KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammed Nader Al Awadhi and Liana Rashid, GLA & Company
3.4 Regulators and Enforcement Please see 1.7 Regulators .
• news agencies; • news services; • websites offering electronic commercial advertise - ments; and • the digital presence of print newspapers and satel - lite channels. However, the Electronic Media Law does not apply to personal domains, websites, outlets or electronic accounts that are not operated by individuals with specialised professional expertise. Notably, the Elec - tronic Media Law specifies that the name of the web - site or media outlet must not violate public order or morals or be identical to an existing site. Thus, media regulation under Kuwaiti law seems to be restricted to media channels that are not privately owned. On the other hand, the data protection requirements under the E-Transactions Law or the DPPR would apply to both private companies and entities offering services to the public. 3.3 Rights and Obligations Under Applicable Data Regulation Under the E-Transactions Law, individuals have rights to access, correction and deletion of personal data in electronic records, while entities must ensure accu - racy, purpose limitation and security, with retention aligned to policies and agreements. The DPPR and User Guidelines impose Licensee- specific obligations on consent, transparency, breach notifications to CITRA/users, and transfer notifications for data leaving Kuwait. The Cloud Framework requires privacy policies to cover categories of data collected, use and disclosure practices (including third-party processors), cookie usage, marketing unsubscribe mechanisms and user correction/deletion pathways, with alerts on data relo - cation due to M&A or ownership changes. There is no statutory data portability right, and organisations should instead enable reasonable access on a con - tractual and transparency basis. For action items, please also see 1.2 Rights and Obli- gations .
4. Sectoral Topics 4.1 Use of Cookies
Pursuant to the Cloud Framework, the privacy policy of a CSP must contain a clause labelled “Cookies”, which determines the mechanisms of usage when it comes to:
• log-in authentication; • security inferences; • advertisements; and • personal identification.
The CSP may not use this data to determine the iden - tity of the user and must always disclose the types of cookies used by it or by external parties on any platform on which the service operates. 4.2 Personalised Advertising and Other Online Marketing Practices Spam Messaging In accordance with Article 12 of the CITRA Regula - tions, the Licensee must have a database of users who have requested that they do not receive spam messages. Licensees sending messages for commer - cial purposes must only do so between the hours of 7am and 10pm Kuwait time. Marketing Practice Pursuant to Article 14 of the User Guidelines, the mar - keting practices of Licensees must not exploit any consumer or group of consumers on account of their weaknesses, disabilities, ages or lack of knowledge. They must also not use any means of fraud or decep - tion in the advertising of their products and services. When it comes to sending a marketing communica - tion/call, the Licensees must have duly verified the identity of the recipient user. At the beginning of the communication/call, the Licensee must: • disclose the sender’s name; • disclose the cause for such communication/call; and
268 CHAMBERS.COM
Powered by FlippingBook