|
Q. Who is responsible for administering the Data Protection Law in the DIFC?
The DIFC Authority is responsible for administering the Data Protection Law, (DIFC Law No. 1 of 2007 (the “Law”).
Q. What is Personal Data?
Personal Data is any information relating to an identified natural Person or Identifiable Natural Person. For example, Personal Data may include an individual’s name, age, home address, race, sexual orientation, income, blood type, marital status, education, and employment information.
Q. What is Sensitive Personal Data?
Sensitive Personal Data is personal data relating to an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, offences and criminal convictions, trade union membership, health or sex life.
Q. Who is a Data Subject?
A Data Subject is the individual to whom the Personal Data relates. For example, where an organisation holds Personal Data about its employees, the employees are Data Subjects.
Q. Who is a Recipient?
A Recipient is any person to whom Personal Data is disclosed. An example of a Recipient is a member of the human resources department in an organisation who receives Personal Data or Sensitive Personal Data about employees of that organisation.
Q. Who is a Data Controller?
A Data Controller is any Person in the DIFC who determines the purposes for which, and the manner in which, any Personal Data is to be Processed.
Q. What is Processing?
Processing is any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
Q. What is the purpose of the Legislation?
The Legislation is intended to protect the confidentiality of Personal Data. It creates a legal and procedural framework which ensures that an individual’s Personal Data in the DIFC is treated fairly, lawfully and securely when it is stored, used or released.
The Legislation strikes a balance between a Data Subject’s right to control access to, and the use of, their Personal Data with a Data Controller’s need to collect and use Personal Data for legitimate purposes.
Q. What about expressions of opinion?
Personal Data includes “any information” relating to an individual. Therefore this may include an employer’s appraisal or opinion of an employee.
Q. What determines whether data relates to an individual?
Whether information relates to a particular individual will be a question of fact in each case. If a connection can be made between the information and an individual, then the information is Personal Data. Personal Data can relate to more than one individual. For example, information concerning a joint bank account relates to both account holders and therefore is the Personal Data of each account holder and would be protected as such.
Q. What must a Data Controller do when it wants to deal with an individual’s Personal Data?
The Data Controller must notify the DIFCA when it is:
- Processing Sensitive Personal Data; and/or transferring Personal Data outside the DIFC to a jurisdiction that does not have adequate levels of data protection.
- If Processing continues, the DIFCA must be notified annually.
- If during the year, the manner of Processing is changed, a notification reflecting this must be submitted.
Notification by a Data Controller is carried out by completing a notification form and sending it to the Data Protection Commissioner at the DIFC Authority. Forms can be downloaded from the DIFC website: www.difc.ae
Q. Is there a fee for notification?
Yes.
Q. When is a permit required?
An application for a permit may be made to the DIFCA by a Data Controller if it is:
- Processing an individual’s Sensitive Personal Data, but not within Article 10 (1) of
the Law; or
- transferring an individual’s Personal Data outside the DIFC, but not within Article
11(1) of the Law.
The DIFCA may in its absolute discretion refuse to grant applications for permits.
Q. How is a permit obtained?
A Data Controller may obtain a permit by completing the applicable application forms and sending it to the Data Protection Commissioner at the DIFC Authority. Forms can be downloaded from the DIFC website: www.difc.ae. There is a separate permit application form for Processing Sensitive Personal Data and transferring Personal Data outside the DIFC.
Q. Is there a fee for a permit?
Yes.
Q. What are my rights as a Data Subject?
The Legislation gives certain rights to Data Subjects concerning their Personal Data and Sensitive Personal Data. Generally, a Data Subject has the right to access any Personal Data that is kept about them.
If the Personal Data Processed by the Data Controller is inaccurate, then the Data Subject can request the Data Controller to take action to rectify, block or destroy the inaccurate data. However, there are certain circumstances, or exemptions, where it is legal for a Data Controller not to have to notify a Data Subject that Personal Data is being Processed. For example, where Personal Data is being released to a legitimate authority to comply with anti money laundering obligations.
A Data Subject can object on reasonable grounds to the Processing of their Personal Data, and request their Personal Data not be disclosed to third parties. This may include circumstances where an individual requests a Data Controller to cease Processing Personal Data for the purposes of direct marketing. If the Data Controller objects to the request within the Legislation, the Data Subject may file a complaint with the Data Protection Commissioner at the DIFCA who may refer the matter to mediation.
Q. How does a Data Controller comply with the core provisions of the Law?
Dealing with the Data Subject
A Data Controller must securely keep any Personal Data it collects and Process it fairly and lawfully.
At or before the time Personal Data is collected from a Data Subject, a Data Controller should take reasonable steps to ensure that the Data Subject is aware of:
- the identity of the Data Controller and how to contact it;
- the fact that the Data Subject is able to gain access to their Personal Data;
- the purposes for which their Personal Data is collected;
- other persons to whom the Data Controller usually discloses data of that kind;
and
- the main consequence for the Data Subject if all or part of the data is not
provided.
If a Data Controller intends to Process the Personal Data collected from a Data Subject, it is suggested that when the Data Controller collects that Personal Data, the Data Controller obtain the Data Subject’s written consent to such Processing at the same time.
Initial internal procedures
The Data Controller should consider the following for all Personal Data:
- purpose for which it holds Personal Data;
- number of individuals identified in the Personal Data it holds;
- nature of the Personal Data;
- length of time it holds Personal Data;
- procedure for individuals identified by the Personal Data it holds to obtain access to their Personal Data; and
- the possible consequences for individuals identified by the Personal Data it holds as a result of the way it holds, erases or Processes Personal Data.
Ongoing internal procedure
The Data Controller should consider the following matters:
- is there a record of when the Personal Data it holds was recorded or last updated?
- are all those involved with the collection and Processing of Personal Data, including people to whom they are disclosed as well as employees of the Data Controller, aware that the Personal Data may not necessarily be up to date and accurate?
- are steps taken to update the Personal Data, for example, by checking back at intervals with the original source or with the Data Subject? If so, how effective are these steps?
- if the Personal Data is out of date is it likely to cause damage or distress to the Data
Subject?
Transfers
Before Personal Data is transferred outside the DIFC the Data Controller should consider the following matters:
- does it need a permit?
- has the DIFC Authoritygranted a permit to transfer the Personal Data?
- has the Data Subject unambiguously consented to the proposed transfer?
- is the transfer necessary for the performance of a contract between the Data Subject and the Data Controller?
- is the transfer necessary or legally required on grounds important in the interests of the DIFC, or for the establishment, exercise or defence of legal claims?
- is the transfer necessary in order to protect the vital interests of the Data Subject?
- is the transfer intended to provide information to the public which is open to consultation?
- is the transfer necessary to comply with any legal obligation?
- is the transfer necessary to uphold the legitimate interests of the Data Controller recognised in the international financial markets?
- is the transfer necessary to comply with auditing, accounting or anti-money laundering obligations that apply to a Data Controller?
If, after reading this, you require further information, please contact:
The Data Protection Administrator
Dubai International Financial Centre Authority
Level 14, The Gate
PO Box 74777,
Dubai, United Arab Emirates
Email: administrator@dp.difc.ae
Tel : +971 4 362 2655
Fax: +971 4 362 2656
|
