KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammed Nader Al Awadhi and Liana Rashid, GLA & Company
or Data Act; however, CSP and telecom rules impose transparency/security requirements, and the Elec - tronic Media Law governs certain online publishing activities with privacy-intersecting content rules. 1.2 Rights and Obligations The E-Transactions Law Consent Under Article 4 of the E-Transactions Law, individuals must consent prior to dealing by electronic means, though such consent may be inferred through affirma - tive conduct indicating approval. Under Article 32, when collecting data (including per - sonal data and data relating to individuals’ profes - sional affairs, social status, health status or financial status), government authorities, public authorities and institutions, companies, non-governmental entities and their employees (“Entities”) are explicitly man - dated to secure individuals’ consent and to state the purpose behind collecting such data. Under Articles 32 and 35, Entities must also ensure that consent is obtained when conducting any access, disclosure, sharing or processing of the collected data. These activities must be undertaken by lawful means and be limited to the stated purpose provided to data subjects. This is a requirement that pertains to personal data or information that is stored in elec - tronic records or processing systems and relates to the professional affairs, social status, health status or financial status of individuals who are registered with the Entities. Data protection Under Article 35, Entities are required to regularly verify and update the accuracy of personal data or information stored on their electronic records or pro - cessing systems. They must also implement appro - priate measures to safeguard the personal data and information collected or stored on their electronic records or processing systems. Under Article 2 of the Executive Regulations, the stor - age and maintenance of electronic records, inclusive of personal data, must preserve their original form, encompassing all associated original data, without compromising the quality or standard of the records.
In addition, the storage of electronic records, inclusive of personal data, should align with the policies and agreements established between the parties involved in electronic transactions, specifying the duration for retaining and maintaining such records. Data subject rights Article 33 of the E-Transactions Law grants specific rights to data subjects concerning their personal data stored in electronic records and processing systems maintained by Entities. Any person with their person - al data stored by an Entity has the right to request access to, as well as a record of, such data. Additionally, under Article 36, the data subject has the right to modify or delete their personal data held by any Entity, and may also update personal informa - tion in the event of changes. Requests for the access, modification or deletion of personal data can only be initiated by the individual to whom the data pertains or by their legal representative (Articles 25–26 (1) of the Executive Regulations). Under Article 26 (2) of the Executive Regulations, deleting stored personal data or information is only permissible when correction is deemed necessary; in such cases, the previously stored information must be maintained without any use or handling. The User Guidelines Collection of data Under Article 2 of the User Guidelines, a Licensee must prepare relevant rules and mechanisms for the sale of its service, either through means of electronic transaction or through telephone communication. CITRA must approve the rules and mechanisms (or any amendments to existing contracts of sale) in advance, which includes the relevant data collection and storage rules and mechanisms. Pursuant to Arti - cle 3.16, in the case of any amendment to an exist - ing contract of sale, the following must occur before execution can take place: • the service user must be notified of the amend - ment 60 days before the amendment enters into force; and • the service user’s written approval or e-signature (using the “Hawyti” application) must be obtained.
262 CHAMBERS.COM
Powered by FlippingBook