Data Protection Update 6 - Data Protection In The Qatar Financial Centre

Data protection and privacy are important considerations for all businesses. Failing to treat personal information in accordance with legislative requirements and best practice can have an adverse effect on a company's reputation and its relationship with its employees and customers.

Specific data protection regimes are now in place in many jurisdictions. Awareness of the implications of data protection and privacy issues is increasing around the globe, including in the Middle East, where there have been a number of developments in recent months.

This article provides a brief overview of data protection and privacy in the Qatar Financial Centre (QFC).

Background

The QFC has an extensive data protection regime which is comprised of the QFC Data Protection Regulations (QFC Regulation No. 6 of 2005), and the QFC Data Protection Rules (together the QFC DP Regulations).

The QFC DP Regulations have adopted many of the data protection principles and concepts that are applicable in the European Union. The QFC DP Regulations classify data as belonging to one of two categories: Personal Data (which is any information relating to an identified or identifiable natural person), and Sensitive Personal Data (which is Personal Data revealing or relating to racial or ethnic origin, political views, religious affiliation, health and sex life).

Any person in the QFC who determines the purposes and means of processing Personal Data is considered a "Data Controller". According to the QFC DP Regulations, the term "processing" is broadly defined to include:

"any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction."

Data Controllers are required to establish and maintain systems and controls that enable them to satisfy themselves that processing Personal Data complies with the requirements of the QFC DP Regulations, and companies in the QFC are required to complete a comprehensive data protection form (Form Q10) prior to processing any Personal Data.

Processing Personal Data

According to the QFC DP Regulations, Data Controllers must ensure that the Personal Data that they process is:

(a) processed fairly, lawfully and securely;

(b) processed for specified, explicit and...