EGYPT Law and Practice Contributed by: Ibrahim Shehata, Hesham Kamel, Mohamed Abed and Omar Selim, Shehata & Partners
• the appointment of a DPO, where required; • notifying data subjects of personal data breaches; • compliance with enhanced obligations relating to sensitive personal data; • specific protections for children’s personal data; • restrictions and conditions on cross-border data transfers; • obligations applicable to direct marketing activities; • requirements governing the use of visual surveil - lance methods in public spaces; and • the obligation to appoint a representative in Egypt, where applicable. 3.4 Regulators and Enforcement In Egypt, the competent authority responsible for enforcing the regulatory frameworks applicable to IoT and cloud computing services is the NTRA. In exercising its mandate, the NTRA co-ordinates with privacy and competition authorities by requiring com - pliance with the PDPL, its Regulations and, recently, the guidelines issued by the Center, as well as with the rules governing competition law in Egypt. In addition, the NTRA and the Egyptian Competition Authority signed a memorandum of understanding to enhance co-ordination and strengthen the protection of free competition in Egypt’s telecom market through a joint executive committee. The co-operation aims to prevent anti-competitive and monopolistic practices, ensure fair regulation of the ICT sector, and maintain high-quality telecom services at fair prices for users. It also seeks to support digital transformation while attracting new investments and safeguarding exist - ing ones. From a competition perspective, Articles 2, 24 and 30 of the Telecommunications Law establish core principles for the protection of free competition in the telecommunications sector, including: • the obligation for licensed operators to provide ser - vices under conditions of free and fair competition; • the prohibition of cross-subsidisation of one ser - vice at the expense of another; and • the requirement to provide services to users with - out discrimination.
The Telecommunications Law further entrusts the NTRA with determining the thresholds beyond which anti-competitive or monopolistic practices may arise within the sectors it regulates. Recent regulatory trends in Egypt include the issuance of the Regulations of the PDPL and the launch of the official website of the Center, which provides practical guidance to stakeholders. These guidelines address key compliance areas, including but not limited to data subject consent, obligations of data users (controllers and processors), data protection principles, and the lawful bases for processing personal data. Collective - ly, these developments reflect a shift toward greater regulatory clarity, operational guidance and enforce - ment readiness in the data protection landscape. Under the general principles of the PDPL, the use of online tracking technologies – including cookies, SDKs and other device identifiers – requires obtaining the prior, explicit and valid consent of the data subject. Where such technologies are used for marketing pur - poses, they are also subject to the rules on electronic direct marketing. Consent must be obtained through fair and transpar - ent means. Misleading consent practices, including dark patterns or interfaces designed to influence user choices, invalidate consent, as it cannot be consid - ered freely given, explicit or informed. 4. Sectoral Topics 4.1 Use of Cookies Each electronic marketing communication must include a clear and effective “unsubscribe” mecha - nism. Where such a mechanism exists in form but is ineffective in practice, or where marketing commu - nications are disguised as personal messages, the processing is unlawful. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised or targeted advertising in Egypt is regu - lated under the PDPL as a form of direct electronic marketing whenever it is based on an individual’s data, behaviour or profiling.
81 CHAMBERS.COM
Powered by FlippingBook