SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
• collection of personal data is necessary to achieve the legitimate interests of the controller, provided that no sensitive personal data is processed and without prejudice to the rights and interests of the personal data subject. Article 11 of the PDPL stipulates the following in rela - tion to privacy, fairness and legitimate interest: • The purpose for which personal data is collected must directly relate to the controller’s purposes and must not contravene any applicable legal provi - sions. • The methods and means of collecting personal data must: (a) not conflict with any legal provisions; (b) be suited to the circumstances of the personal data subject; (c) be direct, clear and secure; and (d) not involve any deception, misleading or extor - tion. • The content of the personal data must be appro - priate and limited to the minimum amount neces - sary to achieve the purpose of the collection. The regulations shall set out the rules applicable in this regard. • If the personal data collected is no longer neces - sary for the purpose for which it has been col - lected, the controller must cease the collection and destroy the previously collected personal data. Article 15 of the PDPL’s implementing regulations also provides specifications relating to the collection of data from third parties, while Article 16 of the PDPL’s implementing regulations addresses the processing of data, other than sensitive personal data, for legiti - mate interests by private entities. A legitimate interest is defined as any necessary interest of the controller that requires the processing of personal data for a specific purpose, provided that it does not adversely affect the rights and interests of the data subject. Legitimate interests include, among others, the disclo - sure of fraud operations and the protection of network and information security. The controller may process personal data to achieve a legitimate interest provided that the processing purpose is legal, but in so far as the processing of data balances the rights and inter -
ests of the data subject with the legitimate interests of the controller, and, in doing so, the controller does not adversely affect the rights and interests of the data subject. Processing shall be within the reasonable expectations of the data subject. Internal or External Privacy Policies Article 12 of the PDPL stipulates that the controller shall adopt a personal data privacy policy and make it available to personal data subjects for review prior to collecting personal data. The policy shall specify the purpose of collection, the personal data to be col - lected, the method of collection, the means of stor - age and processing, the manner in which the personal data shall be destroyed, and the rights of the personal data subject in relation to the personal data and how Article 5 of the PDPL states that a data subject has the right to access their personal data available with the controller provided that such access does not nega - tively impact the rights of others, such as intellectual property rights or trade secrets. Article 6 also makes it clear that, subject to certain parameters, data sub - jects have the right to request a copy of their personal data in a readable and clear format from the controller. Article 13 of the PDPL stipulates that when collecting personal data directly from the personal data sub - ject, the controller shall take appropriate measures to inform the personal data subject of the following prior to collection: • the legal basis and valid practical reasons for col - lecting their personal data; such rights shall be exercised. Data Subjects’ Access Rights • the purpose of the collection, whether collecting some or all of the personal data is mandatory or optional, and that the personal data collected will not be subsequently processed in a manner incon - sistent with the collection purpose or in circum - stances other than those stated in Article 10 of the PDPL; • the identity of the person collecting the personal data and the address of such person’s representa - tive, if necessary (unless the collection is for securi - ty purposes);
387 CHAMBERS.COM
Powered by FlippingBook