INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297025, 28447, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\">The <a href=\"https://www.tamimi.com/law-update-articles/getting-to-grips-with-vat-implementation/\">introduction of value added tax</a> (VAT) in the UAE and KSA raises complexities for education providers, even as both countries are now moving towards the eighth month since the implementation of VAT.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In this article, we will examine the UAE VAT treatment of supplies made in the education sector and the VAT issues which arise in the industry.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">The VAT story so far in the Education Sector in the UAE</h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8217 alignright\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/6.jpg\" alt=\"\" width=\"570\" height=\"397\" /></h3>\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What is the VAT treatment in the education sector?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">By way of background, VAT is imposed at the standard rate of 5% on the taxable supply of most goods and services (unless the supply is zero-rated (0%) or exempt) made in the UAE by a taxable person for consideration in the course of conducting business in the UAE.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The main difference between standard rated, zero rated and exempt supplies is that input tax incurred in connection with standard rated or zero rated supplies is as a general rule recoverable (subject to the normal rules of input tax recovery). Conversely, input VAT incurred in connection with exempt supplies is not generally recoverable.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the UAE, the supply of educational services and related goods and services for nurseries, preschool, school education, and higher educational institutions owned or funded by Federal or local Government is subject to VAT at the zero-rate.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">For a supply of educational services to qualify for zero-rating, the following conditions prescribed under the UAE VAT Executive Regulations should be fulfilled:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the supply of educational services must be provided in accordance with a curriculum recognised by the federal/local competent government entity;</li>\r\n 	<li dir=\"LTR\">the supplier of the educational services is an educational institution which is accredited by the federal/local competent government entity; and</li>\r\n 	<li dir=\"LTR\">where the supplier of educational services is a higher education institution, the institution is either (i) owned by the federal or local government; or (ii) receiving at least 50% of its annual funding directly from the federal or local government.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions may also avail of the zero-rating treatment in respect of the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a supply of goods or services that is directly related to the provision of a zero-rated educational service; and</li>\r\n 	<li dir=\"LTR\">printed and digital reading material which are related to the curriculum of an education.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Are there any exceptions to the zero-rating rule?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Not all supplies made by qualifying educational institutions benefit from this zero-rating rule. The following supplies are specifically excluded from this treatment and will therefore be subject to VAT at the standard rate:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">goods and services supplied to persons who are not enrolled in the educational institution;</li>\r\n 	<li dir=\"LTR\">any goods other than educational materials provided by the educational institution;</li>\r\n 	<li dir=\"LTR\">uniforms or any other clothing required to be worn by the educational institution;</li>\r\n 	<li dir=\"LTR\">electronic devices in relation to educational services;</li>\r\n 	<li dir=\"LTR\">food and beverages at the educational institution;</li>\r\n 	<li dir=\"LTR\">recreational field trips;</li>\r\n 	<li dir=\"LTR\">extracurricular activities provided for an additional fee; and</li>\r\n 	<li dir=\"LTR\">student organisation memberships.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">Additionally, the supply of residential accommodation for students or school pupils is exempt from VAT. This means that qualifying educational institutions will be unable to recover any input VAT paid on expenses that are related to the supply of residential accommodation.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Would qualifying educational institutions need to register for VAT in the UAE?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions are required to register for VAT in the UAE if the value of their annual taxable turnover meets the mandatory registration threshold of AED 375,000. In calculating the value of taxable turnover, the value of standard rated and zero-rated supplied made by the qualifying educational institutions must be taken into account.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions may also apply for an exception to register for VAT in the UAE if they make wholly zero-rated supplies. If the application is approved, the educational institution will be exempted from any VAT obligations such as filing VAT returns. However, in doing so, educational institutions will be unable to recover any input VAT incurred on their expenses. In determining whether to apply for the exception to register for VAT, educational institutions should carefully assess the potential VAT compliance costs against the amount of recoverable input VAT.</p>\r\n\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"While the primary supply of most educational services is zero-rated in the UAE, the VAT treatment of some activities may not always be straightforward. Given that the VAT regime is still in its early stages of implementation, it is expected that the VAT legislation would continue to evolve. Educational institutions should continuously ensure that the correct VAT treatment is applied to all of its transactions.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">The VAT issues</h3>\r\n<img class=\"wp-image-8218  alignright\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/7.jpg\" alt=\"\" width=\"541\" height=\"341\" />\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What type of supplies are \"directly related\" to the provision of a zero-rated educational service?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">As noted above, a supply of goods or services made by educational institutions is treated as zero-rated where the supply is directly related to the provision of a zero-rated educational service. However, the UAE VAT Executive Regulations do not provide further guidance on what constitutes supplies which are \"directly related\" to the provision of a zero-rated educational service. This uncertainty will likely give rise to challenges in ascertaining the VAT treatment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">For example, a qualifying educational institution provides music courses. As part of the course requirements, students of the institution are required to perform in a musical concert held at the institution. Only the students’ family members and friends who received a special invitation are allowed to attend the musical concert. The concert tickets are sold at a reduced fee to cover some of the costs of running the musical concert. Can the supply of the musical performances be treated as a supply \"directly related\" to the provision of an educational service?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is arguable that the supply of the musical performance may be \"directly related\" to the provision of educational service considering that:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the principal supply of the qualifying educational institution is zero-rated educational service; and\\</li>\r\n 	<li dir=\"LTR\">the practical training arising from the supply of musical performances forms a necessary and essential part of the curriculum;</li>\r\n 	<li dir=\"LTR\">therefore, the supply of musical performances is ancillary to the principal supply; and</li>\r\n 	<li dir=\"LTR\">the musical concert is not in competition with any commercial enterprise and not generating additional profits.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">On the other hand, the supply of the musical performances may also be regarded as falling under the scope of the exception to the zero-rating rule, and therefore be subject to VAT at the standard rate. It can be contended that the musical performances are supplied to third parties, rather than the intended recipient of educational services, i.e., the students. Further, the supply of musical performances itself will generally be treated as standard rated if it was conducted in the course of business.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What is the VAT treatment of grants and sponsorships?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">It is common for the government or third parties to provide educational institutions with financial support such as grants or sponsorships. While the VAT legislation does not prescribe the VAT treatment of grants or sponsorships, the general principle is that if a monetary grant or sponsorship is freely given without receiving anything in return, the grant or sponsorship will not constitute consideration for any supply. Therefore, the grant or sponsorship would fall outside the scope of UAE VAT.