EGYPT Law and Practice Contributed by: Ibrahim Shehata, Hesham Kamel, Mohamed Abed and Omar Selim, Shehata & Partners
ry or more detailed obligations, provided they remain consistent with the PDPL and the constitutional right to privacy. Moreover, the PDPL excludes from its scope of appli - cation personal data retained by the Central Bank of Egypt and the entities falling under its jurisdiction (except for money transfer and currency exchange companies), as well as data retained or claimed by the Egyptian Presidency, Ministry of Interior, Ministry of Defence, General Intelligence Service and Admin - istrative Control Authority. The PDPL also excludes personal data related to judicial seizure reports, inves - tigations and lawsuits. Extraterritorial Reach of the PDPL The PDPL’s extraterritorial scope is based on national - ity, residence and effects-based criteria, as set out in its second article of issuance. Under this framework, the PDPL applies to Egyptian nationals who commit any of the offences stipulat - ed therein, regardless of whether such offences are committed in Egypt or abroad. It also applies to non- Egyptian nationals residing in Egypt, irrespective of whether the offence occurs inside or outside Egypt. Furthermore, it extends its arm to non-Egyptian nationals residing abroad, provided that the following conditions are met: • one of the offences stipulated under the PDPL has been committed; • the same act is punishable under the law of the country where it was committed, irrespective of its legal characterisation; or • the personal data concerned relates to Egyptian nationals or to foreign nationals residing in Egypt. 1.2 Rights and Obligations General Principles and Requirements for Processing Personal Data Licensing and approval requirements The collection and processing of personal data is sub - ject to the requirement that the entity carrying out such activities be duly licensed as a data controller and/or processor. Approval must also be obtained from the Personal Data Protection Center for the mechanisms
used to collect personal data, and for the method of obtaining the consent of the data subject. General requirements Personal data must be: • collected for lawful, specific and declared pur - poses; • accurate, valid and adequately secured; • processed in a lawful and appropriate manner consistent with the purposes for which it was col - lected; and • not retained for a period longer than necessary to achieve the specified purpose. Furthermore, the processing of personal data must be made on one of the legal bases permitted by the law, which include obtaining the data subject’s consent, executing a contractual or legal obligation, pursuing a legal action, abiding by an order of a court of an investigation authority, or legitimate interest. Data Subject’s Rights Under Article 2 of the PDPL, personal data may not be collected, processed, disclosed or made available by any means except with the explicit consent of the data subject or in cases expressly permitted by law. In this context, the data subject is granted the follow - ing rights: • the right to be informed of, access, review and obtain personal data held by any data holder, con - troller or processor; • the right to withdraw consent previously given for the retention or processing of personal data; • the right to request the correction, amendment, updating, addition or deletion of personal data; • the right to limit the processing of personal data to a specific scope; • the right to be informed of any breach or violation affecting personal data; and • the right to object to the processing of personal data or its outcomes where such processing conflicts with the data subject’s fundamental rights and freedoms. Except for the right to be informed of data breaches, the exercise of these rights may be subject to a ser -
73 CHAMBERS.COM
Powered by FlippingBook