KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammed Nader Al Awadhi and Liana Rashid, GLA & Company
sciences and healthtech companies implement de- identification methods and limit re-identification risks. 1.5 Processing of Personal Data in the Context of Artificial Intelligence There is no dedicated AI statute in Kuwait. Personal data used in AI systems must comply with the E-Trans - actions Law’s consent, purpose, accuracy and secu - rity principles, and with DPPR/User Guidelines where the entity is a Licensee handling subscriber data. 1.6 Data Breach Requirement For Licensees, the DPPR requires notifying both CITRA and affected data subjects in the event of a personal data breach within a time period not exceed - ing 24 hours from the time of breach, supported by appropriate technical measures and incident response capabilities. The notification must set out the nature of the breach, including the scope of the personal data leakage, the categories of affected individu - als, and the security levels impacted, together with the identity of the Licensee’s Data Protection Officer and the means of communicating with that officer. It must further address the potential consequences of the breach and outline the measures already taken or proposed by the Licensee to mitigate and address the breach. Notification to the affected data subjects is not required where the Licensee has implemented appropriate technical and organisational protection measures and such measures have been applied to the personal data subject to the breach. For other entities, breach handling is guided by the E-Transactions Law’s security and lawful processing duties, and the Cybercrime Law applies to unlawful access, alteration or disclosure, and the competent authorities may initiate investigations in the event that any complaints or referrals indicate offences. 1.7 Regulators Kuwait does not currently have a single regulatory authority with overarching jurisdiction over data pro - tection matters. While CITRA was initially regarded as the principal data protection regulator (given that the DPPR origi - nally imposed obligations on a broad range of entities), subsequent amendments have limited its direct regu -
latory scope primarily to Licensees. Notwithstanding this narrowing, CITRA continues to play a significant role by overseeing various data protection-related matters, issuing regulations and providing guidance, particularly within the telecommunications sector applicable to Licensees. In parallel, the Central Agency for Information Tech - nology serves as another key authority in the area of personal data protection, being responsible for the issuance of the E-Transactions Law and its Executive Regulations. In addition, the National Centre for Cybersecurity, established pursuant to Decree No 37 of 2022, is a recently formed authority with a central regulatory role in cybersecurity matters, particularly in relation to gov - ernmental entities. Regulatory investigations are generally initiated fol - lowing complaints or through supervisory oversight. In this context, CITRA has the authority to conduct inspections, assess service quality, review relevant records, require corrective measures and, where criminal conduct is suspected, refer matters involv - ing Licensees to the competent authorities. 1.8 Enforcement Proceedings and Fines The CITRA Law The CITRA Law empowers CITRA to collect informa - tion relevant to the telecommunications and IT sec - tors, and to issue any reports, bulletins and guidelines to users. CITRA, pursuant to the CITRA Law, also pre - pares the necessary media programmes to increase public awareness of the importance attached to these sectors and the extent of their influence on social and economic development in the State of Kuwait. Pursuant to Article 15 of the CITRA Law, all Licen - sees must adjust their internal policies and rules to any extent necessary to achieve compliance with the provisions of the CITRA Law. Pursuant to Article 49 of the CITRA Law, if CITRA receives any complaint about a Licensee’s default in the performance of its obligations, a dispute between a Licensee and beneficiary users in relation to the quality and standard of the service being provided or
265 CHAMBERS.COM
Powered by FlippingBook