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Conversely, if the grantor or sponsor receives a benefit or something in return from the educational institution for the monetary grant or sponsorship, the grant or sponsorship may be subject to VAT. The benefit provided by the educational institution will be rated as a taxable supply and the educational institution will have to account for VAT on the benefit. Currently, determining what constitutes a benefit is a grey area. As such, it is open to question as to whether an inclusion of the sponsor in a list of supporters in a notice or naming a university building after the sponsor may be considered as benefits.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Final remarks</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Generally, the primary supply of most educational services is zero-rated in the UAE to the extent the educational services are provided in accordance with an accredited curriculum by qualifying educational institutions. Notwithstanding this, the VAT treatment of some activities may not always be straightforward. Given that the VAT regime is still in its early stages of implementation, it is expected that the VAT legislation will continue to evolve. Educational institutions should continuously ensure that the correct VAT treatment is applied to all of its transactions, in compliance with the current VAT legislation.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/practice/tax/\">tax team</a> regularly advises on VAT and other tax matters. For further information, please contact <a href=\"https://www.tamimi.com/lawyer/shiraz-khan/\">Shiraz Khan</a> (<a href=\"mailto:s.khan@tamimi.com\">s.khan@tamimi.com</a>) or <a href=\"https://www.tamimi.com/lawyer/janet-gooi/\">Janet Gooi</a> (<a href=\"mailto:j.gooi@tamimi.com\">j.gooi@tamimi.com</a>).</em>'),
(297026, 28447, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\">The <a href=\"https://www.tamimi.com/law-update-articles/getting-to-grips-with-vat-implementation/\">introduction of value added tax</a> (VAT) in the UAE and KSA raises complexities for education providers, even as both countries are now moving towards the eighth month since the implementation of VAT.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In this article, we will examine the UAE VAT treatment of supplies made in the education sector and the VAT issues which arise in the industry.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">The VAT story so far in the Education Sector in the UAE</h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8217 alignright\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/6.jpg\" alt=\"\" width=\"520\" height=\"362\" /></h3>\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What is the VAT treatment in the education sector?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">By way of background, VAT is imposed at the standard rate of 5% on the taxable supply of most goods and services (unless the supply is zero-rated (0%) or exempt) made in the UAE by a taxable person for consideration in the course of conducting business in the UAE.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The main difference between standard rated, zero rated and exempt supplies is that input tax incurred in connection with standard rated or zero rated supplies is as a general rule recoverable (subject to the normal rules of input tax recovery). Conversely, input VAT incurred in connection with exempt supplies is not generally recoverable.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the UAE, the supply of educational services and related goods and services for nurseries, preschool, school education, and higher educational institutions owned or funded by Federal or local Government is subject to VAT at the zero-rate.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">For a supply of educational services to qualify for zero-rating, the following conditions prescribed under the UAE VAT Executive Regulations should be fulfilled:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the supply of educational services must be provided in accordance with a curriculum recognised by the federal/local competent government entity;</li>\r\n 	<li dir=\"LTR\">the supplier of the educational services is an educational institution which is accredited by the federal/local competent government entity; and</li>\r\n 	<li dir=\"LTR\">where the supplier of educational services is a higher education institution, the institution is either (i) owned by the federal or local government; or (ii) receiving at least 50% of its annual funding directly from the federal or local government.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions may also avail of the zero-rating treatment in respect of the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a supply of goods or services that is directly related to the provision of a zero-rated educational service; and</li>\r\n 	<li dir=\"LTR\">printed and digital reading material which are related to the curriculum of an education.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Are there any exceptions to the zero-rating rule?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Not all supplies made by qualifying educational institutions benefit from this zero-rating rule. The following supplies are specifically excluded from this treatment and will therefore be subject to VAT at the standard rate:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">goods and services supplied to persons who are not enrolled in the educational institution;</li>\r\n 	<li dir=\"LTR\">any goods other than educational materials provided by the educational institution;</li>\r\n 	<li dir=\"LTR\">uniforms or any other clothing required to be worn by the educational institution;</li>\r\n 	<li dir=\"LTR\">electronic devices in relation to educational services;</li>\r\n 	<li dir=\"LTR\">food and beverages at the educational institution;</li>\r\n 	<li dir=\"LTR\">recreational field trips;</li>\r\n 	<li dir=\"LTR\">extracurricular activities provided for an additional fee; and</li>\r\n 	<li dir=\"LTR\">student organisation memberships.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">Additionally, the supply of residential accommodation for students or school pupils is exempt from VAT. This means that qualifying educational institutions will be unable to recover any input VAT paid on expenses that are related to the supply of residential accommodation.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Would qualifying educational institutions need to register for VAT in the UAE?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions are required to register for VAT in the UAE if the value of their annual taxable turnover meets the mandatory registration threshold of AED 375,000. In calculating the value of taxable turnover, the value of standard rated and zero-rated supplied made by the qualifying educational institutions must be taken into account.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions may also apply for an exception to register for VAT in the UAE if they make wholly zero-rated supplies. If the application is approved, the educational institution will be exempted from any VAT obligations such as filing VAT returns. However, in doing so, educational institutions will be unable to recover any input VAT incurred on their expenses. In determining whether to apply for the exception to register for VAT, educational institutions should carefully assess the potential VAT compliance costs against the amount of recoverable input VAT.</p>\r\n<img class=\"wp-image-8218  alignright\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/7.jpg\" alt=\"\" width=\"541\" height=\"341\" />\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"While the primary supply of most educational services is zero-rated in the UAE, the VAT treatment of some activities may not always be straightforward. Given that the VAT regime is still in its early stages of implementation, it is expected that the VAT legislation would continue to evolve. Educational institutions should continuously ensure that the correct VAT treatment is applied to all of its transactions.\"</h2>\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">The VAT issues</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What type of supplies are \"directly related\" to the provision of a zero-rated educational service?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">As noted above, a supply of goods or services made by educational institutions is treated as zero-rated where the supply is directly related to the provision of a zero-rated educational service. However, the UAE VAT Executive Regulations do not provide further guidance on what constitutes supplies which are \"directly related\" to the provision of a zero-rated educational service. This uncertainty will likely give rise to challenges in ascertaining the VAT treatment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">For example, a qualifying educational institution provides music courses. As part of the course requirements, students of the institution are required to perform in a musical concert held at the institution. Only the students’ family members and friends who received a special invitation are allowed to attend the musical concert. The concert tickets are sold at a reduced fee to cover some of the costs of running the musical concert. Can the supply of the musical performances be treated as a supply \"directly related\" to the provision of an educational service?