EGYPT Law and Practice Contributed by: Ibrahim Shehata, Tasneem El-Naggar and Safa Rabea, Shehata & Partners
the provisions of the PDPL, in addition to regu - lating the methods of reconciliation when any of these violations are committed. For instance, a fine of no less than EGP100,000 and no more than EGP1 million will be charged to any data controller, processor or holder who discloses personal data or who makes it avail - able, in cases other than those punishable by law. A controller or processor who prevents the person concerned with the data from exercising the rights conferred upon them by law will be punished with the same penalty. Furthermore, the penalty is increased to a fine of between EGP500,000 and EGP5 million where violating the provisions of permits or licences should be pursued under the DPL. It is worth mentioning that the PDPL has adopted a relatively new punitive act that penalises those responsible for the actual management of a legal person with the same penalties prescribed for individuals violating the provisions of the DPL, if it can be proved that the manager was aware of such violations and that the breach of their duties can be contributed to the occurrence. 1.3 Enforcement Proceedings and Fines Administration and Enforcement Process Practically speaking, there are still no prece - dents in relation to the administrative process that the PDPC must follow to investigate and impose penalties on PDPL violators, due to the fact that the PDPC has not yet been established, along with the absence of PDPL executive regu - lations that should regulate such administrative process. Nonetheless, the PDPL states that any person concerned about personal data, who has capacity and direct interest, has the right to complain to the PDPC in the following cases, without prejudice to the right to resort to the judiciary:
• violation or breach of the right to protect personal data; • the person concerned is prevented from ful - filling their rights; or • regarding decisions issued by the Data Protection Office (DPO) in connection with requests submitted to it. The complaint will be submitted to the PDPC, which will follow the necessary investigation procedures. The PDPC must issue its decision within 30 working days from the date of the sub - mission, provided that the complainant and the defendant are notified of the decision. The defendant is obliged to implement the PDPC’s decision within seven working days from the date of notification, and to inform the PDPC of what has been done towards the implementa - tion of its decision. Calculation of Administrative Fines The calculation of administrative fines for the violation of data protection is governed by the PDPL, which outlines specific penalties for vari - ous offences related to personal data handling, in which it includes both administrative and criminal liabilities. The calculation of administra - tive fines under the PDPL can vary significantly based on the nature of the offence, with the fol - lowing examples. For unauthorised data handling Any holder, controller or processor who collects, processes, discloses, provides access to or cir - culates electronically processed personal data without legal authorisation or the consent of the data subject is subject to a fine ranging from EGP100,000 to EGP1 million.
105 CHAMBERS.COM
Powered by FlippingBook