In this era where data privacy regulations are sprouting up almost daily, another city has taken data privacy rights into consideration and devised a law that resembles the likes of GDPR. In 2004, Dubai’s International Financial Centre (DIFC), a world class financial hub and free zone was established and a data protection law was passed in 2007. This law has now been built upon and updated to include concepts from the EU’s GDPR as well as other significant data protection regulations around the world, for example, the California Consumer Privacy Act (CCPA).
This initiative by Dubai could mean that there is a National level law in the works (experts suggest that it is already being constructed) for the UAE. In the event that a national law is published, it is believed that it will be compatible with the DIFC’s Updated Law, which certainly raises the bar significantly for similar legislations across the region.
The law was set to go into effect on July 1st, 2020, but given the Covid-19 pandemic, enforcing bodies have given organizations a three month grace period , up until October 2020 to transition to this new law. Experts suggest that organizations that do not already have a GDPR framework set in place will struggle to make this transition in a mere three month time.
Let’s explore the impact of this new law and what organizations will have to do in order to stay compliant with this law, ahead of 1st October, 2020.
Key Changes with Regards to GDPR
The New DP Law is mirrored against the GDPR are there are certain key changes made in the law that reflect that of the GDPR.
Compliance Requirements
The New DP Law will apply to organizations that
- Work within the DIFC, regardless of where processing takes place
- Situated elsewhere but are processing personal data in the DIFC as part of stable arrangements (this includes those who transfer data out of the DIFC)
Accountability and Record-Keeping Requirements
Controllers need to put programs in place which demonstrate compliance with the New DP Law, similar to the GDPR’s accountability requirements. It also needs to keep records of its processing activities. Failure to maintain adequate mechanisms in compliance with the new standards imposed by the New DP Law can lead to fines going up to $50,000 along with injunctions by the DIFC court.
Data Protection Principles
The New DP Law has set requirements for processing data that are largely identical to the data protection principles under the GDPR.
Lawful Bases for Processing
The New DP Law gives organizations the same legal bases for processing personal data as the GDPR. With regard to consent, the New DP Law reflects elements of the GDPR’s standard, this includes stating “the consent be freely given and demonstrated by a clear affirmative act showing an unambiguous indication of consent.”
Data Subject Rights
Data subjects have been provided a huge host of new rights in relation to their personal data. Data controllers and processors are obligated to provide data subjects with information relating to processing and a mechanism to data subjects to exercise their rights with respect to their data or face heavy liabilities. The rights given to data subjects include:
- Right to withdraw consent
- Right to notice, right to access
- Right to rectification and erasure of personal data
- Right to object to processing
- Right to restriction of processing
- Right to data portability
- Right to object to automated individual decision-making including profiling
- Right to non-discrimination.
Controllers and Processors face heavy fines (which go up to $100,000 per incident) and are also liable for damages to individual data subjects if they are found to have violated any of these rights.
Data Protection Officer (“DPO”) and Data Protection Impact Assessments (“DPIAs”)
A Data Protection Officer must be appointed to monitor and advise on compliance with the New DP Law where a controller or processor engages in “high-risk processing activities” on a systematic or regular basis, the definition of which includes criteria that are similar, but not identical to, the criteria for appointment of a DPO under the GDPR. The DPO officer will produce annual assessments of the controller’s processing activities. Additionally, before undertaking high-risk processing activities, a controller must carry out a Data Protection Impact Assessments in order to weigh the risks with the benefits and mitigate any potential risks.
Data Transfers
The New DP Law restricts transfers outside of the DIFC where the Commissioner of Data Protection has determined that the recipient jurisdiction, or a specific sector within the recipient jurisdiction, does not provide an adequate level of data protection to the data subjects whose data is being transferred. Standard Contractual Clauses or Binding Corporate Rules are among the available safeguards that will permit such transfers. A controller and processor should also weigh the risks to a data subject before transferring any data outside of the DFIC to a requesting authority (including a public authority).
Data Breach Notification
Controllers need to notify the Commissioner of Data Protection in case of any data breach that jeopardizes a data subject’s confidentiality, security or privacy. Data subjects must also be notified if the breach is expected to result in a high risk to their security or rights. These notifications need to be sent out as immediately as possible.
Special Category Data
There is a general prohibition on the processing of special category data unless a derogation applies.
Controller-Processor Agreements
Similar to Article 28 of the GDPR (and, to some extent, the requirements of the CCPA), the New DP Law requires controllers to create a legally binding agreement with the processor to whom they are going to disclose the information. This process must be repeated by processors when making agreements with sub-processors. Controllers may only enter into agreements with processors who can provide sufficient assurances that they have the technical and organizational measures to adhere to the requirements set forth by the DP law.
Next steps
With only three months, organizations that do not already have a GDPR framework in place are going to struggle to remain compliant. There are likely a lot of gaps in the current framework that need to be filled. These could include:
- Creating a Record of Processing Activities
- Ensuring necessary DPIAs are undertaken
- Issuing privacy notices, while meeting the requirements under Part 5 of the Updated Law, both in respect of their customers and employees
- Reviewing supplier arrangements, in order to ensure that a suitable data processing agreement is in place
- Reviewing any international transfers of personal data and keeping them in line with the updated law
- Creating and operationalizing a data breach or security incident policy
- Adequate technical and organizational measures to protect the consumers' personal data withheld by the organization
- Ensuring that processes are in place which enables data subjects to exercise their data subject rights under the Updated Law.
Filling these gaps and several others through manual tasks will make it virtually impossible to complete ahead of October, 2020. Organizations that are looking for swift and efficient compliance, while still being cost-effective, need to consider automation. With the help of automation, these gaps can be filled with ease and in a short timeframe. In an era where even our washing machines do their job on their own, it is absolutely paramount that organizations automate their operations if they want to see themselves comply with global privacy regulations.
