KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammed Nader Al Awadhi and Liana Rashid, GLA & Company
Under Article 3.3, the Licensee must verify the valid - ity of the personal information provided by the users of said services; such proof (in the form of a civil ID, passport or driving licence) must be certified by com - petent governmental bodies. Under Article 3.4, before executing the service con - tract, the mechanism(s) for cancelling the service and any variation(s) to the contractual terms of service must be clearly stipulated. Under Article 3.6, the Licensee must open an elec - tronic file in which all the information, documents and complaints pertaining to each user are safely stored. Duties of the Licensee upon a user’s request for cancellation of service Under Article 4, the Licensee must facilitate the mech - anisms or procedures for cancellation of service. The Licensee may not bind the subscriber with a mini - mum limit of the service contract term, unless this is approved by the authority. Upon the subscriber’s request to cancel the service, the Licensee must verify the identity of the subscriber applying for cancellation. Dealing with data Under Article 6, Licensees must adhere to the follow - ing requirements: • Making no collection, use or disclosure of any per - sonal information relating to the user without their explicit approval. • Not requiring information that is irrelevant in the context of providing services. • Obtaining the approval of the user before disclos - ing their information to other parties. • Taking all security measures with regard to: (a) protection of the user’s information; and (b) protection against the loss, damage or disclo - sure of such information (or its replacement with any untrue data). The DPPR Consent Under Articles 2 and 4 of the DPPR, Licensees must secure user consent prior to collecting and process - ing their personal data, and must specify the purpose for data collection and processing both before and
during the provision of services, as well as after the termination of services. Data protection In accordance with Article 5 (1-3), Licensees are required to implement robust measures for safeguard - ing data from unauthorised access, loss, destruc - tion or damage, with protective measures to include encryption, confidentiality practices and disaster recovery protocols. Under Article 6, Licensees must inform both the data subject and CITRA in the event of a personal data breach. Data subject rights Under Article 4 (3), Licensees must disclose their iden - tity, location and contact information to their users, ensuring that users can readily recognise and reach out to them when required. Under Article 4 (10), users must be given the right to withdraw consent or to entirely delete their personal information from a Licensee’s records. Under Article 4 (11), Licensees are obliged to notify data subjects if their personal data is to be transferred outside Kuwait. Under Article 4 (12), Licensees must afford their users the right to access or modify stored personal data that is in their possession and is stored with them. CITRA Cloud Service Providers: Regulations and Commitments Types of information collected by CSPs Pursuant to the regulations concerning Platform as a Service (PaaS) and Software as a Service (SaaS) providers in Article 2 of the Cloud Framework, the types of information that a CSP may obtain from a user include (but are not limited to): • name and email address; • address; • payment information; • internet protocol address (“IP address”); and • device and browser information.
263 CHAMBERS.COM
Powered by FlippingBook