KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammed Nader Al Awadhi and Liana Rashid, GLA & Company
Licensees may require approval from CITRA to trans - fer user data internationally, as indicated through consultations with CITRA. However, there is a lack of specific regulations detailing the mechanisms or conditions for such data transfers. 5.3 Data Localisation Requirements Kuwaiti law does not generally address data localisa - tion requirements, especially after the repeal of the Data Classification Policy (see 5.5 Recent Develop- ments ). However, certain sector-specific examples, such as a healthcare facility, must maintain a register and database to document patient information in either written or electronic form. The facility’s management is responsible for ensuring the safety of these records, and, if the facility ceases operations or changes activi - ties, it must provide its patients with files or copies of their medical information upon request (Article 60 of Law No 70 of 2020 on the Medical Profession). While the law does not provide specific mechanisms for data transfers, it is understood from the E-Trans - actions Law that patient consent is required. Another example of data localisation is found in Article 80 of Law No 6 of 2010 on Labour in the Private Sec - tor, which mandates that employers must maintain a dedicated file for each employee, containing essen - tial documents such as the work permit, employment contract, civil ID, and records of leave, overtime, work injuries and penalties. Similar to healthcare facilities, this law does not address mechanisms for data trans - fers. 5.4 Blocking Statutes Kuwait has several laws and regulations relating to blocking or censoring web content, some of which concern privacy and data protection. Key examples include the following: • The Press and Publications Law No 3 of 2006 regulates the publication of printed and electronic media in Kuwait. It includes provisions relating to blocking content that violates public order, morals or national security. This law gives the government the power to block websites or other media that violate these provisions.
• The Cybercrime Law criminalises a wide range of online activities, including hacking and online fraud. This law gives the government the power to block websites or other online content that violates its provisions. • The CITRA Law regulates the telecommunications sector in Kuwait and includes provisions relating to blocking or intercepting communications that violate public order, morals or national security. This law gives the government the power to block websites or other online content that violates these provisions. Among other prohibited content, CITRA receives requests to block web content in Kuwait that violates the public interest (including public morals, Islamic faith teachings and public order). If CITRA receives a request to block or unblock web content, it will take the necessary actions to block prohibited web content or to unblock web content in the case of an error in classifying the content as prohibited. 5.5 Recent Developments Following the repeal of the Data Classification Policy in February 2024, which previously classified sensi - tive data into different tiers, the regulatory framework for data storage and transfers has become less clear. Under the former policy, Tier 3 data (private sensitive data) included information such as business plans, internal reports, litigation files, medical records and criminal fingerprints, which, if disclosed without authorisation, could damage individual privacy. Tier 4 data, considered highly sensitive, included informa - tion of a national or governmental nature, and unau - thorised disclosure of such data could cause signifi - cant harm to privacy. The Data Classification Policy required that Tier 4 data be stored within Kuwait, while Tier 3 data could be stored in hybrid clouds, both inside and outside Kuwait. Due to the repeal of the Data Classification Policy, the legislative framework surrounding the stor - age and transfer of sensitive data is now governed pri - marily by the consent provisions in the E-Transactions Law.
270 CHAMBERS.COM
Powered by FlippingBook