HH the Emir Sheikh Tamim bin Hamad al-Thani on Thursday (November 13) issued Law No 13 of 2016 on protecting personal data.

The law includes provisions related to the rights of individuals to protect the privacy of their personal data.

According to Article 2, the legislation refers only to personal data that is electronically processed, or obtained, gathered or extracted in preparation for electronic processing, or when a combination of electronic and traditional processing is used.

It does not apply to personal data processed by individuals privately or within a family context, or to any personal data gathered for official surveys and statistics.

According the law, businesses are now banned from sending direct marketing messages electronically without obtaining an individual’s prior consent.

According to the law, organizations must adhere to basic data protection responsibilities. This includes ensuring data handlers are properly trained and that necessary precautions are made to “protect personal data from loss, damage, modification, disclosure or being illegally accessed.”

It also includes articles that require consent from individuals before their personal information can be used by an organization.

According to Article 17, the owner or operator of any website related to children must put up a policy about how it manages the information of minors. These website operators must also get the consent of the child’s parent when processing their information.

The law is effective starting from its date of publication in the official gazette.

The introduction of new data protection laws in Qatar should help spur investment in the country, an expert has said.

The Personal Data Privacy Protection Law is set to be published shortly in the state's legal gazette and due to take effect six months from the date of publication. 

Specialist in technology contracts Diane Mullenex of Pinsent Masons, the law firm behind Out-Law.com, said the new legislation promises to provide organisations with greater legal certainty over how personal data can be collected, used and shared. This in turn will help support Qatar's development of smart cities, as well as moves to digitise health care and support the use of connected and autonomous vehicles, among other major technology projects the country is engaging in, she said.

Mullenex said Qatar will be leading the way in the GCC where many countries have yet to enact any federal legislation in respect of data protection. She said the new law is an important part of a legislative strategy aimed at supporting the pillars of Qatar's 2030 vision, specifically those of human, economic and social development.

"The new law is set to define and protect personal information and is likely to include mechanisms for express consent to be given by individuals before a company may use such personal information; and it could see the specific demarcation of certain types of sensitive data, for example in relation to children or issues such as a person’s physical or mental health," Mullenex said. "It will also strike a balance between the rights of individuals to privacy and the ability for organisations to use data for the purpose of their business."

"We also expect the new law to introduce fines and penalties for breaches and non-compliance, which will add a degree of certainty for both individuals and organisations as to their rights in relation to personal information and what can be done with it. Such additional certainly will be positive for investors, adding a degree of clarity and protection that will enable them to enter the Qatari market knowing that both personal and corporate information is now more likely to be adequately protected," Mullenex said.

Mullenex said the measures designed to improve data security were "especially relevant" given the growth of e-commerce and digitisation and the cybersecurity issues that have come to prominence in recent times.

"Now, where business deal in or with personal information, the rules are known, compliance procedures can be implemented, risk can be better managed and business models can be developed to accommodate the new laws," Mullenex said. "This will be an incentive for further investment in Qatar."

http://www.motc.gov.qa/en/documents/document/qatar-issues-personal-data-privacy-law-5