Lower House approves amended Personal Data Protection Law
shahennews
The Lower House on Wednesday granted approval to the amended Personal Data Protection Law for the year 2022, marking a pivotal development in the realm of data security and privacy.
Under these revised provisions, entities subject to the regulatory oversight of the Central Bank are now empowered to engage in the processing of personal data. This includes the transfer and exchange of data both within and outside the kingdom. This processing can occur without the need to inform the individual whose data is being processed. This action has been bestowed with the dual status of being both “legal” and “legitimate” under the reformed law.
Of particular significance is the exemption extended to entities entrusted with data processing for the precise purpose for which the data was originally collected. These entities are exempt from the conventional licensing and permit requirements. This exemption, however, hinges on the stipulation that the processed data must not be disseminated or disclosed to external parties.
The term “processing” encompasses a gamut of activities, ranging from the collection, recording, and copying of data to its storage, organization, revision, and eventual utilization. It also encompasses actions such as data transmission, distribution, and display, as well as identity concealment, encoding, destruction, restriction, erasure, modification, description, and disclosure through various means.
In a notable addition, the Senate has proposed the establishment of a specialized regulatory framework to govern the processing of data. This framework aims to ensure adherence to the highest standards of data protection and privacy.
Furthermore, the Senate’s amendments include the omission of the term “accessing data” from the definition of data processing within the draft law. This underscores the legislature’s intent to streamline and clarify the parameters of data processing activities.
In a noteworthy shift of authority, the prerogative to appoint four distinguished experts to the newly formed Personal Data Protection Council, in accordance with the law, now rests with the Cabinet. This responsibility has been transferred from the Minister of Digital Economy and Entrepreneurship.
