As final and comprehensive data privacy legislations have been introduced in the region over the last 12 months, this article will take a look at what we can expect from the PPD’s ER.
Why are the ER essential?
There are more than 20 references to the ER under the PPD which clearly indicates that key data privacy principles, controls, conditions, and requirements remain unaddressed under the PPD.
The ER will tackle major points, notably:
- Exemptions: The UAE Data Office, the authority responsible for overseeing compliance with the PPD, may exempt some establishments that do not process a large volume of personal data from part, or all of the requirements of the PPD. The conditions, eligibility, and process to benefit from such exemption remain to be seen under the ER and are crucial to some companies hoping to be relieved from the costs of complying with the PPD.
- Additional legal basis: It is understood that the ER may include additional legal basis for the processing of personal data. This is considered to be one of the most anticipated points to be covered in the ER as the question on everyone’s mind is whether the ER will add legitimate interest as a legal basis. This is because legitimate interest is seen as the most flexible legal basis and may be used by companies to justify personal data processing for marketing and other purposes. However, this flexibility can also be ambiguous, leading to potential misuse, and should therefore require careful consideration.
- Data breaches: Similar to the General Data Protection Regulation (GDPR) and other regional data privacy regulations, under the PPD, data breaches must be reported to the UAE Data Office as well as to the affected data subjects. However, the PPD does not provide a timeline to comply with such reporting obligations. It is also unclear if all types of breaches must be reported or if only certain breaches of a certain severity level will be subject to this obligation.
- Data transfers: Personal data may be transferred to countries benefiting from an adequacy decision. Alternatively, the PPD permits cross-border transfers by relying on other transfer mechanisms such as obtaining the data subject’s explicit consent, creating adequate protection through appropriate safeguards and/or where the transfer is necessary to protect the public health, to defend legal claims etc. At present, the UAE Data Office has not published the list of adequate countries and it remains to be seen if the PPD will adopt standard contractual clauses in line with the approach followed under the GDPR and other data privacy regulations in the region.
- Penalties: The PPD is also silent on the scope and nature of penalties applied on those who are in violation. The UAE regulator might opt to mirror the GDPR’s methodology by establishing a schedule of penalties tailored to specific types of violations, or alternatively, it could introduce a maximum general limit to fines that can be imposed for infringements. It is also worth wondering whether the UAE regulator will provide the UAE Data Office with additional corrective powers like imposing bans on data processing or audits.
Impact of potential fines on data privacy compliance
Generally, the size and scope of potential fines has a direct effect on compliance. It is in fact the mega-fines imposed worldwide that have increased global awareness about the importance of complying with data privacy.
Despite the absence of coercive measures in the UAE, we have witnessed an increasing number of data privacy related instructions as the risks involved are not limited to the fear of sanctions. In fact, operational inefficiencies and permanent loss of consumer trust are enough to keep stakeholders concerned and drive compliance with the PPD.
The PPD’s enforceability
The PPD was published in the Official Gazette and came into effect on January 2, 2022. However, as per the PPD, controllers and processors have a grace period of six months following the issuance of the ER to comply.
The postponement in the issuance of the ER is a double-edged sword. On one hand, it provides controllers and processors ample time to familiarise themselves with the content of the PPD and set in place a suitable transition plan. On the other hand, this transition may be incomplete and counterproductive in the absence of the ER, without which material data privacy principles and requirements remain unaddressed.
Whilst the challenges of being in a grey zone are recognised, it is strongly recommended that stakeholders begin to set the stage for a robust and compliant data privacy system, and take certain necessary steps ahead of the issuance of the ER.
This article was written by Hala Harb, Associate, emphasizing the critical importance of the UAE's Executive Regulations (ER) for the Protection of Personal Data (PPD), highlighting that they are essential for addressing key data privacy principles and requirements that remain unclear or unaddressed under the current PPD.
BSA is a regional Law Firm in the Middle East with offices in the UAE, Oman and Saudi Arabia. As a full-service law firm our practice areas include litigation, arbitration and corporate services, including M&A, banking & finance, Intellectual Property, TMT, Fintech, employment and insurance.
Published on 23 July, 2024.