UAE Law and Practice Contributed by: Amir Alkhaja, Areen Jayousi, Gulsun Ozmen and Alia AlMarzooqi, Habib Al Mulla & Partners
8. Data Protection 8.1 Applicable Regulations
for registration; however, voluntary registration with the Ministry of Economy is available and is recom - mended as a means of establishing a public record of ownership. The law protects a broad range of works, including lit - erary, artistic, musical, dramatic, audiovisual, architec - tural and applied art works. The duration of protection is the lifetime of the author plus 50 years for most cat - egories; works of legal entities and audiovisual works are protected for 50 years from publication, and both civil remedies (injunctions, damages and seizure of infringing copies) and criminal enforcement are avail - able, with the UAE Customs Authority empowered to detain suspected infringing goods at the border. 7.5 Others Software and Databases Computer software is protected as a literary work under the Copyright Law and benefits from the same term and enforcement framework. Databases that involve a sufficient degree of creative selection or arrangement are similarly protected; there is no sepa - rate sui generis database right in the UAE, and protec - tion is contingent on meeting the originality threshold under the Copyright Law. Trade Secrets Trade secrets are protected under Federal Decree- Law No 26 of 2020 on Trade Secrets. Protection applies to commercially valuable confidential informa - tion that the rights-holder has taken reasonable steps to maintain as secret; there is no registration require - ment, and misappropriation gives rise to civil liability in damages, with criminal liability potentially arising under the Cybercrime Law (Federal Decree-Law No 34 of 2021) where the misappropriation involves the use of electronic systems or networks. Domain Names Registration and dispute resolution in respect of the. ae country code top-level domain are regulated by the Telecommunications and Digital Government Regulatory Authority (TDRA), which operates a dis - pute resolution policy based on the Uniform Domain Name Dispute Resolution Policy (UDRP) model and provides a cost-effective mechanism for recovering domain names registered in bad faith.
The primary federal data protection legislation is Fed - eral Decree-Law No 45 of 2021 on the Protection of Personal Data (PDPL), which came into effect on 2 January 2022. It is worth mentioning that the Imple - menting Regulations of this Law have not yet been issued. The PDPL establishes a principles-based framework for the processing of personal data, incorporating requirements relating to lawful basis, transparency, purpose limitation, data minimisation, accuracy, stor - age limitation and security. Sector-specific rules apply in a number of areas: the Central Bank of the UAE has issued data protection and cloud computing reg - ulations applicable to licensed financial institutions, and the health sector is subject to supplementary requirements under Ministry of Health and Preven - tion guidance. The DIFC and ADGM operate distinct and more comprehensive data protection regimes, the DIFC Data Protection Law 2020 and the ADGM Data Protection Regulations 2021, respectively, which are broadly modelled on the GDPR and apply exclusively within those financial free zones. 8.2 Geographical Scope The PDPL applies to the processing of personal data of individuals located in the UAE, and to data control - lers and processors established in the UAE. The law also has extraterritorial reach: it applies to the pro - cessing of personal data of UAE residents by entities located outside the UAE where that processing relates to the offering of goods or services to residents or the monitoring of their behaviour within the UAE. Cross-border transfers of personal data outside the UAE are permitted only to countries, territories or international organisations that ensure an adequate level of protection, as determined by the UAE Data Office, or where the data controller has implemented appropriate safeguards such as standard contractual clauses or binding corporate rules. Transfers may also be made on the basis of enumerated derogations, including the explicit consent of the data subject or necessity for the performance of a contract to which the data subject is a party.
1059 CHAMBERS.COM
Powered by FlippingBook