EGYPT Law and Practice Contributed by: Ibrahim Shehata, Hesham Kamel, Mohamed Abed and Omar Selim, Shehata & Partners
private sectors, leveraging their advantages in devel - oping software, enhancing workforce capabilities and improving service efficiency. It also accelerates the pace of secure data migration and the use of data through public cloud computing systems. Data Classification and Future Legislative Developments Through its executive office and specialised commit - tees, the SCDS continues to undertake efforts to pre - pare a draft law establishing binding rules and stand - ards for the classification, availability and exchange of official data and information. In addition, the Cloud Policy emphasises that proper data classification is a core pillar of effective cloud computing governance. Given the significance of data classification, work is currently underway to prepare the draft law mentioned above. Pending the issuance of this legislation, the Cloud Policy adopts an interim data classification approach aligned with international standards, and classifies data into four levels: public, confidential, secret and top secret. For the purposes of the Cloud Policy, public data refers to public data that held by the governmental authorities and available for general access. Accord - ingly, such data would fall within the scope of the Open Data Policy and be subject to its rules on access, use and reuse. 3.2 Interaction of Data Regulation and Data Protection With respect to the legal basis and confidentiality of personal data, Egyptian law adopts a clear hierarchy. Where data processed under IoT or cloud comput - ing frameworks qualifies as personal data, the legal basis for processing and the confidentiality obliga - tions are governed solely by the PDPL and its Regu - lations. However, sector-specific frameworks (ie, IoT or cloud computing) do not create independent legal bases for processing personal data and instead defer to the PDPL. Moreover, in the absence of a dedicated non-personal data protection regime in Egypt, non-personal data must meet specific requirements in order to be treated as a trade secret under the Intellectual Property Law No 82 of 2002. In particular, the data must:
• have commercial value as a result of not being publicly available; • be known only to a limited group of persons; and • be subject to reasonable measures taken by its holder to preserve its confidentiality, including the use of confidentiality agreements with employees and business partners. Alternatively, such data may be registered as a copy - right, provided that it fulfils the legal and regulatory conditions. 3.3 Rights and Obligations Under Applicable Data Regulation In the absence of a clear legislative framework in Egypt governing the rights and obligations relating to the use of non-personal data, other than the Open Data Policy discussed in 3.1 Objectives and Scope of Data Regulation , and pending the issuance of the anticipated data governance law, the existing regula - tory frameworks applicable to IoT and cloud comput - ing primarily operate by reference to the rules govern - ing personal data, to the extent that any personal data is involved. Accordingly, the current rights and obligations under these frameworks largely relate to the use of personal data, as regulated by the PDPL, its Regulations and the guidelines issued by the Center. In this context, Article 2 of the PDPL establishes a set of fundamental rights granted to data subjects (see 1.2 Rights and Obligations for more detail). At present, the PDPL expressly provides for the right of access, while the remaining rights are not explicitly detailed. However, the Center is expected to further clarify and address such rights through the issuance of additional specific guidance. Articles 4 and 5 of the PDPL and Articles 3 and 4 of its Regulations set out the core obligations applicable to personal data users, whether acting as controllers or processors. These provisions establish the main responsibilities governing the lawful use of personal data, including, in particular: • obtaining the relevant licences or permits; • the obligation not to unlawfully disclose personal data;
80 CHAMBERS.COM
Powered by FlippingBook