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is arguable that the supply of the musical performance may be \"directly related\" to the provision of educational service considering that:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the principal supply of the qualifying educational institution is zero-rated educational service; and\\</li>\r\n 	<li dir=\"LTR\">the practical training arising from the supply of musical performances forms a necessary and essential part of the curriculum;</li>\r\n 	<li dir=\"LTR\">therefore, the supply of musical performances is ancillary to the principal supply; and</li>\r\n 	<li dir=\"LTR\">the musical concert is not in competition with any commercial enterprise and not generating additional profits.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">On the other hand, the supply of the musical performances may also be regarded as falling under the scope of the exception to the zero-rating rule, and therefore be subject to VAT at the standard rate. It can be contended that the musical performances are supplied to third parties, rather than the intended recipient of educational services, i.e., the students. Further, the supply of musical performances itself will generally be treated as standard rated if it was conducted in the course of business.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What is the VAT treatment of grants and sponsorships?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">It is common for the government or third parties to provide educational institutions with financial support such as grants or sponsorships. While the VAT legislation does not prescribe the VAT treatment of grants or sponsorships, the general principle is that if a monetary grant or sponsorship is freely given without receiving anything in return, the grant or sponsorship will not constitute consideration for any supply. Therefore, the grant or sponsorship would fall outside the scope of UAE VAT.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Conversely, if the grantor or sponsor receives a benefit or something in return from the educational institution for the monetary grant or sponsorship, the grant or sponsorship may be subject to VAT. The benefit provided by the educational institution will be rated as a taxable supply and the educational institution will have to account for VAT on the benefit. Currently, determining what constitutes a benefit is a grey area. As such, it is open to question as to whether an inclusion of the sponsor in a list of supporters in a notice or naming a university building after the sponsor may be considered as benefits.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Final remarks</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Generally, the primary supply of most educational services is zero-rated in the UAE to the extent the educational services are provided in accordance with an accredited curriculum by qualifying educational institutions. Notwithstanding this, the VAT treatment of some activities may not always be straightforward. Given that the VAT regime is still in its early stages of implementation, it is expected that the VAT legislation will continue to evolve. Educational institutions should continuously ensure that the correct VAT treatment is applied to all of its transactions, in compliance with the current VAT legislation.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/practice/tax/\">tax team</a> regularly advises on VAT and other tax matters. For further information, please contact <a href=\"https://www.tamimi.com/lawyer/shiraz-khan/\">Shiraz Khan</a> (<a href=\"mailto:s.khan@tamimi.com\">s.khan@tamimi.com</a>) or <a href=\"https://www.tamimi.com/lawyer/janet-gooi/\">Janet Gooi</a> (<a href=\"mailto:j.gooi@tamimi.com\">j.gooi@tamimi.com</a>).</em>'),
(297027, 28447, 'MetaLink', 'content'),
(297028, 28447, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8199&amp;action=edit'),
(297029, 28447, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\">The <a href=\"https://www.tamimi.com/law-update-articles/getting-to-grips-with-vat-implementation/\">introduction of value added tax</a> (VAT) in the UAE and KSA raises complexities for education providers, even as both countries are now moving towards the eighth month since the implementation of VAT.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In this article, we will examine the UAE VAT treatment of supplies made in the education sector and the VAT issues which arise in the industry.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">The VAT story so far in the Education Sector in the UAE</h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8217 alignright\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/6.jpg\" alt=\"\" width=\"520\" height=\"362\" /></h3>\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What is the VAT treatment in the education sector?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">By way of background, VAT is imposed at the standard rate of 5% on the taxable supply of most goods and services (unless the supply is zero-rated (0%) or exempt) made in the UAE by a taxable person for consideration in the course of conducting business in the UAE.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The main difference between standard rated, zero rated and exempt supplies is that input tax incurred in connection with standard rated or zero rated supplies is as a general rule recoverable (subject to the normal rules of input tax recovery). Conversely, input VAT incurred in connection with exempt supplies is not generally recoverable.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the UAE, the supply of educational services and related goods and services for nurseries, preschool, school education, and higher educational institutions owned or funded by Federal or local Government is subject to VAT at the zero-rate.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">For a supply of educational services to qualify for zero-rating, the following conditions prescribed under the UAE VAT Executive Regulations should be fulfilled:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the supply of educational services must be provided in accordance with a curriculum recognised by the federal/local competent government entity;</li>\r\n 	<li dir=\"LTR\">the supplier of the educational services is an educational institution which is accredited by the federal/local competent government entity; and</li>\r\n 	<li dir=\"LTR\">where the supplier of educational services is a higher education institution, the institution is either (i) owned by the federal or local government; or (ii) receiving at least 50% of its annual funding directly from the federal or local government.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions may also avail of the zero-rating treatment in respect of the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a supply of goods or services that is directly related to the provision of a zero-rated educational service; and</li>\r\n 	<li dir=\"LTR\">printed and digital reading material which are related to the curriculum of an education.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Are there any exceptions to the zero-rating rule?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Not all supplies made by qualifying educational institutions benefit from this zero-rating rule. The following supplies are specifically excluded from this treatment and will therefore be subject to VAT at the standard rate:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">goods and services supplied to persons who are not enrolled in the educational institution;</li>\r\n 	<li dir=\"LTR\">any goods other than educational materials provided by the educational institution;</li>\r\n 	<li dir=\"LTR\">uniforms or any other clothing required to be worn by the educational institution;</li>\r\n 	<li dir=\"LTR\">electronic devices in relation to educational services;</li>\r\n 	<li dir=\"LTR\">food and beverages at the educational institution;</li>\r\n 	<li dir=\"LTR\">recreational field trips;</li>\r\n 	<li dir=\"LTR\">extracurricular activities provided for an additional fee; and</li>\r\n 	<li dir=\"LTR\">student organisation memberships.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">Additionally, the supply of residential accommodation for students or school pupils is exempt from VAT. This means that qualifying educational institutions will be unable to recover any input VAT paid on expenses that are related to the supply of residential accommodation.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Would qualifying educational institutions need to register for VAT in the UAE?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions are required to register for VAT in the UAE if the value of their annual taxable turnover meets the mandatory registration threshold of AED 375,000. In calculating the value of taxable turnover, the value of standard rated and zero-rated supplied made by the qualifying educational institutions must be taken into account.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions may also apply for an exception to register for VAT in the UAE if they make wholly zero-rated supplies. If the application is approved, the educational institution will be exempted from any VAT obligations such as filing VAT returns. However, in doing so, educational institutions will be unable to recover any input VAT incurred on their expenses. In determining whether to apply for the exception to register for VAT, educational institutions should carefully assess the potential VAT compliance costs against the amount of recoverable input VAT.