Personal Data Protection in the United Arab Emirates: Rights and Legal Safeguards
Introduction
Amid the rapid digital revolution, personal data has become some of the most important information tied to individuals’ private lives, as its collection, circulation, and processing across electronic platforms and modern technologies continue to increase. This development has created an urgent need for a legislative framework that safeguards privacy and balances individuals’ rights with the demands of technological progress.
In this context, Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data was issued and came into force on 2 January 2022. Its aim is to regulate the processing of personal data and to define the rights of data subjects and the obligations of the entities that process such data, in order to provide legal protection for individuals in a changing digital environment. The law affirms that every individual has the right to the protection of their personal data, and that such data may not be processed except in accordance with the provisions of the law.
First: The Concept of Personal Data and Its Types
Article (1) of the law defines personal data as any data relating to an identified natural person, or one who can be identified directly or indirectly by linking data or using various identifiers, such as name, image, voice, identification number, and geographic location.
The legislator also distinguished between personal data and sensitive personal data, which includes data relating to racial or ethnic origin, religious beliefs, political and philosophical opinions, criminal records, and health, genetic, and biometric data, as well as other data specified by the law.
This distinction highlights the importance of providing legal protection to data according to its nature and degree of sensitivity, thereby helping to reduce the risks of its misuse or unlawful disclosure.
Second: Rules Governing Consent to the Processing of Personal Data
Article (6) of the law sets out the conditions for recognizing the data subject’s consent to the processing of their data. Where processing is based on consent, the controller must be able to demonstrate that consent was given. Consent must be clear, simple, unambiguous, and easily accessible, whether written or electronic.
The data subject also has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
However, consent is not the only legal basis for processing. The law permits processing without the data subject’s consent in specific cases, subject to the conditions and exceptions set out in the law, including where the public interest so requires.
Third: The Rights of the Data Subject
The law guarantees the data subject a set of rights that strengthen their ability to control and protect their data, the most prominent of which are:
- The right to obtain information: to be informed of the types of data being processed, the purposes of processing, and related decisions, in accordance with the provisions of the law.
- The right to rectification or erasure of data: to request the correction or completion of inaccurate data, and to request its erasure in the cases specified by the law.
- The right to restrict or stop processing: to request the restriction or cessation of data processing where the prescribed legal conditions are met.
- The right to object to automated decisions: to object to decisions resulting from automated processing that produce a legal effect or a significant impact on the data subject, in accordance with the legal controls and exceptions.
- The right to protection from unlawful processing: to benefit from the legal safeguards governing the collection, use, disclosure, and transfer of data.
Fourth: Violations of Personal Data and Their Legal Forms
Violations of personal data take many forms. They may consist of unlawful access to data, disclosure without legal justification, or altering, destroying, transferring, or processing data in a manner that contravenes applicable legislation.
The Personal Data Protection Law does not define the crime of infringement of personal data directly. However, Article (1) of the law defines some forms of this crime under the term “personal data breach and violation.” It defines such a breach as: a breach of information security and violation of personal data through unlawful or unauthorized access to it, including copying, sending, distributing, exchanging, transferring, or circulating it, or processing it in a way that leads to its disclosure to third parties, or destroying or modifying it during storage, transfer, and processing.
Accordingly, the crime of infringement of personal data can be defined as: the perpetrator’s commission of material acts that result in unlawful access to individuals’ data and the viewing, transferring, or processing of it without prior consent from the person concerned, or without a legal justification permitting it.
Alternatively, the crime of infringement of personal data may occur in a digital environment and by electronic means, where the personal data concerned is stored in electronic databases and records, whether on computers, servers, websites, or other digital databases created to store personal data. This crime may also occur through unlawful viewing, modification, or processing of paper records and registers, if such records or registers are intended to document this data. Whatever the method of infringing individuals’ personal data, once it occurs it is subject to this law and to any other legislation that provides for criminalization and punishment more severe than that provided in this law.
The object of the crime of infringement of personal data is the data itself, which consists of information that identifies a person, whether directly or indirectly, as well as data relating to their origin, place of residence, or whereabouts. It also includes more detailed and highly sensitive personal data, such as data relating to religious belief or to health or genetic status.
In this context, Article (6) of Federal Decree-Law No. (34) of 2021 on Combatting Rumors and Cybercrimes criminalizes certain acts committed against electronic personal data or information, as follows:
- Anyone who, without authorization, obtains, acquires, modifies, destroys, discloses, leaks, cancels, deletes, copies, publishes, or republishes electronic personal data or information, using information technology or an information technology means, shall be punished by imprisonment for a period of not less than six (6) months and a fine of not less than (20,000) twenty thousand dirhams and not more than (100,000) one hundred thousand dirhams, or by either of these two penalties.
- If the data or information referred to in clause (1) of this Article relates to medical examinations, diagnosis, treatment, care, or medical records, or to bank accounts or electronic payment methods data and information, this shall be considered an aggravating circumstance.
- Anyone who receives any of the data and information referred to in clauses (1) and (2) of this Article, and retains, stores, accepts dealing in, or uses it despite knowing that it was obtained unlawfully, shall be punished by imprisonment and a fine, or by either of these two penalties.
Fifth: The Right to File a Complaint
Article (24) of the Personal Data Protection Law provides the data subject with the right to file a complaint with the UAE Data Office if they have grounds to believe that a violation of the law’s provisions has occurred, or that the controller or processor is processing their data in violation of its provisions.
The Office receives and examines complaints in coordination with the controller and processor, and it may impose the administrative penalties prescribed by law when a violation is established, in accordance with the relevant provisions.
Conclusion
Personal data protection is one of the fundamental aspects of safeguarding individuals’ privacy in the digital age. By regulating processing operations and defining the rights of data subjects and the obligations of the entities concerned, the UAE legislator establishes legal safeguards aimed at limiting the misuse of personal information and enhancing trust in the digital environment.
Accordingly, respecting personal data protection provisions is not limited to compliance with legislation; it is also an essential element in protecting individual rights and strengthening legal responsibility in handling information.
For Legal Consultation
If you are facing an issue relating to a personal data violation or its unlawful access, disclosure, or use without legal justification, engaging a specialized lawyer can help you understand your rights and determine the appropriate legal measures to protect your interests.
To obtain legal advice or to learn about the legal options available based on the circumstances of your case, please contact our firm. We are committed to providing the necessary legal support and following up on matters relating to personal data protection in accordance with the legislation in force in the United Arab Emirates.