Qatar Leads The Way With New Standalone Data Protection Law - January 15th 2017

The Qatari government has passed a law requiring a minimum level of protection for personal data within the State of Qatar. It is the first GCC member state to issue a generally applicable data protection law. The law will be of particular interest to Qatar based employers given it introduces new requirements in relation to how employers maintain and manage their employee's information. It will require prompt action to ensure compliance, both for governance reasons and given the law introduces material fines for breach. Law No. 13 of 2016 Concerning Personal Data Protection (the Data Protection Law) was issued on 3 November 2016. It will come into full effect in six months' time (3 May 2016), unless this period is extended. The Data Protection Law will help build consumer trust in Qatar in the online environment and may encourage consumers to engage with innovative technologies in confidence that their data will be protected. It comes at a time when the rapid pace of technological change means that more personal data than ever before is being processed electronically, including due to the advance of big data and internet of things technologies.

Some of the highlights from the new law that employers should be aware of are:

The vast majority of personal data processing activities are likely to be caught - The new law will apply in most instances where personal data is handled. Article 2 provides that the requirements shall apply where personal data (being data which identifies an individual or which can be used in combination with other data to identify an individual) is electronically processed, or obtained, gathered or extracted in preparation for electronic processing, or where a combination of electronic and traditional processing is used. You must have lawful grounds for processing - Personal data should not be processed without first obtaining the approval of the data subject, unless the processing is necessary to achieve a legitimate purpose. The legitimate purpose referred to may be satisfied by reference to the purpose of the data controller or a third party to whom the personal data is sent. It is unclear at this time how narrowly the term 'necessary' will be interpreted by the Qatari Courts. Individuals have the right to access their personal data - The rights given to individuals include the right to consent to any processing of their personal data, and to withdraw consent at any time. An individual will also have a right to...