QATAR Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company
direct marketing emails until they withdraw their con - sent. 4.2 Personalised Advertising and Other Online Marketing Practices Article 22 of the PDPPL and the PDPPL Guidelines explicitly prohibit unsolicited direct marketing or mar - keting communications. Prior consent to send elec - tronic marketing communications is required, includ - ing by wired or wireless communication. The PDPPL recognises that the consent must be explicit and unambiguous. It is worth noting that implied consent is not recognised under the PDPPL and will mostly be deemed as invalidly taken. The following information must be included in all elec - tronically shared communications: • the identity of the sender; • an indication that the message is sent for the pur - pose of direct marketing; • a reachable and searchable address; and • a communication platform enabling the customer to request withdrawal of its consent and request the immediate cessation of all upcoming commu - nications. 4.3 Employment Privacy Law Currently, there is no freedom of information legisla - tion in the State of Qatar – a step being discussed by most practitioners. In the same vein, the focus is on organisations and employers, which would need to display that permission was duly received from employees for the assessment and collection of their personal sensitive and classified data. According to the PDPPL, workplace privacy rulesstrictly provide for a solid framework for protect - ing an employee’s privacy. Thus, organisations must provide proof or evidence that they have a permit - ted reason to process their employees’ personal data (SISCO systems, telephone or PC monitoring, GPS). Employers will also need to conduct data protection impact assessments when processing employees’ personal data, as this is considered by the CDPD as an example of processing that “may cause serious damage”.
In parallel, the Labour Law requires employers to maintain employee files and registers containing per - sonal and employment-related information, including identification details, wages, leave records, discipli - nary sanctions and termination information, and to retain such records for prescribed periods. These obli - gations do not override the PDPPL, and employers must ensure that the collection, storage and retention of employment records under the Labour Law are car - ried out in compliance with the PDPPL’s privacy and data protection requirements. On 24 May 2021, the Ministry of Administrative Development, Labour and Social Affairs (MADLSA) launched the first phase of the Unified Platform for Complaints and Whistle-blowers. Through this elec - tronic platform, citizens, expatriates and establish - ments can file a complaint against entities subject to the provisions of Qatar Labour Lawpromulgated by Law No 14 of 2004 and the Domestic Workers Law promulgated by Law No 15 of 2017, or against entities with business regulated by the MADLSA. 4.4 Data Protection in M&A The PDPPL applies to the processing of personal data where such data is electronically processed, prepared for electronic processing, or processed using a com - bination of electronic and traditional means. It does not regulate non-personal data. During due diligence, the disclosure or access to personal data constitutes personal data processing, including disclosure and transfer. Accordingly: • Personal data may only be processed for a lawful purpose , either based on the data subject’s con - sent or where processing is necessary to achieve a lawful purpose of the controller or recipient (Article 4). • Any disclosure of personal data must be consist- ent with the lawful purposes for which the data was collected (Article 12). • Controllers and processors must implement appropriate administrative, technical and finan - cial safeguards to protect personal data against unauthorised access, disclosure or misuse (Articles 8, 11 and 13).
374 CHAMBERS.COM
Powered by FlippingBook