UAE Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, Bizilance Legal Consultants
5. International Considerations 5.1 Restrictions on International Data Transfers
data subjects before cookies are utilised, and they must be provided with clear and accessible options to opt out of cookie usage. 4.2 Personalised Advertising and Other Online Marketing Practices The UAE Law confers on the data subject a “right to stop processing” where personal data is processed for direct marketing purposes, including profiling to the extent that profiling is related to such direct mar - keting. The DIFC Law provides that a data subject has the right to be informed before personal data is disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing and that the data subject be expressly offered the right to object to direct marketing. The data subject has the right to object to personal data processing for direct market - ing purposes, including profiling to the extent profiling is related to such direct marketing. The ADGM Regulations carry the same provisions as in the DIFC Law, regarding direct marketing. The ADGM Regulations, in addition, provide that when a data subject objects to direct marketing, personal data must not be processed for direct marketing pur - poses. 4.3 Employment Privacy Law Federal Decree Law No 33 of 2021, regarding the regulation of employment relationships, provides that a worker should maintain the confidentiality of infor - mation and data to which they have access by virtue of their work. The UAE Law, the DIFC Law and the ADGM Regula - tions do not contain any provision concerning the role of labour organisations, whistle-blowing or e-discov - ery. 4.4 Data Protection in M&A There is no dedicated framework concerning privacy requirements in M&A; instead, the general framework, as discussed elsewhere in this chapter, is applicable.
The UAE Law provides that personal data may only be transferred outside the UAE to a jurisdiction with a law in place covering various aspects as to the protection of personal data (ie, an adequate level of protection). Personal data may also be transferred to those coun - tries with whom the UAE has bilateral or multilateral agreements in respect of personal data protection. Where no adequacy decision exists, the UAE Personal Data Protection Law permits certain transfers of per - sonal data outside the UAE, subject to the Executive Regulation, including the following: • where legally binding safeguards ensure compli - ance with UAE data protection standards; • where the data subject has expressly consented in a manner consistent with public order and national security; • where the transfer is required for judicial proceed - ings or the exercise of legal rights; • where it is necessary to enter into or perform a contract involving or benefiting the data subject; • where it is undertaken for purposes of international judicial co-operation; or • where it is justified by public interest considera - tions. The DIFC Law provides that personal data may be transferred to a third country or to an international organisation on the basis of an adequate level of pro - tection, as determined by the Commissioner of Data Protection. A list of adequate jurisdictions is issued through the DIFC Data Protection Regulations. In the absence of an adequate level of protection, the personal data may be transferred by incorporating appropriate safeguards, which may be provided by adopting the following: • any agreement between public authorities of both the sender and the receiver; • binding corporate rules; • standard data protection clauses that will be issued by the Commissioner;
536 CHAMBERS.COM
Powered by FlippingBook