Articles 8 to 16: General Regulations

This section can be described as the general portion of data protection law. DPL-DIFC 07, Article 8, governs data protection principles, such as the principles of restricting the appropriation of data, and of data accuracy. Similarities to the wording of Great Britain’s DPA 1998 are noteworthy. Moreover, one can ascertain that the data protection principles in certain sections were taken partially verbatim from those of the EU Directive 95/46/EC of the European Parliament and European Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

Thus, DPL-DIFC 07, Article 8, governs the following data protection principles:

Processing according to law and legislation, and in good faith (Article 8 (1)(a))

Principle of limitation to specified purpose (Article 8(1)(b))

Data accuracy (Article 8(1)(c)(d); (2))

Data minimization (primarily from a chronological perspective (Article 8(1)(e))

Ban with reservation to grant permission

DPL-DIFC 07, Article 9, establishes the ban with reservation to grant permission. The wording of the provision reads: “Personal Data may only be processed if…” Thus, here as well, the European tenet of the exception-to-the-rule principle applies: accordingly, data processing actions are basically illegitimate and justified only on an exceptional basis, namely if the affected party has granted permission or the law has allowed such processing.

Permission must be granted in writing

According to data protection law in Dubai, permission is only deemed to be on an authorized basis if it was granted in writing (DPL-DIFC 07, Article 9(1)(a)).

Data processing without permission

Irrespective of the aforementioned, there are four circumstances that are not contingent on the granting of permission (DPL-DIFC 07, Article 9(1)(b)-(f)). These can be summarized to the effect that processing data without permission is only legitimate if the preponderant interests of a third party or the common welfare justify such acts. DPL-DIFC 07, Article 10, confines these permissible circumstances to the category of sensitive data, as is found under the system of European data protection guidelines.

Regulation of technical data protection

Article 16 of DPL-DIFC 07 is additionally of paramount importance. According to this article, each responsible office commits to establish “appropriate technical and organizational measures to protect Personal Data against willful, negligent, accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access and against all other unlawful forms of Processing, in particular where the Processing of Personal Data is performed pursuant to Article 10 or Article 12 above.” The parallels to the European standards here are obvious.

Rights of the affected party

The rights of the affected party are governed in DPL-DIFC 07, Articles 17 to 18. They cover the right to information, correction, deletion and blockage (DPL-DIFC 07, Article 17). The conditions essentially correspond to European standards (Data Protection Guideline Section 12 et seq.). Deletion is required in any case if storage is not permitted.

via Data Protection in Dubai: The DIFC Data Protection Law.