EGYPT Law and Practice Contributed by: Ibrahim Shehata, Hesham Kamel, Mohamed Abed and Omar Selim, Shehata & Partners
Personalised or profiling-based advertising is prohib - ited without the data subject’s prior explicit consent. Marketing communications must: • clearly identify the sender; • state that they are sent for direct marketing pur - poses; • include a valid contact address; and • provide clear and easy mechanisms that allow the individual to refuse the communication or withdraw consent at any time. The PDPL also: • requires marketers to limit the use of data to the specific marketing purpose for which consent was given; • prohibits the disclosure of the data subject’s con - tact details; and • obliges marketers to retain electronic records evidencing consent, its amendments or withdrawal for three years from the date of the last marketing communication. Any use of profiling for marketing purposes falls with - in this regime and requires compliant prior consent. The use of sensitive personal data or children’s data for personalised or targeted advertising is subject to stricter legal restrictions and enhanced safeguards, and is generally high-risk and highly limited under Egyptian law. 4.3 Employment Privacy Law There is no specific or settled guidance directly addressing the protection of employee and applicant data. However, based on the current legal framework and prevailing practice, the following principles apply. Personal data collected during recruitment and job applications is protected under the PDPL even before an employment relationship is formed. Employers must: • limit processing to recruitment purposes; • define appropriate retention periods; and • not reuse or share applicants’ personal data without a valid legal basis, in accordance with the PDPL and constitutional protections of privacy.
The existence of an employer–employee relation - ship does not remove the employee’s right to privacy. Employers act as data controllers and may process employee personal data only for lawful, specific and legitimate purposes, and only to the extent necessary and proportionate, in accordance with the PDPL. Employee monitoring, including time tracking and attendance systems, is permitted where it is neces - sary for work organisation, wage calculation or legal compliance, provided employees are informed in advance. Hidden, excessive or continuous monitor - ing may be prohibited, as it could violate the principle of necessity under the PDPL. Remote work does not expand the employer’s moni - toring powers. Employers may monitor working hours or performance only to the extent required to perform the employment contract. Intrusive monitoring, con - stant surveillance or the use of cameras in the employ - ee’s home is not permitted, as it interferes with the employee’s constitutionally protected private life and exceeds what is necessary under the PDPL. Personal data processed through workplace IT sys - tems, such as corporate email, HR platforms and task management tools, falls within the scope of the PDPL. Such data may be used only for the employ - ment-related purposes for which it was collected, and may not be repurposed for broader surveillance or disciplinary objectives without a lawful basis and prior transparency. Background checks are lawful only where they are directly relevant and necessary for the specific role. Collecting criminal, financial or other sensitive per - sonal data without a clear job-related justification violates the PDPL’s restrictions on sensitive data pro - cessing and the non-discrimination principles under the Labour Law. 4.4 Data Protection in M&A While the PDPL does not explicitly mention M&A transactions and asset deals, it is still applicable to such matters. The processing and transfer of per - sonal data in this context may be based primarily on the legitimate interest legal basis, provided that the
82 CHAMBERS.COM
Powered by FlippingBook