<p>The Data Protection Law 2007 (DIFC Law No. 1 of 2007), was recently amended by the Data Protection Law Amendment Law 2012 (DIFC Law No. 5 of 2012), which became effective on 20 December 2012.&nbsp;The 'new' Data Protection Law amends the 'old' Data Protection Law,  which prescribed rules and regulations regarding the collection,  handling, disclosure and use of personal data in the DIFC, the rights of  individuals to whom the personal data relates, and the role of the DIFC  Authority with regard to data protection. The amended Data Protection  Law retains the international best practice standards found in the 2007  law, and is broadly consistent with the 1995 EU Data Protection  Directive. It is designed to balance the legitimate needs of businesses  and organizations to process personal information with the importance of  upholding an individual&rsquo;s right to privacy.<br /><br />Besides  miscellaneous amendments aimed at improving drafting and clarity, the  key changes in the amendedData Protection Law can be summarised as  follows:<br /><br />Duty to notify changes: A Data Controller must notify  the Commissioner of Data Protection of any changes to the particulars of  the Data Controller&rsquo;s notification to the Commissioner. Failure to  notify the Commissioner of such changes as soon as possible &ndash; and in any  event within 14 days from the date upon which the particulars becomes  inaccurate or incomplete &ndash; is a contravention of the law.<br /><br />Delegation  powers of the Commissioner of Data Protection: The Commissioner may  delegate functions and powers to officers and employees of the Dubai  International Financial Centre Authority.<br /><br />General contravention  and administrative imposition of fines: The proposed changes set out  provisions relating to contraventions of the law and the administrative  imposition of fines.<br /><br />As part of the set-up process in the DIFC,  an entity is required to notify the DIFC&rsquo;s Commissioner of Data  Protection if it intends to process personal information. This  notification has to be updated when the entity&rsquo;s commercial licence is  renewed, or if at any time the entity changes the way in which it will  process personal information. The apparent absence of this requirement  from the amended Data Protection Law is one aspect that would have  benefitted from more detailed consideration.<br /><br />An entity that  wishes to process &lsquo;Sensitive Personal Data&rsquo; (being personal information  revealing or concerning (directly or indirectly) racial or ethnic  origin, communal origin, political affiliations or opinions, religious  or philosophical beliefs, criminal record, trade-union membership and  health or sex life), or that wishes to transfer personal information  outside the DIFC to a jurisdiction that is not recognised by the DIFC as  offering an adequate level of protection to personal information, needs  to seek a permit from the Commissioner of Data Protection.</p>
<p>It remains to be seen whether the amendments to the DIFC Data  Protection Law indicates that the Commissioner of Data Protection is  going to become more active in policing the data protection compliance  of entities operating in the DIFC.</p>
<p>Interestingly, in January this year, the European Commission  published its proposal for a new Data Protection Regulation. The EU&rsquo;s  current rules, which the DIFC Data Protection Law emulates to some  degree, are about 17 years old, and the revision is intended, to some  extent, to 'future proof' the EU's data protection regime. It will be  interesting to see if further changes to the DIFC Data Protection Law  will be considered once new European rules make it through the European  legislative process.</p>
<p>Al Tamimi &amp; Company&rsquo;s Technology, Media &amp; Telecommunications  team regularly advises on data protection issues in the Middle East,  including in on-shore Dubai and free zones such as DIFC. For any data  protection related queries, please contact Nick O&rsquo;Connell (<a href="mailto:n.oconnell@tamimi.com">n.oconnell@tamimi.com</a>).</p>