SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
Where disputes reach the courts, they typically arise in the context of unlawful access or disclosure of per - sonal content, reputational harm, employment moni - toring disputes, or broader civil liability claims relating to misuse of personal data, alongside criminal expo - sure under the Anti-Cyber Crime Law. Currently, most actions relating to privacy protection are managed by SDAIA and the NDMO, which inves - tigate complaints and enforce compliance with the PDPL. Instead of litigation, regulatory fines and inves - tigations have been the primary mechanisms used to address violations. As data protection awareness continues to rise and the enforcement of the PDPL strengthens, it is likely that litigation will increase. Businesses are expected to face greater scrutiny regarding data breaches and violations of data subjects’ rights, which may lead to more litigation relating to compensation or damage claims in the future. SDAIA is the primary authority for PDPL-related com - plaints, and its role will be critical in shaping the future of privacy-related litigation in KSA. In addition, the Anti-Cyber Crime Law plays a signifi - cant role in privacy protection. Recent trends under this Law highlight an increased focus on privacy pro - tection in the digital space. This includes heightened penalties for privacy violations, and the law continues to evolve in line with technological advancements. In 2024, the government enhanced its monitoring of online platforms, with an increasing number of cases involving cybercrime, such as hacking, illegal data interception and online harassment. KSA courts may award compensation for material and non-material (moral) harm under general civil liability principles, assessed on a case-by-case basis. Rel - evant factors may include the nature and sensitivity of the data, the seriousness and duration of the violation, the extent of disclosure, the concrete impact on the individual (eg, distress or reputational injury), and the controller’s fault and remediation. In cross-border transfer arrangements, contractual safeguards (including standard contractual clauses
(SCCs)) may also allocate liability and compensation obligations between the contracting parties. 2.2 Recent Case Law KSA courts publish selectively, and PDPL-specific private litigation is still nascent. As a result, the most influential privacy-related rules have emerged from: (i) criminal and quasi-criminal cases involving unau - thorised access, disclosure or publication of per - sonal content; (ii) defamation and reputational pri - vacy decisions addressing online speech; (iii) labour and employment cases dealing with monitoring and employee data; and (iv) administrative/appeal rulings that review regulator measures on marketing, spam and data handling. Given the limited publication of KSA judgments and the early stage of PDPL-specific private litigation, enforcement in practice has primarily been regulatory, through SDAIA and the committees reviewing viola - tions under the PDPL framework. Where claims are brought before courts, the PDPL recognises a right to seek proportionate compensa - tion for material and moral damage before the com - petent court. In addition, privacy-related disputes in the digital con - text may also involve criminal exposure under KSA’s anti-cybercrime framework, particularly in incidents involving unauthorised access to, interception of or unlawful disclosure of private data. 2.3 Collective Redress Mechanisms As of the time of writing, KSA does not have formal collective redress mechanisms for privacy-related vio - lations, such as the class action system seen in some EU jurisdictions. The PDPL provides a robust frame - work for individual data protection, but it does not cur - rently include provisions for collective actions or class actions for data privacy violations. Therefore, in pri - vacy and data protection matters, collective redress is primarily sought through regulatory and administrative means rather than private, court-led class litigation.
384 CHAMBERS.COM
Powered by FlippingBook