</p>\r\n<img class=\"wp-image-8218  alignright\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/7.jpg\" alt=\"\" width=\"541\" height=\"341\" />\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"While the primary supply of most educational services is zero-rated in the UAE, the VAT treatment of some activities may not always be straightforward. Given that the VAT regime is still in its early stages of implementation, it is expected that the VAT legislation would continue to evolve. Educational institutions should continuously ensure that the correct VAT treatment is applied to all of its transactions.\"</h2>\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">The VAT issues</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What type of supplies are \"directly related\" to the provision of a zero-rated educational service?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">As noted above, a supply of goods or services made by educational institutions is treated as zero-rated where the supply is directly related to the provision of a zero-rated educational service. However, the UAE VAT Executive Regulations do not provide further guidance on what constitutes supplies which are \"directly related\" to the provision of a zero-rated educational service. This uncertainty will likely give rise to challenges in ascertaining the VAT treatment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">For example, a qualifying educational institution provides music courses. As part of the course requirements, students of the institution are required to perform in a musical concert held at the institution. Only the students’ family members and friends who received a special invitation are allowed to attend the musical concert. The concert tickets are sold at a reduced fee to cover some of the costs of running the musical concert. Can the supply of the musical performances be treated as a supply \"directly related\" to the provision of an educational service?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is arguable that the supply of the musical performance may be \"directly related\" to the provision of educational service considering that:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the principal supply of the qualifying educational institution is zero-rated educational service; and\\</li>\r\n 	<li dir=\"LTR\">the practical training arising from the supply of musical performances forms a necessary and essential part of the curriculum;</li>\r\n 	<li dir=\"LTR\">therefore, the supply of musical performances is ancillary to the principal supply; and</li>\r\n 	<li dir=\"LTR\">the musical concert is not in competition with any commercial enterprise and not generating additional profits.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">On the other hand, the supply of the musical performances may also be regarded as falling under the scope of the exception to the zero-rating rule, and therefore be subject to VAT at the standard rate. It can be contended that the musical performances are supplied to third parties, rather than the intended recipient of educational services, i.e., the students. Further, the supply of musical performances itself will generally be treated as standard rated if it was conducted in the course of business.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What is the VAT treatment of grants and sponsorships?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">It is common for the government or third parties to provide educational institutions with financial support such as grants or sponsorships. While the VAT legislation does not prescribe the VAT treatment of grants or sponsorships, the general principle is that if a monetary grant or sponsorship is freely given without receiving anything in return, the grant or sponsorship will not constitute consideration for any supply. Therefore, the grant or sponsorship would fall outside the scope of UAE VAT.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Conversely, if the grantor or sponsor receives a benefit or something in return from the educational institution for the monetary grant or sponsorship, the grant or sponsorship may be subject to VAT. The benefit provided by the educational institution will be rated as a taxable supply and the educational institution will have to account for VAT on the benefit. Currently, determining what constitutes a benefit is a grey area. As such, it is open to question as to whether an inclusion of the sponsor in a list of supporters in a notice or naming a university building after the sponsor may be considered as benefits.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Final remarks</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Generally, the primary supply of most educational services is zero-rated in the UAE to the extent the educational services are provided in accordance with an accredited curriculum by qualifying educational institutions. Notwithstanding this, the VAT treatment of some activities may not always be straightforward. Given that the VAT regime is still in its early stages of implementation, it is expected that the VAT legislation will continue to evolve. Educational institutions should continuously ensure that the correct VAT treatment is applied to all of its transactions, in compliance with the current VAT legislation.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/practice/tax/\">tax team</a> regularly advises on VAT and other tax matters. For further information, please contact <a href=\"https://www.tamimi.com/lawyer/shiraz-khan/\">Shiraz Khan</a> (<a href=\"mailto:s.khan@tamimi.com\">s.khan@tamimi.com</a>) or <a href=\"https://www.tamimi.com/lawyer/janet-gooi/\">Janet Gooi</a> (<a href=\"mailto:j.gooi@tamimi.com\">j.gooi@tamimi.com</a>).</em>|<p dir=\"LTR\" align=\"LEFT\">The <a href=\"https://www.tamimi.com/law-update-articles/getting-to-grips-with-vat-implementation/\">introduction of value added tax</a> (VAT) in the UAE and KSA raises complexities for education providers, even as both countries are now moving towards the eighth month since the implementation of VAT.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In this article, we will examine the UAE VAT treatment of supplies made in the education sector and the VAT issues which arise in the industry.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">The VAT story so far in the Education Sector in the UAE</h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8217 alignright\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/6.jpg\" alt=\"\" width=\"570\" height=\"397\" /></h3>\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What is the VAT treatment in the education sector?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">By way of background, VAT is imposed at the standard rate of 5% on the taxable supply of most goods and services (unless the supply is zero-rated (0%) or exempt) made in the UAE by a taxable person for consideration in the course of conducting business in the UAE.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The main difference between standard rated, zero rated and exempt supplies is that input tax incurred in connection with standard rated or zero rated supplies is as a general rule recoverable (subject to the normal rules of input tax recovery). Conversely, input VAT incurred in connection with exempt supplies is not generally recoverable.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the UAE, the supply of educational services and related goods and services for nurseries, preschool, school education, and higher educational institutions owned or funded by Federal or local Government is subject to VAT at the zero-rate.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">For a supply of educational services to qualify for zero-rating, the following conditions prescribed under the UAE VAT Executive Regulations should be fulfilled:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the supply of educational services must be provided in accordance with a curriculum recognised by the federal/local competent government entity;</li>\r\n 	<li dir=\"LTR\">the supplier of the educational services is an educational institution which is accredited by the federal/local competent government entity; and</li>\r\n 	<li dir=\"LTR\">where the supplier of educational services is a higher education institution, the institution is either (i) owned by the federal or local government; or (ii) receiving at least 50% of its annual funding directly from the federal or local government.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions may also avail of the zero-rating treatment in respect of the following:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a supply of goods or services that is directly related to the provision of a zero-rated educational service; and</li>\r\n 	<li dir=\"LTR\">printed and digital reading material which are related to the curriculum of an education.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Are there any exceptions to the zero-rating rule?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Not all supplies made by qualifying educational institutions benefit from this zero-rating rule. The following supplies are specifically excluded from this treatment and will therefore be subject to VAT at the standard rate:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">goods and services supplied to persons who are not enrolled in the educational institution;</li>\r\n 	<li dir=\"LTR\">any goods other than educational materials provided by the educational institution;</li>\r\n 	<li dir=\"LTR\">uniforms or any other clothing required to be worn by the educational institution;</li>\r\n 	<li dir=\"LTR\">electronic devices in relation to educational services;</li>\r\n 	<li dir=\"LTR\">food and beverages at the educational institution;</li>\r\n 	<li dir=\"LTR\">recreational field trips;</li>\r\n 	<li dir=\"LTR\">extracurricular activities provided for an additional fee; and</li>\r\n 	<li dir=\"LTR\">student organisation memberships.