In the world we currently live in, we find ourselves immersed in a landscape defined by digital progress. Within this ever-expanding digital sphere, questions arise about the destiny of individual privacy. The expansion of the digital domain emphasizes the need to synchronize technological progress and the protection of personal data.

The Dubai International Financial Centre (DIFC) recently took a significant step forward with its latest amendment to the Data Protection Regulations in September 2023. The amendment focuses on transparency, accountability, and ethical practices while handling personal data, aligning it with international data protection standards.

What are the key aspects of this amendment?

Prompt Reporting of Personal Data Breaches:

The amended regulations places emphasise on the timely and prompt reporting of personal data breaches to the Commissioner and affected Data Subjects ensuring that individuals are aware of the potential risks to their data, enabling them to take the appropriate precautions. Time is of essence in maintaining trust and complying with the data protection mandates.

Responsible Data Management:

The new amendment outlines procedures for handling personal data inadvertently obtained by a party. Parties are obligated to initiate efforts to return the data to its rightful owners. Failure to do so, or any non-compliance, including using acquired data for personal gain, have implications such as fines, and cost recovery measures. The consequences are intended to highlight the significance of responsible data handling.  

Transparent Digital Communication and Services:

The amendment provides guidelines for collecting and using personal data in digital communications and services. Clear and transparent information must be provided to Data Subjects regarding data usage, with an option to refuse such communications. Default privacy settings should collect only the minimum necessary data. Consent for processing personal data in these contexts must be freely given through clear affirmative acts, promoting transparency and individual choice.

Commissioner’s Authority:

Under the new amendments Commissioner is granted the authority to investigate and enforce actions against Controllers or Processors involved in unfair or deceptive practices. This includes misleading information about data processing or false claims regarding adherence to data protection principles. Such measures ensure transparency and honesty in data handling practices, reinforcing trust in data-driven processes.

 Ethical Use of AI and Autonomous Systems:

The most significant update in the latest amendment is the provisions relating to responsible use of autonomous and semi-autonomous systems, particularly focusing on artificial intelligence (AI) technology when processing personal data. These provisions prioritize ethical and fair practices, transparency in AI decision-making, data security, and accountability mechanisms. The emphasis on compliance with data protection laws in high-risk processing scenarios signifies a commitment to responsible AI deployment.

The latest amendments to the DIFC Data Protection Regulations in September 2023 mark a significant stride towards enhancing data privacy and security in the digital age. By emphasizing transparency, responsible data management, and ethical AI practices, these provisions align with global data protection regulations and promote trust and accountability in data-driven processes. As technology continues to evolve, these regulations serve as a vital framework for protecting individual rights while harnessing the potential benefits of advanced technologies. In a world increasingly reliant on data, the DIFC’s commitment to data protection is a commendable step towards a more secure and ethical digital future.

The author of this Galadari Insight is Raka Roy.

Raka Roy is a Partner and the Head of Intellectual Property and Data Protection at Galadari. She has almost two-decades of Middle East experience specialising in Commercial, Employment, Data Protection, and Intellectual Property. Raka has extensive experience advising both regional and international clients on a broad spectrum of Data Protection related matters including data privacy compliance, data breach responses, data protection impact assessments, and international data protection regulations.

Raka Roy Partner raka@galadarilaw.com