News and developments
Personal Data Infringement and Protection Under UAE Laws
the legal framework for data protection is established by Federal Decree-Law No. 45/2021 on the Protection of Personal Data (Data Protection Code) and Federal Decree-Law No. 34/2021 concerning the Fight Against Rumours and Cybercrime. This article delves into the key principles and regulations governing personal data protection in the UAE, focusing on the mechanisms in place to prevent data breaches and uphold privacy.
Federal Decree-Law No. 45/2021: The Data Protection Code
The Data Protection Code provides a comprehensive framework for the protection of personal data in the UAE. Key definitions under Article 1 of the Data Protection Code include:
-
- Data: Information processed by humans or computers, whether organized or unorganized, including numbers, words, and images.
- Personal Data: Information that identifies or makes an individual identifiable, including sensitive personal data and biometric data.
- Sensitive Personal Data: Private details such as family background, beliefs, criminal records, or health information revealing physical, psychological, or sexual conditions.
- Biometric Data: Unique personal data resulting from specific processing techniques confirming identification through physical, physiological, or behavioural characteristics, such as facial images or fingerprint data.
- Unauthorized access, acquisition, modification, damage, disclosure, leakage, cancellation, deletion, copying, publication, or re-publication of electronic personal data or information using information technology may result in detention for not less than six months and/or a fine of AED 20,000 to 100,000.
- If the data or information relates to medical records, bank accounts, or e-payment methods, the penalties may be aggravated.
- Receiving, keeping, storing, or using such data knowing it is illegitimate to obtain shall also result in detention and/or a fine.
- Eavesdropping, recording, communication, transmission, or disclosure of conversations or materials.
- Taking or spreading photographs or electronic images without consent.
- Spreading news, images, or information to harm a person.
- Publishing photographs of casualties or victims without permission.
- Tracking or disclosing geographical data of third parties.
- Altering or processing recordings or images to defame or abuse another person may result in detention for not less than one year and/or a fine of AED 250,000 to 500,000.