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">Additionally, the supply of residential accommodation for students or school pupils is exempt from VAT. This means that qualifying educational institutions will be unable to recover any input VAT paid on expenses that are related to the supply of residential accommodation.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Would qualifying educational institutions need to register for VAT in the UAE?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions are required to register for VAT in the UAE if the value of their annual taxable turnover meets the mandatory registration threshold of AED 375,000. In calculating the value of taxable turnover, the value of standard rated and zero-rated supplied made by the qualifying educational institutions must be taken into account.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Qualifying educational institutions may also apply for an exception to register for VAT in the UAE if they make wholly zero-rated supplies. If the application is approved, the educational institution will be exempted from any VAT obligations such as filing VAT returns. However, in doing so, educational institutions will be unable to recover any input VAT incurred on their expenses. In determining whether to apply for the exception to register for VAT, educational institutions should carefully assess the potential VAT compliance costs against the amount of recoverable input VAT.</p>\r\n\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"While the primary supply of most educational services is zero-rated in the UAE, the VAT treatment of some activities may not always be straightforward. Given that the VAT regime is still in its early stages of implementation, it is expected that the VAT legislation would continue to evolve. Educational institutions should continuously ensure that the correct VAT treatment is applied to all of its transactions.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">The VAT issues</h3>\r\n<img class=\"wp-image-8218  alignright\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/7.jpg\" alt=\"\" width=\"541\" height=\"341\" />\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What type of supplies are \"directly related\" to the provision of a zero-rated educational service?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">As noted above, a supply of goods or services made by educational institutions is treated as zero-rated where the supply is directly related to the provision of a zero-rated educational service. However, the UAE VAT Executive Regulations do not provide further guidance on what constitutes supplies which are \"directly related\" to the provision of a zero-rated educational service. This uncertainty will likely give rise to challenges in ascertaining the VAT treatment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">For example, a qualifying educational institution provides music courses. As part of the course requirements, students of the institution are required to perform in a musical concert held at the institution. Only the students’ family members and friends who received a special invitation are allowed to attend the musical concert. The concert tickets are sold at a reduced fee to cover some of the costs of running the musical concert. Can the supply of the musical performances be treated as a supply \"directly related\" to the provision of an educational service?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is arguable that the supply of the musical performance may be \"directly related\" to the provision of educational service considering that:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the principal supply of the qualifying educational institution is zero-rated educational service; and\\</li>\r\n 	<li dir=\"LTR\">the practical training arising from the supply of musical performances forms a necessary and essential part of the curriculum;</li>\r\n 	<li dir=\"LTR\">therefore, the supply of musical performances is ancillary to the principal supply; and</li>\r\n 	<li dir=\"LTR\">the musical concert is not in competition with any commercial enterprise and not generating additional profits.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">On the other hand, the supply of the musical performances may also be regarded as falling under the scope of the exception to the zero-rating rule, and therefore be subject to VAT at the standard rate. It can be contended that the musical performances are supplied to third parties, rather than the intended recipient of educational services, i.e., the students. Further, the supply of musical performances itself will generally be treated as standard rated if it was conducted in the course of business.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>What is the VAT treatment of grants and sponsorships?</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">It is common for the government or third parties to provide educational institutions with financial support such as grants or sponsorships. While the VAT legislation does not prescribe the VAT treatment of grants or sponsorships, the general principle is that if a monetary grant or sponsorship is freely given without receiving anything in return, the grant or sponsorship will not constitute consideration for any supply. Therefore, the grant or sponsorship would fall outside the scope of UAE VAT.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Conversely, if the grantor or sponsor receives a benefit or something in return from the educational institution for the monetary grant or sponsorship, the grant or sponsorship may be subject to VAT. The benefit provided by the educational institution will be rated as a taxable supply and the educational institution will have to account for VAT on the benefit. Currently, determining what constitutes a benefit is a grey area. As such, it is open to question as to whether an inclusion of the sponsor in a list of supporters in a notice or naming a university building after the sponsor may be considered as benefits.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Final remarks</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Generally, the primary supply of most educational services is zero-rated in the UAE to the extent the educational services are provided in accordance with an accredited curriculum by qualifying educational institutions. Notwithstanding this, the VAT treatment of some activities may not always be straightforward. Given that the VAT regime is still in its early stages of implementation, it is expected that the VAT legislation will continue to evolve. Educational institutions should continuously ensure that the correct VAT treatment is applied to all of its transactions, in compliance with the current VAT legislation.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/practice/tax/\">tax team</a> regularly advises on VAT and other tax matters. For further information, please contact <a href=\"https://www.tamimi.com/lawyer/shiraz-khan/\">Shiraz Khan</a> (<a href=\"mailto:s.khan@tamimi.com\">s.khan@tamimi.com</a>) or <a href=\"https://www.tamimi.com/lawyer/janet-gooi/\">Janet Gooi</a> (<a href=\"mailto:j.gooi@tamimi.com\">j.gooi@tamimi.com</a>).</em>'),
(297030, 28447, 'ClientIP', '83.111.236.141'),
(297031, 28447, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297032, 28447, 'CurrentUserID', '5'),
(297033, 28447, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297034, 28447, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297035, 28448, 'PostID', '8199'),
(297036, 28448, 'PostType', 'law_update_articles'),
(297037, 28448, 'PostTitle', 'VAT 2.0: The Story So Far'),
(297038, 28448, 'PostStatus', 'draft'),
(297039, 28448, 'PostDate', '2018-09-03 17:43:34'),
(297040, 28448, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8199'),
(297041, 28448, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8199&amp;action=edit'),
(297042, 28448, 'ClientIP', '83.111.236.141'),
(297043, 28448, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297044, 28448, 'CurrentUserID', '5'),
(297045, 28448, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297046, 28448, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297047, 28449, 'PostID', '8199'),
(297048, 28449, 'PostType', 'law_update_articles'),
(297049, 28449, 'PostTitle', 'VAT 2.0: The Story So Far'),
(297050, 28449, 'PostStatus', 'draft'),
(297051, 28449, 'PostDate', '2018-09-03 17:43:31'),
(297052, 28449, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8199'),
(297053, 28449, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8199&amp;action=edit'),
(297054, 28449, 'ClientIP', '83.111.236.141'),
(297055, 28449, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297056, 28449, 'CurrentUserID', '5'),
(297057, 28449, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297058, 28449, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297059, 28450, 'PostID', '8199'),
(297060, 28450, 'PostType', 'law_update_articles'),
(297061, 28450, 'PostTitle', 'VAT 2.0: The Story So Far'),
(297062, 28450, 'PostStatus', 'draft'),
(297063, 28450, 'PostDate', '2018-09-03 17:43:53'),
(297064, 28450, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8199'),
(297065, 28450, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8199&amp;action=edit'),
(297066, 28450, 'ClientIP', '83.111.236.141'),
(297067, 28450, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297068, 28450, 'CurrentUserID', '5'),
(297069, 28450, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297070, 28450, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297071, 28451, 'PostID', '8200'),
(297072, 28451, 'PostType', 'law_update_articles'),
