What should Startups in the Middle East know about legal website notices and policies?

Many factors have come together that could accelerate the Middle East's entry into the online marketplace.?The region has high per capita income and spending rates[i]?and high internet user penetration rates of 99 percent in Bahrain[ii]?and the United Arab Emirates,[iii]?followed by 97.9 percent in Saudi Arabia.[iv]??Moreover, the Middle East has a growing technophile population that is among the highest social media consumers in the world.[v]

COVID-19 also accelerated a worldwide shift from traditional brick-and-mortar retail systems to online platforms and services by driving consumers to online and other contact-free payment experiences.??With 73 percent more shopping online than before the pandemic,[vi]?even some of the region's largest retailers, Carrefour and LuLu, have launched online shopping portals.[vii]

Despite these converging factors, online retail sales in the Middle East are only 3 percent of total retail sales,[viii]?leaving opportunities for startups to enter and grow the region's online marketplace.

From fintech startups to entrepreneurs like?AZOM,?NOON,?and?Floward,?entry into the online marketplace starts with the website.??Elements of a successful website include visual design, navigation, content, and other factors.??This article introduces entrepreneurs and startups to the legal rights that apply to website content and personal data and their legal obligations to protect website content, prevent abuse, and comply with the law.

Legally Protected Content

Website content includes texts, images, sounds, and videos consisting of original works, logos, and other materials protected by copyright, trademark, and other intellectual property rights.

Websites, including articles, pictures, training, music, and videos posted or linked to the website, are protected by copyright laws.??Within the Gulf Cooperation Council (GCC),[ix]?copyright laws apply to original works of literature, art, and science.??They also give copyright owners the exclusive right to reproduce, distribute, and publicly perform or display their works of authorship online and in other media and venues.

Trademarks?apply to words, phrases, and logos that distinguish one enterprise's goods, products, and services from the goods, products, and services of another.??Within the region, the GCC Trademark Law[x]?gives trademark owners the exclusive right to use their trademarks, prevent others from using them, and enforce their rights through the GCC member states.[xi]

In addition to trademarks and copyrights, proprietary materials can include financial information, trade secrets, client lists, computer programs, and know-how not made available to the public without authorization.

The legal obligation to protect copyrights, trademarks, and proprietary material applies to the work and material created by website owners and the work and material created by others.??As such, website owners have a commercial interest in protecting their trademarks, copyrights, and proprietary materials from theft and abuse.??They also have a legal interest in preventing the theft and misuse of copyrights, trademarks, and proprietary materials of their partners, customers, and content providers.

Preventing Abuse

In addition to protecting proprietary rights, regional laws make it a crime to collect, store, and distribute illegal content online and to engage in illegal activities online.

For example, it is illegal to access any online content in Saudi Arabia and the United Arab Emirates without legal authorization.[xii]??Specific prohibitions also apply to collecting, storing, and distributing private[xiii]?and confidential?[xiv]?information; personal data;[xv]?financial, credit, and banking information;?[xvi]?and government-related information.[xvii]

Illegal content also includes defamatory, slanderous, or harmful[xviii]?information related to illegal or immoral activities such as human trafficking,[xix]?pornography,[xx]?gambling,[xxi]?narcotics,[xxii]?and terrorist activities.[xxiii]

Illegal conduct applies to activities directed toward individuals and websites.??For example, it is illegal to threaten or blackmail others online;[xxiv]??delete, damage, alter, or redistribute the private data of others online;[xxv]?and engage in online conduct that disturbs public order[xxvi]?or violates religious values, public morals, and privacy.[xxvii]

Illegal conduct also includes hacking websites, changing their design, or occupying their URL;[xxviii]?destroying, deleting, leaking, damaging, or altering website programs and data;[xxix]?and obstructing access to, distorting, or causing a breakdown of website services.[xxx]

These prohibitions against posting illegal content and engaging in illegal conduct apply to Users that engage in prohibited activities and website owners that fail to restrict or remove the offending Users and content.[xxxi]

Protecting Personal Data

In the region, Saudi Arabia, the United Arab Emirates, Bahrain, and others have adopted personal data protection laws (PDPL) to protect the rights of Personal Data Owners.??These rights include knowing that their Personal Data is being collected,[xxxii]?the right to correct their information,[xxxiii]?and the right to request its destruction.[xxxiv]

To collect the names, email addresses, and cookies routinely collected from website visitors and users in the region, website owners must notify Personal Data Owners that their Personal Data is being collected,[xxxv]why it is being collected,[xxxvi]?who will have access to their Personal Data,[xxxvii]?and their rights to access, correct, and stop the processing of their Personal Data.[xxxviii]

Legal Website Notices and Policies

Website notices and policies are used to protect website content, prevent online abuse, and comply with the law.??

