KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammed Nader Al Awadhi and Liana Rashid, GLA & Company
• give the recipient user the option to continue with the communication/call or not. Regulations and Commitments of CSPs The CSP’s privacy policy must inform users of the procedures to follow should they wish to cancel mar - keting communication subscriptions. 4.3 Employment Privacy Law Law No 9 of 2001 Regarding Misuse of Telecom - munications and Wiretap Sets governs privacy in an employment context, but there is no specific rule applicable to employee monitoring. Telephone conversations may be recorded by employ - ers to deal with any grievances from customers or clients, in order to ensure that the calls are dealt with professionally or for the purposes of training only. In some situations, such recordings may be carried out and reproduced for legal purposes upon an order of the competent court in a situation occurring between third parties and company employees. No applicable laws are in place for monitoring employ - ees’ emails in Kuwait. Private life cannot be violated, so the monitoring and recording of such information is considered to be an infringement of rights and a violation of confidentiality, which is guaranteed to indi - viduals under the Kuwaiti Constitution. The courts of Kuwait aim to protect citizens and expatriates from all such violations. The employer can draw up a set of rules and regulations that may govern such moni - toring for the purpose of safeguarding their interests. However, they should restrict it to the official work areas and not infringe on privacy rights, including the protection of personal emails. Such rules and regula - tions will need to be drawn up and made available to employees in a handbook that is provided to newly joined employees for them to understand and abide by. 4.4 Data Protection in M&A The E-Transactions Law Under Articles 32 and 35 of the E-Transactions Law, Entities are expressly required to: • obtain individuals’ consent before accessing, dis - closing or sharing personal data; and
• specify the purpose for collecting and processing such personal data, including processing activities for data transfers. These activities must be conducted using lawful means and limited to the stated purpose. This applies to personal data or information in electronic records or processing systems concerning the professional, social, health or financial status of individuals regis - tered with these Entities. Consent may be obtained or inferred from affirmative actions indicating approval, as outlined in Article 4 of the E-Transactions Law. DPPR and the User Guidelines Licensees have notification obligations, including informing data subjects about personal data trans - fers outside Kuwait, pursuant to Article 4 of the DPPR. In addition, Licensees are required to establish and uphold a written privacy policy that elaborates exten - sively on their procedures concerning the collection and processing of personal data, including transfers as part of the processing activities. This policy should be publicly accessible on their websites and provided to users and data subjects when entering into service contracts. For entities operating under the E-Transactions Law, cross-border disclosures must align with consent, purpose limitation and security duties for electronic records. For Licensees, the DPPR requires informing users of transfers of data outside Kuwait and their legal repre - sentative in the recipient country. Please also see 4.4 Data Protection in M&A . 5.2 Government Notifications and Approvals Private entities covered by the E-Transactions Law typically do not need regulatory approval for interna - tional data transfers, unless the data involves state or government-related information in Kuwait. 5. International Considerations 5.1 Restrictions on International Data Transfers
269 CHAMBERS.COM
Powered by FlippingBook