(297073, 28451, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297074, 28451, 'PostStatus', 'draft'),
(297075, 28451, 'PostDate', '2018-09-03 17:38:56'),
(297076, 28451, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297077, 28451, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297078, 28451, 'ClientIP', '83.111.236.141'),
(297079, 28451, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297080, 28451, 'CurrentUserID', '5');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297081, 28451, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297082, 28451, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297083, 28452, 'PostID', '8200'),
(297084, 28452, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297085, 28452, 'PostStatus', 'draft'),
(297086, 28452, 'PostType', 'law_update_articles'),
(297087, 28452, 'PostDate', '2018-09-03 17:44:46'),
(297088, 28452, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297089, 28452, 'MetaID', '226854'),
(297090, 28452, 'MetaKey', 'content'),
(297091, 28452, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"380\" height=\"291\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297092, 28452, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"400\" height=\"306\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter size-full wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"708\" height=\"120\" /></p>'),
(297093, 28452, 'MetaLink', 'content'),
(297094, 28452, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297095, 28452, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"400\" height=\"306\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter size-full wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"708\" height=\"120\" /></p>|<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"380\" height=\"291\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297096, 28452, 'ClientIP', '83.111.236.141'),
(297097, 28452, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297098, 28452, 'CurrentUserID', '5'),
(297099, 28452, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297100, 28452, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297101, 28453, 'PostID', '8200'),
(297102, 28453, 'PostType', 'law_update_articles'),
(297103, 28453, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297104, 28453, 'PostStatus', 'draft'),
(297105, 28453, 'PostDate', '2018-09-03 17:44:48'),
(297106, 28453, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297107, 28453, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297108, 28453, 'ClientIP', '83.111.236.141'),
(297109, 28453, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297110, 28453, 'CurrentUserID', '5'),
(297111, 28453, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297112, 28453, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297113, 28454, 'PostID', '8200'),
(297114, 28454, 'PostType', 'law_update_articles'),
(297115, 28454, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297116, 28454, 'PostStatus', 'draft'),
(297117, 28454, 'PostDate', '2018-09-03 17:44:46'),
(297118, 28454, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297119, 28454, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297120, 28454, 'ClientIP', '83.111.236.141'),
(297121, 28454, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297122, 28454, 'CurrentUserID', '5'),
(297123, 28454, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297124, 28454, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297125, 28455, 'PostID', '8200'),
(297126, 28455, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297127, 28455, 'PostStatus', 'draft'),
(297128, 28455, 'PostType', 'law_update_articles'),
(297129, 28455, 'PostDate', '2018-09-03 17:45:13'),
(297130, 28455, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297131, 28455, 'MetaID', '226854'),
(297132, 28455, 'MetaKey', 'content');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297133, 28455, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"452\" height=\"346\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297134, 28455, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"380\" height=\"291\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297135, 28455, 'MetaLink', 'content'),
(297136, 28455, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297137, 28455, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"380\" height=\"291\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>|<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"452\" height=\"346\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297138, 28455, 'ClientIP', '83.111.236.141'),
(297139, 28455, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297140, 28455, 'CurrentUserID', '5'),
(297141, 28455, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297142, 28455, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297143, 28456, 'PostID', '8200'),
(297144, 28456, 'PostType', 'law_update_articles'),
(297145, 28456, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297146, 28456, 'PostStatus', 'draft'),
(297147, 28456, 'PostDate', '2018-09-03 17:45:16'),
(297148, 28456, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297149, 28456, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297150, 28456, 'ClientIP', '83.111.236.141'),
(297151, 28456, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297152, 28456, 'CurrentUserID', '5'),
(297153, 28456, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297154, 28456, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297155, 28457, 'PostID', '8200'),
(297156, 28457, 'PostType', 'law_update_articles'),
(297157, 28457, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297158, 28457, 'PostStatus', 'draft'),
(297159, 28457, 'PostDate', '2018-09-03 17:45:13'),
(297160, 28457, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297161, 28457, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297162, 28457, 'ClientIP', '83.111.236.141'),
(297163, 28457, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297164, 28457, 'CurrentUserID', '5'),
(297165, 28457, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297166, 28457, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297167, 28458, 'PostID', '8200'),
(297168, 28458, 'PostType', 'law_update_articles'),
(297169, 28458, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297170, 28458, 'PostStatus', 'draft'),
(297171, 28458, 'PostDate', '2018-09-03 17:45:54'),
(297172, 28458, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297173, 28458, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297174, 28458, 'ClientIP', '83.111.236.141'),
(297175, 28458, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297176, 28458, 'CurrentUserID', '5'),
(297177, 28458, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297178, 28458, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297179, 28459, 'PostID', '8195'),
(297180, 28459, 'PostType', 'law_update_articles'),
(297181, 28459, 'PostTitle', 'Faking It: The Fall-out from the Bogus Degree Epidemic'),
(297182, 28459, 'PostStatus', 'draft'),
(297183, 28459, 'PostDate', '2018-09-03 11:45:14'),
(297184, 28459, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8195'),
(297185, 28459, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8195&amp;action=edit'),
(297186, 28459, 'ClientIP', '83.111.236.141'),
(297187, 28459, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297188, 28459, 'CurrentUserID', '5'),
(297189, 28459, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297190, 28459, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297191, 28460, 'PostID', '8195'),
(297192, 28460, 'PostTitle', 'Faking It: The Fall-out from the Bogus Degree Epidemic'),
(297193, 28460, 'PostStatus', 'draft'),
(297194, 28460, 'PostType', 'law_update_articles'),
(297195, 28460, 'PostDate', '2018-09-03 17:46:50'),
(297196, 28460, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8195'),
(297197, 28460, 'MetaID', '226600'),
(297198, 28460, 'MetaKey', 'content');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297199, 28460, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright size-full wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"691\" height=\"316\" />\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).'),
(297200, 28460, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).'),
(297201, 28460, 'MetaLink', 'content'),
(297202, 28460, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8195&amp;action=edit');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297203, 28460, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).|<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright size-full wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"691\" height=\"316\" />\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).'),
(297204, 28460, 'ClientIP', '83.111.236.141'),
(297205, 28460, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297206, 28460, 'CurrentUserID', '5'),
(297207, 28460, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297208, 28460, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297209, 28461, 'PostID', '8195'),
(297210, 28461, 'PostType', 'law_update_articles'),
(297211, 28461, 'PostTitle', 'Faking It: The Fall-out from the Bogus Degree Epidemic'),
(297212, 28461, 'PostStatus', 'draft'),
(297213, 28461, 'PostDate', '2018-09-03 17:46:53'),
(297214, 28461, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8195'),
(297215, 28461, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8195&amp;action=edit'),
(297216, 28461, 'ClientIP', '83.111.236.141'),
(297217, 28461, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297218, 28461, 'CurrentUserID', '5'),
(297219, 28461, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297220, 28461, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297221, 28462, 'PostID', '8206'),
