UAE Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, Bizilance Legal Consultants
fine to the controller or processor. The Commissioner must issue a notice to the controller or processor of the imposition of a fine or may hold the controller or processor liable for damages and compensation pay - able to the data subject. Administrative fines are set out in Schedule 2 of DIFC Data Protection Law No 5 of 2020. Fines corresponding to the contraventions mentioned in Schedule 2 range from USD10,000 to USD100,000. Data subjects are also given a private right of action under the DIFC Law, so that when a data subject suf - fers damage due to a violation of the DIFC Law or its regulations, the data subject may apply to the court for compensation. Under the ADGM Regulations, if a controller or pro - cessor performs an act or abstains from performing an act in contravention of a direction issued by the Commissioner of Data Protection or the ADGM Regu - lations (or subsequent rules made thereunder), they shall be subject to imposition of an administrative fine by the Commissioner. The Commissioner shall send a written “penalty notice” to the controller or processor. The penalty imposed by the Commissioner must not exceed USD28 million. 1.9 Enforcement Trends Under the ADGM Regulations the following penalties have been imposed: • Okadoc Technologies Limited (21 May 2024): The violation involved failure to comply with a data subject’s access request, breaching individual rights. The penalty was a USD20,000 fine under the ADGM Regulations. Adequate processes were lacking for identifying, facilitating and fulfilling the access request. • VentureRock Global Limited (23 June 2023): The violation involved deficiencies in data security, policies and procedures. The ADGM Commissioner of Data Protection found that poor cybersecurity practices due to human error, inadequate training, and lack of proper policies and procedures contrib - uted to the violation. Under the DIFC Law, recent amendments have intro - duced, among other matters, an express principle of
liability and have granted data subjects a private right of action, enabling them to apply to the court for com - pensation.
2. Privacy Litigation 2.1 Privacy Litigation Overview
As discussed in 2.2 Recent Case Law , the ADGM Commissioner of Data Protection has issued a direc - tion in two different cases with respect to contraven - tion of the ADGM Regulations. However, no active court litigation relating to privacy has arisen in this context. 2.2 Recent Case Law No court decisions are currently available. 2.3 Collective Redress Mechanisms UAE law does not provide for collective redress mech - anisms for data subjects. DIFC Law and ADGM Regulations Under the DIFC Law and the ADGM Regulations, mul - tiple data subjects affected by the same offence or violation may file a collective complaint. In addition, the Commissioner may elect to deal collectively with multiple complaints that relate to the same contraven - tion or breach. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation The TDRA has issued a regulatory policy on the inter - net of things (IoT). This policy shall be applicable to all persons connected with IoT within the UAE, including but not limited to: • licensees; • IoT service providers; and • IoT service users, including individuals, businesses and the government. Objective/Scope The IoT policy encompasses the following objectives:
534 CHAMBERS.COM
Powered by FlippingBook