SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
1.4 Processing of Personal Data for Research and Development Purposes Companies providing products or services used by healthcare providers may only anonymise patient data when acting on the provider’s documented instruc - tions as the controller and on a valid lawful basis under the PDPL, with controller–processor roles, law - ful bases and security/organisational measures set out in Article 1 (definitions), Articles 5–8 (lawful bases and consent) and Articles 10–12 (controller/processor obligations). Once data is anonymised to a standard where an individual is not identifiable (and re-identification is not reasonably likely), they fall outside the PDPL’s scope, but organisations must apply recognised de- identification methods and safeguards to prevent re-identification, as reflected in Article 1 of the PDPL (definition of personal data) read with its implement - ing regulations on anonymisation standards, and the NDMO Government Data Classification Policy and Anonymisation/De-identification guidance. Secondary use for product development or scientific research must either be within the original purpose/ notice and lawful basis or meet sectoral research/ secondary-use conditions (including approvals under health research ethics rules), and processors may not repurpose data without explicit controller authori - sation, consistent with Articles 5–8 (purpose/lawful basis/consent) and Articles 10–12 (processor limits) of the PDPL, and KSA health sector privacy and research governance instruments (eg, Saudi Health Council/ National Health Information Center policies; Law of Ethics of Research on Living Creatures Articles 11–18 on IRB approval and consent/waivers). If data remains personal, full PDPL obligations continue to apply. For EU-sourced datasets, KSA life sciences firms must comply with the European Health Data Space (EHDS) rules in addition to the European General Data Protection Regulation (GDPR), including data per - mits from Health Data Access Bodies, use of secure processing environments, purpose limitations and prohibited uses including re-identification bans, and output-only access, materially raising governance and security expectations for research and discovery pipe - lines that access EU electronic health data.
1.5 Processing of Personal Data in the Context of Artificial Intelligence Although there is no horizontal AI statute, SDAIA published the AI Adoption Framework, which offers a guiding framework that provides a comprehensive roadmap for the adoption of AI in all sectors. Its goal is to provide necessary guidance and instructions, outline critical steps and procedures, and align with best practices to ensure optimal and responsible AI adoption, thus achieving successful milestones in the transformation towards AI within the ecosystem. In September 2023, SDAIA published the first ver - sion of its AI Ethics Principles. These principles were issued and published with the aim of: • supporting KSA’s efforts towards achieving its vision and national strategies related to adopting AI technology, encouraging research and innovation, and driving economic growth for prosperity and development; • developing and establishing AI ethics policies, guidelines, regulations and frameworks; • governing data and AI models to limit the negative implications of AI systems and potential threats; • helping entities adopt standards and ethics when building and developing AI-based solutions to ensure responsible use thereof; and • protecting the privacy of data subjects and their rights with respect to the collection and processing of their data. The AI Ethics Principles apply to all AI stakehold - ers designing, developing, deploying, implementing, using or being affected by AI systems within KSA, including, without limitation, public entities, private entities, non-profit entities, researchers, public ser - vices, institutions, civil society organisations, individu - als, workers and consumers. Seven principles are addressed in the framework: • fairness; • privacy and security; • humanity; • social and environment benefits; • reliability and safety; • transparency and explainability; and
381 CHAMBERS.COM
Powered by FlippingBook