(297222, 28462, 'PostType', 'law_update_articles'),
(297223, 28462, 'PostTitle', 'Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
(297224, 28462, 'PostStatus', 'draft'),
(297225, 28462, 'PostDate', '2018-09-02 19:14:15'),
(297226, 28462, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8206'),
(297227, 28462, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8206&amp;action=edit'),
(297228, 28462, 'ClientIP', '83.111.236.141'),
(297229, 28462, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297230, 28462, 'CurrentUserID', '5'),
(297231, 28462, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297232, 28462, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297233, 28463, 'PostID', '8206'),
(297234, 28463, 'PostTitle', 'Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
(297235, 28463, 'PostStatus', 'draft'),
(297236, 28463, 'PostType', 'law_update_articles'),
(297237, 28463, 'PostDate', '2018-09-03 17:48:22'),
(297238, 28463, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8206'),
(297239, 28463, 'MetaID', '227216'),
(297240, 28463, 'MetaKey', 'content'),
(297241, 28463, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright  wp-image-8222\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a separate Law Update article) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n\r\n<em>Al Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"https://www.tamimi.com/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"https://www.tamimi.com/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297242, 28463, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a separate Law Update article) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n&nbsp;\r\n<em>Al Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"https://www.tamimi.com/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"https://www.tamimi.com/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
(297243, 28463, 'MetaLink', 'content'),
(297244, 28463, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8206&amp;action=edit'),
(297245, 28463, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a separate Law Update article) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n&nbsp;\r\n<em>Al Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"https://www.tamimi.com/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"https://www.tamimi.com/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>|<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright  wp-image-8222\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a separate Law Update article) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n\r\n<em>Al Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"https://www.tamimi.com/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"https://www.tamimi.com/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
(297246, 28463, 'ClientIP', '83.111.236.141'),
(297247, 28463, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297248, 28463, 'CurrentUserID', '5'),
(297249, 28463, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297250, 28463, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297251, 28464, 'PostID', '8206'),
(297252, 28464, 'PostType', 'law_update_articles'),
(297253, 28464, 'PostTitle', 'Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
(297254, 28464, 'PostStatus', 'draft'),
(297255, 28464, 'PostDate', '2018-09-03 17:48:25'),
(297256, 28464, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8206'),
(297257, 28464, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8206&amp;action=edit'),
(297258, 28464, 'ClientIP', '83.111.236.141'),
(297259, 28464, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297260, 28464, 'CurrentUserID', '5'),
(297261, 28464, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297262, 28464, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297263, 28465, 'PostID', '8195'),
(297264, 28465, 'PostType', 'law_update_articles'),
(297265, 28465, 'PostTitle', 'Faking It: The Fall-out from the Bogus Degree Epidemic'),
(297266, 28465, 'PostStatus', 'draft'),
(297267, 28465, 'PostDate', '2018-09-03 17:46:50'),
(297268, 28465, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8195'),
(297269, 28465, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8195&amp;action=edit'),
(297270, 28465, 'ClientIP', '83.111.236.141'),
(297271, 28465, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297272, 28465, 'CurrentUserID', '5'),
(297273, 28465, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297274, 28465, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297275, 28466, 'PostID', '8195'),
(297276, 28466, 'PostTitle', 'Faking It: The Fall-out from the Bogus Degree Epidemic'),
(297277, 28466, 'PostStatus', 'draft'),
(297278, 28466, 'PostType', 'law_update_articles'),
(297279, 28466, 'PostDate', '2018-09-03 17:48:39'),
(297280, 28466, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8195'),
(297281, 28466, 'MetaID', '226600'),
(297282, 28466, 'MetaKey', 'content');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297283, 28466, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright  wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"584\" height=\"267\" />\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).'),
(297284, 28466, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright size-full wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"691\" height=\"316\" />\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).'),
(297285, 28466, 'MetaLink', 'content'),
(297286, 28466, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8195&amp;action=edit');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297287, 28466, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright size-full wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"691\" height=\"316\" />\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).|<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright  wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"584\" height=\"267\" />\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).'),
(297288, 28466, 'ClientIP', '83.111.236.141'),
(297289, 28466, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297290, 28466, 'CurrentUserID', '5'),
(297291, 28466, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297292, 28466, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297293, 28467, 'PostID', '8195'),
(297294, 28467, 'PostType', 'law_update_articles'),
(297295, 28467, 'PostTitle', 'Faking It: The Fall-out from the Bogus Degree Epidemic'),
(297296, 28467, 'PostStatus', 'draft'),
(297297, 28467, 'PostDate', '2018-09-03 17:48:42'),
(297298, 28467, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8195'),
(297299, 28467, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8195&amp;action=edit'),
(297300, 28467, 'ClientIP', '83.111.236.141'),
(297301, 28467, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297302, 28467, 'CurrentUserID', '5'),
(297303, 28467, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297304, 28467, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297305, 28468, 'PostID', '8200'),
(297306, 28468, 'PostType', 'law_update_articles'),
(297307, 28468, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297308, 28468, 'PostStatus', 'draft'),
(297309, 28468, 'PostDate', '2018-09-03 17:45:52'),
(297310, 28468, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297311, 28468, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297312, 28468, 'ClientIP', '83.111.236.141'),
(297313, 28468, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297314, 28468, 'CurrentUserID', '5'),
(297315, 28468, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297316, 28468, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297317, 28469, 'PostID', '8200'),
(297318, 28469, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297319, 28469, 'PostStatus', 'draft'),
(297320, 28469, 'PostType', 'law_update_articles'),
(297321, 28469, 'PostDate', '2018-09-03 17:48:52'),
(297322, 28469, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297323, 28469, 'MetaID', '226854'),
(297324, 28469, 'MetaKey', 'content'),
(297325, 28469, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"482\" height=\"369\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297326, 28469, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"452\" height=\"346\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297327, 28469, 'MetaLink', 'content'),
(297328, 28469, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297329, 28469, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"452\" height=\"346\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>|<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"482\" height=\"369\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297330, 28469, 'ClientIP', '83.111.236.141'),
(297331, 28469, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297332, 28469, 'CurrentUserID', '5'),
(297333, 28469, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297334, 28469, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297335, 28470, 'PostID', '8200'),
(297336, 28470, 'PostType', 'law_update_articles'),
(297337, 28470, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297338, 28470, 'PostStatus', 'draft'),
(297339, 28470, 'PostDate', '2018-09-03 17:48:55'),
(297340, 28470, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297341, 28470, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297342, 28470, 'ClientIP', '83.111.236.141'),
(297343, 28470, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297344, 28470, 'CurrentUserID', '5'),
(297345, 28470, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297346, 28470, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297347, 28471, 'PostID', '8195'),
