KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammed Nader Al Awadhi and Liana Rashid, GLA & Company
Obligations in dealing with information In accordance with the regulations concerning PaaS and SaaS providers in Article 2, the CSP must describe to the user all information that needs to be collected and inform them as to what information will be col - lected automatically (as well as where to access and amend such information). Following data collection, the CSP must explain to the user where and how such information may be used. The CSP may not use this information to determine the identity of the user. The CSP must also inform the user of any third-party providers that operate certain services on its behalf – and of its privacy policies – for the purpose of maintaining transparency. The CSP commits to not share, dispose of or sell the user’s information with third parties; however, for purposes of improving the service and customer experience, it may be granted access to the user’s name, address, phone number and email. In any case, the user must be informed of such. The user must be notified immediately of any reloca - tion of data to new owners as a result of M&A, liquida - tion or dissolution. The CSP must be efficient, competent and equipped to detect any fraud, security threats or technical prob - lems. The user has the right to request the amendment or deletion of their personal data available to the CSP or to third parties. The CSP must also provide clear mechanisms to users for communication regarding the privacy policy. SaaS providers must specify in their privacy policy the targeted age group for the collection of data. If the targeted age group is minors, the consent of their guardians must be obtained. The service must abide by any relevant child protection laws of the state. A practical compliance checklist would commonly include: • map electronic records and personal data flows (including cloud/telecom dependencies); • implement consent and purpose disclosures;
• deploy access, correction and deletion mecha - nisms; • adopt security and retention controls consistent with the E-Transactions Law and DPPR rules; • enable breach identification and notification pro - cedures (applicable to Licensees with respect to notification of CITRA and users); • ensure transfer transparency and approvals where required; and • maintain clear user-facing privacy policies and change-control processes. 1.3 Special Categories of Personal Data Kuwait’s legal instruments do not provide a GDPR-like taxonomy of “special categories”, but the E-Transac - tions Law does make reference to personal data as data stored in electronic systems relating to an indi - vidual’s professional, social, health or financial sta - tus, with criminal sanctions for unlawful access/dis - closure/use or processing beyond stated purposes. Processing minors’ data requires guardian consent when SaaS targets minors (under the User Guidelines). Providers must state any age targeting in their privacy policy and comply with child protection requirements. There is no standalone regime for criminal conviction data beyond the general prohibitions and criminal penalties for unlawful access, alteration or disclosure under the Cybercrime Law and the E-Transactions Law. 1.4 Processing of Personal Data for Research and Development Purposes Kuwait has not adopted a dedicated secondary-use regime akin to the EU’s European Health Data Space. Secondary use for product development or research typically relies on processing consent requirements pursuant to the E-Transactions Law and the DPPR principles on data collection and processing purpose specification, lawful means and security outlined in 1.2 Rights and Obligations . For medical data, written patient consent is gener - ally required for disclosure, and healthcare provid - ers must maintain secure patient records under the Medical Profession Law No 70 of 2020. In practice, life
264 CHAMBERS.COM
Powered by FlippingBook