Acceptable Use Policies (AUP) help website owners protect their content and the content of their partners, customers, and content providers and protect website owners from legal liability for the illegal activity of others.??At a minimum, the AUP should prohibit posting illegal content and conduct described above and engaging in online conduct that may infringe on the proprietary rights of others, interfere with website operations, or increase the website's vulnerability to cyber-attacks.

Privacy Policies help website owners comply with legal notice requirements necessary to collect Personal Data in the region and inform website users of their rights to their Personal data.??At a minimum, the Privacy Policy should identify the purpose for collecting personal data, how their Personal Data will be processed, and how website Users can exercise their rights to their personal data.

For more information and assistance preparing your website policies and notices, please email?[email protected].

[i]?See?Deloitte, A Middle East Point of View, Spring 2018, by Anish Mehta, Director, and Sachin Bhandari, Senior Manger, Deloitte, UAE.?See also?7 reasons the Middle East has the Hottest E-commerce Market.??by Sini Wilson, September 4, 2021. Aramexpress.

[ii]?https://datareportal.com/reports/digital-2022-bahrain, DIGITAL 2022: BAHRAIN, Simon Kemp, February 15, 2022.

[iii]?https://datareportal.com/reports/digital-2022-united-arab-emirates, DIGITAL 2022: SAUDI ARABIA, Simon Kemp, February 2022

[iv]?https://datareportal.com/reports/digital-2022-saudi-arabia, DIGITAL 2022: SAUDI ARABIA, Simon Kemp, February 2022.

[v]?See?7 reasons the Middle East has the Hottest E-commerce Market, September 4, 2021. Aramexpress.

[vi]?See?7 reasons the Middle East has the Hottest E-commerce Market.

[vii]?Deloitte, A Middle East Point of View, Spring 2018.

[viii]?Online Marketplaces in the Middle East: It’s Only Just Getting Started, January 31, 2023.

[ix]?KSA Copyright Law, Royal Decree No. M/11, 19 Jumada I 1410

UAE Federal Decree Law No. 30 of 2021 on Copyrights and Neighbouring Rights.

[x]?The Trademark Act of the Member States of the Cooperation Council for the

Arab States of the Gulf.

[xi]?Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, and the UAE.

[xii]?KSA Anti-Cyber Crime Law. Article 3. Any person . . . spying on, or intercept[ing], or rec[ieving] . . . data transmitted through an information network or a computer without legitimate authorization.

UAE Federal Decree Law No. 34/2021 Concerning the Fight Against Rumors and Cybercrime. Article 2 Hacking

[xiii]?KSA Article 5,1. Unauthorized access with the intention of cancelling, deleting, destroying, leaking, damaging, altering, or redistributing private data.

UAE Article 44.??Disclosure of Secrets and Privacy Breach.

[xiv]?UAE Article 45.??Disclosure of Confidential Information Ex Officio.

[xv]?UAE Article 6.?Breach of Personal Data and Information.

UAE Article 13. Personal Data and Information Collection and Processing in Violation of Legislations.

[xvi]?KSA Article 4, 2. illegal access to bank or credit data, or data pertaining to the ownership of securities with the intention of obtaining data, information, funds, or services offered.

UAE Article 8. Breach of Data of Financial, Commercial or Economic Establishments.

[xvii]?KSA Article 7, 2. Unauthorized access to a web site or information system directly, or through an information network or computer to obtain data that threatens the internal or external security of the State or its national economy.

UAE Article 5. Compromising Information Systems of a State Institution and Critical Facilities.

UAE Article 7.?Breach of Government Data and Information.

[xviii]?KSA Article?5. Defamation and infliction of damage upon other through the use of various information technology devices.

UAE Article 43.?Insult and Slander.

[xix]?KSA Article 6,?2. The construction or publication of a web site on an information network or computer to promote or facilitate human trafficking.

UAE Article 32.??Creation or Management of Website for Human Trafficking.

[xx]?KSA Article 6,?3.??The preparation, publication, or promotion of material for pornographic networks or gambling activities which violates public morals.

UAE Article 34.??Publication of Pornography and Harming Public Morals.

