KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammed Nader Al Awadhi and Liana Rashid, GLA & Company
The law also applies to those who illegally access gov - ernment systems to obtain confidential information, whether directly or via the internet or other technologi - cal means. The penalty is imprisonment for up to three years or a fine ranging from KWD3,000 to KWD10,000, or both. If the access results in the alteration, deletion or disclosure of the data, the punishment escalates to imprisonment for up to ten years or a fine of between KWD5,000 and KWD20,000, or both. This provision also covers data related to clients’ bank accounts (Article 3). Additionally, the law applies to individuals who deliber - ately modify or destroy electronic medical documents related to medical tests, diagnoses, care or treatment, using the internet or other information technology. Those found guilty of such actions face imprisonment for up to three years or a fine of between KWD3,000 and KWD10,000, or both (Article 3). 1.9 Enforcement Trends Two trends stand out in the last 24 months: the nar - rowing of the DPPR to apply only to telecom Licen - sees (under Decision No 26 of 2024) and the repeal of the Data Classification Policy (see 5.5 Recent Devel- opments ). Public visibility into administrative proceedings and fines remains limited, as regulators do not generally publish case-level outcomes. Accordingly, organisa - tions (whether characterised as a Licensee or any other entity) should implement preventative controls and provide for clear consent and purpose mecha - nisms for collected personal data whether provided for under the E-Transactions Law or the DPPR.
Law’s penal provisions, rather than standalone civil damages claims for privacy harms. Non-material dam - ages are not addressed as a distinct head of claim in the above-outlined laws and regulations. 2.2 Recent Case Law Please see 2.1 Privacy Litigation Overview . 2.3 Collective Redress Mechanisms There is no specific collective redress regime for priva - cy claims reported in the above-cited legislation, and no recent developments implementing representative action mechanisms akin to the EU framework. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Kuwait does not have a cross-sector “data act”, and regulation relevant to non-personal data largely con - sists in certain regulations applicable to Licensees. For example, the Cloud Framework applies to CSPs licensed in Kuwait operating data centres domestical - ly and imposes transparency and security obligations on providers and practical commitments that affect subscribers’ data handling across personal and non- personal data. The DPPR now applies only to Licensees, while the E-Transactions Law applies broadly to entities han - dling electronic records, providing protections and obligations regarding collection, disclosure, security and record maintenance. The Electronic Media Law governs certain online pub - lishing services and content, whereby online Kuwait platforms must comply with rules tied to public order and morals catering to Kuwait’s culture and the Islam - ic faith. 3.2 Interaction of Data Regulation and Data Protection The Electronic Media Law applies to and regulates various online platforms, including:
2. Privacy Litigation 2.1 Privacy Litigation Overview
Privacy litigation in Kuwait remains limited, with no publicly visible court disputes focused specifically on personal data protection. Where disputes arise, they more commonly track cybercrime and unlawful access or disclosure obliga - tions and violations handled through criminal channels under the Cybercrime Law and the E-Transactions
• electronic publishers; • electronic journalism;
267 CHAMBERS.COM
Powered by FlippingBook