Law No. 13 of 2016, Personal Data Privacy Protection in Qatar

Law No. 13 of 2016 Personal Data Privacy Protection, also known as the Qatar Privacy Law is a data privacy law that was passed in Qatar in 2016 and went into effect in 2018. As one of only a handful of comprehensive data protection laws to be passed in the Middle East, including Bahrain’s Personal Data Protection Law of PDPL the Qatar Privacy Law places various restrictions and mandates on data controllers who collect the personal data or information of Qatari citizens. What’s more, the Qatar Privacy Law is the first national law to be passed within the country that is specifically geared toward the protection of data privacy rights.

What is the scope and jurisdiction of the Qatar Privacy Law?

In terms of the scope and jurisdiction of the Qatar Privacy Law, the law specifically states “Provisions hereof shall apply to Personal Data when it is electronically processed, or obtained, gathered or extracted in preparation in any other way for electronic processing, or when processed via a combination of electronic and traditional processing”. Alternatively, the law also specifically states “Provisions hereof shall not apply to Personal Data processed by individuals within a private or a family scope, or to any Personal Data processed for the purpose of obtaining official statistical data as per provisions of the referred to law No (2) of 2011″.

What’s more, the Qatar Privacy Law also places special emphasis on the protection of “personal data of special nature”. Similar to the ways in which “sensitive personal data” is defined under other privacy laws, “personal data of special nature” is defined as Personal data, related to ethnic origin, children, health, physical or psychological condition, religious creeds, marital relations, and criminal offenses, shall be regarded as Personal data with special nature”. Furthermore, the Minister of Transport and Communication also retains the right to add other types of Personal Data of a special nature, where the misuse or disclosure of the same may cause serious damage to Individual”.

What are the requirements of data controllers under the Qatar Privacy Law?

In the same vein as many other privacy laws around the world such as the EU’s General Data Protection Regulation or GDPR and Australia’s Consumer Data Right or CDR, the Qatar Privacy Law outlines various requirements that data controllers within the country must adhere to when collecting, processing, accessing, or disclosing the personal information of Qatari citizens. Some of these requirements include the following:

• Process personal data both honestly and legitimately.
• Verify that all personal data that is collected is both relevant to the lawful purposes for which is collected, and accurate, complete, and up to date at times.
• Consider the controls related to the design, change, or development of products, services, and systems pertaining to the processing of personal information.
• Take appropriate technical, financial, and administrative precautions to protect personal information, in accordance with what is determined by the Competent Department.
• Adhere to the privacy policies developed by the Competent Department, as well as any other decisions issued by the Minister of Transport and Communication.
• Detail any other third party that is processing personal information on behalf of the data controller.
• Outline the lawful purposes for which a third party wants to process personal information.
• Provide comprehensive and accurate descriptions of data processing activities, as well as the levels of data disclosure in accordance with the law.
• Provide data subjects with any other relevant or pertinent information that is relevant or necessary to fulfill the conditions of data processing under the law.

What are the rights of data subjects under the Qatar Privacy Law?

Conversely, the Qatar Privacy Law also grants data subjects a multitude of rights in regards to the collection, processing, access, and disclosure of their personal data and information. These various rights include:

• The right to withdraw consent in relation to data processing.
• The right to object to the processing of their personal data, if said processing is not necessary to achieve the purposes for which this personal data was initially collected, or in instances where processing is found to be beyond the scope and extent that is required, illegal, discriminatory, or otherwise unfair.
• The right to request erasure or omission of personal data, under the conditions of cessation of the purposes for which data processing has been conducted, or when the legal justification for maintaining the personal data of a data subject ceases to exist.
• The right to request that a data controller make corrections to a data subject’s personal data, as well as verify the proof of the accuracy of their personal data.
• The right to be notified of the processing of their personal data, as well as the purpose and reasons for said processing.
• The right to be notified of any inaccurate disclosure of personal data.
• The right to obtain a copy of their personal data, for a price that shall not exceed the applicable service charge related to the data controller.

In terms of penalties for non-compliance, data controllers who are found to be in violation of the law are subject to fines ranging from one million QAR ($276,176) to five million QAR ($1,380,880). Additionally, third parties who process the personal data of Qatari citizens on behalf of data controllers are also subject to monetary penalties “that shall not exceed One million QR ($276,176) shall be applicable to violating legal person, in the event of committing any of those crimes stipulated herein on the name or for the interest thereof, without prejudice to criminal liability taken by affiliated natural person”.

With the passing of the Qatar Privacy Law in 2018, Qatari residents were granted a level of data protection that had never been experienced before in the country. As countries within the Middle East begin to consider drafting and passing similar laws due to the importance that internet communication and commerce continue to play in the lives of people around the world, laws such as the Qatar Privacy Law will only be passed with more frequency. As such, governments around the world can ensure that the privacy of their citizens is protected at every level at all times, even when using the internet.