[xxi]?KSA Article 6,?3.??The preparation, publication, or promotion of material for . . . gambling activities which violates public morals.

UAE Article 38.??Propagation of Practice of Gambling Activities.

[xxii]?KSA Article 6, 4. The construction or publication of a website on an information network or computer to trade, distribute, demonstrate methods of use, or facilitate dealing in narcotic and psychotropic drugs.

UAE Article 31. Narcotics and Psychotropic Substances Trafficking and Supply.

[xxiii]?KSA Article 7, 1. Establishing or publicizing a web site on an information network or computer for terrorist organizations to facilitate communication with the leaders or member of such organizations, finance them, promote their ideologies, publicize methods of making incendiary devices or explosives, or any other means used in terrorist activities.

UAE Article 21.??Favoring and Propagation for Terrorist Groups.

[xxiv]?KSA Article 3. . . . unauthorized access with the intention of threatening or blackmailing any person . . .?

UAE Article 43. Insults and Slander.

[xxv]?UAE Article 6. Breach of Personal Data and Information.

UAE Article 13. Personal Data and Information Collection and Processing in Violation of Legislation.

UAE?Article 44. Disclosure of Secrets and Privacy Breach.

[xxvi]?KSA Article 6, 1. The production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, or privacy, through an information network or computer.

UAE Article 34.??Publication of Pornography and Harming Public.

[xxvii]?KSA Article 6, 1. The production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, or privacy, through an information network or computer.

UAE Article 33.??Incitement to Lewdness and Prostitution.

UAE Article 34.??Publication of Pornography and Harming Public Morals.

UAE Article 37.??Contempt of Regions and Encouraging Sin.?

[xxviii]?KSA Article 3. . . . unauthorized access to a website, or hacking a website to change its design, destroy or modify it, occupy its URL.

UAE Article 2&3.??Hacking

[xxix]?KSA Article 5.??Causing an information network to halt or breakdown, or destroying, deleting, leaking, damaging, or altering existing or used programs or data.

Article 4&5.??Compromising Information Systems.

[xxx]?KSA Article 5.??Obstructing access to, distorting, or causing the breakdown of services by any means.

UAE Article 4&5.??Compromising Information Systems.

[xxxi]?KSA Anti-Cyber Crime Law – Article 9?Any person who incites, assists, or collaborates with other to commit any of the crimes stipulated in the Law shall be subject to a punishment . . .

UAE Article 53. Publication and Abstention from Removal of Illegal Content.

[xxxii]?KSA PDPL Article 4, 1. The right to be informed.

UAE PDPL Article 13. Right of Access to Information.

BAH PDPL Article 17. Information to be provided to the Data Subject.

[xxxiii]?KSA PDPL Article 4, 4. The right to request correction, completion or update of their personal data available to the controlling entity.

UAE PDPL Article 15. Right to Rectification or Erasure of Personal Data.

BAH PDPL Article 23. Right to request rectification, blocking and erasure of data.

[xxxiv]?KSA PDPL Article 4, 5. The right to request destruction of their personal data available to the controlling entity.?

UAE PDPL Article 15.

BAH PDPL Article 23.

[xxxv]?KSA PDPL Article 12.??The controlling entity shall adopt a privacy policy and make it available to personal data owners to review it when collecting their data. And Article 13, The controlling entity shall, in the case of collecting personal data directly from the personal data owner, take adequate means to inform them of the following elements when collecting their personal data.

UAE PDPL Article 13, 2. . . . the Controller shall, prior to the Processing, provide the Data Subject with the information referred to in para. (b), (d), and (g) of subclause (1) above.?

BAH PDPL Article 17. . . . the data controller shall brief the data subject, upon registration of such data . . .

[xxxvi]?KSA PDPL Article 12. . . . this policy includes the purpose of its collection.

UAE PDPL Article 13, 2. (b) the purposes of the Processing.?

BAH PDPL Article 17, b. the purposes for which the data is intended to be processed.

[xxxvii]?KSA PDPL Article 13, 3. The identity and address of those collecting the Personal Data.

UAE PDPL Article 13, d . . . target sectors or enterprises with whom Personal Data concerning him are shared inside and outside the State.

BAH PDPL Article 17, a. The data controller’s full name.

[xxxviii]?KSA PDPL Article 12 . . . the rights of its owner in relation thereto.

UAE PDPL Article 13, f . . . actions for rectification, erasure or restriction of the Processing and objection to Personal Data concerning him.