This serves as the second time a financial free-zone in the UAE has sought to update its data protection framework this year. On October 1, 2020, the Dubai International Financial Centre’s (DIFC) new Data Protection Law (DIFC Law No. 5 of 2020) came into force, replacing the previous data protection law in the DIFC and bringing the data protection regime in the DIFC closer in line with the GDPR and global data protection standards (see our previous alert on the new DIFC data protection law here). The recent announcement from the ADGM therefore reflects a trend in the region to develop data protection frameworks in light of global privacy developments.
I. Broad Alignment with the GDPR, Though Certain Notable Differences
In 2015, the ADGM enacted the current Data Protection Regulations 2015, which were subsequently amended in 2018 and 2020 (the “Existing Regulations”). The Existing Regulations are based on the now repealed European Data Protection Directive and UK Data Protection Act 1998 and thus required revision to reflect the changes occurring in relation to data protection globally, specifically the GDPR. The New Regulations significantly overhaul the existing data protection framework in the ADGM, replacing the 21 sections in the Existing Regulations with a comprehensive 63 sections.
Broadly, the New Regulations are closely aligned with the GDPR, including in adopting the key definitions (such as those regarding personal data, processing, data controller/processor and consent), the fundamental data protection principles (including the standalone principles of accountability, fairness, and transparency which are not in the Existing Regulations) and a range of individual data subject rights (such as the right not to be subject to a decision based solely on automated decision making and data portability). The detailed provisions on international transfers of personal data outside of the ADGM closely mirror those contained in the GDPR, including the option for the Commissioner of Data Protection in the ADGM to adopt and approve the then current standard contractual clauses issued by the European Commission.
The New Regulations contain a number of new provisions that were not previously in the Existing Regulations, including detailed conditions for consent (such as confirming that silence, pre-ticked boxes or inactivity do not constitute consent, the data subject must have the right to withdraw consent at any time and that, in order for consent to be informed, the data subject should be aware of the identity of the data controller and the purposes of processing at the least); comprehensive provisions on the responsibilities of data controllers and processors; provisions on joint controllers; provisions on processing for archiving and research purposes; the requirement to conduct a data protection impact assessment where processing is likely to result in a high risk to the rights of natural persons; and the requirement to inform data subjects of a personal data breach “without undue delay” where the breach is likely to result in a high risk to the rights of natural persons.
However, there are certain important areas where the New Regulations diverge from the GDPR. For example, whereas the GDPR has a rather wide extraterritorial reach, in recognition of the relative size of the ADGM and limitations imposed on its legislative powers under UAE federal law, the New Regulations are proposed to be limited to personal data processed in the context of the activities of an establishment within the ADGM (including a business established in the ADGM that processes personal data through an establishment outside the ADGM where that processing is inextricably linked to the business carried on inside the ADGM). The New Regulations also contain specific provisions regarding the payment of a data protection fee by the data controller to the Commissioner of Data Protection in the ADGM in respect of the 12 months from the date it commenced processing personal data under the New Regulations. Moreover, the New Regulations contain express provisions with regard to circumstances where a controller or processor receives a request for personal data from any public authority outside of the ADGM which has jurisdiction over the controller, processor or any part of its group, including requiring the controller/processor to exercise “reasonable diligence” to determine the validity and proportionality of the request.
II. Practical Implications and Next Steps
The New Regulations envisage the establishment of an independent Office of Data Protection to serve as an independent data protection supervisory authority. In a significant development, the supervisory authority will be empowered to levy administrative fines (which are reviewable by the ADGM courts) up to a proposed absolute cap of $28 million—a significant increase from the previous maximum of $25,000 under the Existing Regulations.
Importantly, as UAE federal criminal law and laws governing national security apply in the financial free-zones, including the ADGM, the proposed New Regulations will exclude criminal law enforcement and national security from the scope of the New Regulations (although it should be noted that various other federal, local and sectoral laws govern the privacy restrictions imposed on such authorities). Furthermore, the ADGM acknowledges that there may be specific exemptions for data controllers from complying with their obligations in respect of data subject rights (such as in the case of information required to be disclosed by law, for the prevention or detection of crime and for the regulatory functions of public and administrative bodies), provided the exemptions respect fundamental rights and freedoms and are a necessary, proportionate measure.
The New Regulations are now open for public comments until December 19, 2020. As the New Regulations are almost double in length, contain an additional 42 sections in total, and significantly revise the data protection regulatory framework in the ADGM, there may be significant public feedback on the New Regulations. Following the end of the consultation period, the draft New Regulations may be amended and subsequently enacted, triggering the 12 or 6-month transition period for current and new establishments, respectively.
We continue to monitor developments in this area and will report upon the final regulations once enacted.
