UAE Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, Bizilance Legal Consultants
• contact details of the DPO; • the likely consequences or impact of the breach; • a description of the measures taken or proposed by the controller to address the breach and miti - gate its effects; and • any additional information required by the UAE Data Office (where applicable under UAE Federal Law). Where a personal data breach is likely to pose a high risk to the security or rights of a data subject, the controller must also notify the affected data subject of the breach. The notification to the data subject must include the same information that was provided to the competent authority. 1.7 Regulators The UAE Data Office is the regulator for the purposes of the UAE Law. The Commissioner administers the DIFC Law while the Commissioner of Data Protection is responsible for the monitoring and enforcement of the ADGM Regulations. The Central Bank of the UAE and the Telecommuni - cations and Digital Government Regulatory Authority (TDRA) are the regulators concerning the banking and telecommunications sectors, responsible for, among other things, the protection of their respective con - sumers’ data. Health authorities (federal or local government) are entrusted with the protection of patients’ data. The above-mentioned authorities have the powers of investigation and complaint-handling in their respec - tive spheres. 1.8 Enforcement Proceedings and Fines The Data Office (concerning the UAE Law) is compe - tent to receive complaints by data subjects regarding contraventions of provisions of the UAE Law. The Data Office is also competent to impose administrative sanctions for contraventions of provisions of the UAE Law. A person aggrieved by any decision, administra - tive sanction or any action of the Data Office may file a grievance with the Director General of the Data Office.
The grievance is to be filed within 30 days of the date of decision, administrative sanction or action of the Data Office. The Director General of the Data Office is to determine such grievance within 30 days of its filing. The executive regulations to be issued pursuant to the UAE Law will specify the procedural aspects for filing and deciding on such grievances. The Commissioner of Data Protection (under the DIFC Law) is competent to receive complaints from data subjects concerning contraventions of the DIFC Law or any breach of the rights of data subjects. The Commissioner is empowered to investigate the com - plaints and to issue a direction or declaration. The Commissioner is empowered to impose fines in the event of non-compliance with a direction issued by them. Concerning a complaint lodged with them, the Commissioner may follow those practices and proce - dures that will, in the Commissioner’s view, lead to the most timely, fair and effective resolution of the claim in the complaint. The controller, processor or data sub - ject aggrieved by the Commissioner’s decision may appeal to the DIFC Court within 30 days. Upon a contravention of the ADGM Regulations, a data subject may lodge a complaint with the Com - missioner of Data Protection under the ADGM Regula - tions. After an assessment, the Commissioner may: • dismiss the complaint; • uphold the complaint; • uphold the complaint but with no further action; or • take any further action. The aggrieved controller, processor or data subject may refer the matter to the court for review. The court may make any orders that it thinks just and appropri - ate in the circumstances, within three months of the penalty notice, direction or date of complaint. Under the UAE Federal Decree Law, the administra - tive sanctions to be imposed are issued by the cabi - net upon proposal of the Director General of the Data Office. As per the DIFC Law, when the Commissioner consid - ers that a controller or processor is liable for a con - travention of law, they may issue an administrative
533 CHAMBERS.COM
Powered by FlippingBook