(297348, 28471, 'PostType', 'law_update_articles'),
(297349, 28471, 'PostTitle', 'Faking It: The Fall-out from the Bogus Degree Epidemic'),
(297350, 28471, 'PostStatus', 'draft'),
(297351, 28471, 'PostDate', '2018-09-03 17:48:39'),
(297352, 28471, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8195'),
(297353, 28471, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8195&amp;action=edit'),
(297354, 28471, 'ClientIP', '83.111.236.141'),
(297355, 28471, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297356, 28471, 'CurrentUserID', '5'),
(297357, 28471, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297358, 28471, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297359, 28472, 'PostID', '8195'),
(297360, 28472, 'PostTitle', 'Faking It: The Fall-out from the Bogus Degree Epidemic'),
(297361, 28472, 'PostStatus', 'draft'),
(297362, 28472, 'PostType', 'law_update_articles'),
(297363, 28472, 'PostDate', '2018-09-03 17:49:20'),
(297364, 28472, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8195'),
(297365, 28472, 'MetaID', '226600'),
(297366, 28472, 'MetaKey', 'content'),
(297367, 28472, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright  wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"584\" height=\"267\" />\r\n&nbsp;<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).'),
(297368, 28472, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright  wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"584\" height=\"267\" />\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).'),
(297369, 28472, 'MetaLink', 'content'),
(297370, 28472, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8195&amp;action=edit');
INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`) VALUES
(297371, 28472, 'ReportText', '<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright  wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"584\" height=\"267\" />\r\n<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).|<p dir=\"LTR\" align=\"LEFT\">The recent headlines about fake degrees have caused shockwaves in the region. In this article we look at the phenomenon from a regional perspective, the legal issues and the ramifications.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Diploma Mill</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The phenomenon of fake diplomas production dates back to Middle Ages in France and Italy. The concept is known as \"diploma mill\" or a \"degree mill\" and refers to a non-accredited company that declares itself as a higher educational institution and awards worthless degrees for a certain fee. In some cases, diploma mills may claim to give credits for \"relevant life experience\", whereas in other cases the victims of the scam may have to pass online exams and write term papers thereby creating an impression of real education. To strengthen their position, diploma mills closely cooperate with accreditation mills, set up for the purpose of providing an appearance of authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In some cases the student knows he is buying a fake degree and in others the student is an unwitting victim of a scam.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Catch me if you can</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In 2015 the <em>New York Times</em> published a report exposing a global scam developed by company in Pakistan which had sold thousands of diplomas of non-existing universities through a complex web of 370 websites including school sites, fake accreditation bodies, recruitment agencies, language schools and even a law firm. Apparently the firm was generating millions of dollars every month.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Among the more alarming revelations was that the company sold aeronautical degrees to airline employees, medical degrees to hospital workers, engineering degrees to site workers and law degrees to dropped out students.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">According to the report, more than 3,000 people in the Middle East hold degrees from bogus universities from this company.</p>\r\n<img class=\"alignright  wp-image-8216\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/5.jpg\" alt=\"\" width=\"584\" height=\"267\" />\r\n&nbsp;<h3 dir=\"LTR\" align=\"LEFT\">KSA</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In Saudi Arabia the sectors that appear to be most affected by fake degrees are healthcare and construction. According to the Saudi Commission for Health Specialties 3,755 forgery cases involving health practitioners were revealed, with 57 physicians being arrested and prosecuted. The Saudi Council of Engineers detected 2,294 fake engineering certificates held by individuals applying to work in the Kingdom.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Qatar</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">When the scandal broke out, the government reacted immediately by introducing new regulations, according to which graduates of foreign universities were required to obtain a letter from their institutions confirming specific details about their courses before receiving approval for a residence permit. Moreover, the companies were prohibited to hire people who have studied for all or part of their degrees online.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Kuwait</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The forged degrees scandal came only a few weeks after the government issued a new regulation requiring all engineers in Kuwait to be registered and certified by the Kuwait Engineering Society. Kuwaiti authorities decided to tackle the problem from several angles:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">Kuwaiti Ministry of Foreign Affairs offices abroad have been warned not to approve any university degrees without coordinating first with the Kuwaiti National Accreditation Bureau;</li>\r\n 	<li dir=\"LTR\">the Health Minister has ordered the formation of a special committee to examine and validate university postgraduate degrees of Ministry of Health employees including both Kuwaiti and expat doctors, nurses, pharmacists, technicians and administrative staff members;</li>\r\n 	<li dir=\"LTR\">the Ministry of Higher Education has started collaboration with the Ministry of Interior to scrutinize suspect certificates;</li>\r\n 	<li dir=\"LTR\">parliamentarians have submitted draft legislation on how to combat this crime in a more effective way as well as proposals for legal action to be undertaken against wrongdoers (such as corrective measures against promotions or wage raises); and</li>\r\n 	<li dir=\"LTR\">criminal cases are moving towards trial against accused violator and some have already been convicted. Moreover, five people suspected of holding fake university degrees have been jailed pending investigation and trial and 45 others are under investigation.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">UAE</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The government introduced a preventive measure for potential victims of this fraud by publishing a list of genuine universities which provide online education, whose degrees are recognised and will be accredited in the UAE. The list can be found on Ministry of Education website, so every resident who wants to enroll for distance learning course can check his preferred university for authenticity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It has been reported that expats found to be using fake degrees will face a life ban from working in the UAE.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Worldwide</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of fake degrees is a global phenomenon. In the last few weeks a US Republican party candidate has admitted to posing with a fake diploma. In United Kingdom, the police had to re-examine 700 cases that a falsely credentialed police criminologist had worked on. In Australia police had to investigate a sophisticated Chinese forgery business charging thousands of dollars for fake degrees and diplomas from nearly 100 of Australia’s leading institutions.</p>\r\n&nbsp;\r\n<h2>\"Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Criminal law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The concept of issuing and using a fake degree constitutes a crime in every GCC jurisdiction. The type of crime and punishment, however, differs from country to country. In most cases the authorities rely on regulations related to fraud, forgery and misrepresentation when dealing with fake degrees.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">By way of example the punishment in KSA for forgery and misrepresentation in different cases will vary from fines in the range of SAR 300,000-700,000 and imprisonment for the period from one to seven years, followed by (in respect of non-nationals) deportation and a life ban from entering KSA. Whereas in the UAE the convicted shall be sentenced to up to ten years of imprisonment.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In respect of government employees the sanctions are generally more severe.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The novelty of this phenomenon, the diversity of its variations and wide range of consequences means that the authorities are now looking at putting in place specific laws (or sections of laws) that deal with fake degrees (as opposed to fraud/forgery/misrepresentation generally).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The general principle in criminal law is that the accused must have had intent to commit a crime. Therefore those unwitting students who were victims of a scam may not face criminal sanction; obviously the court would consider whether a person in the accused’s position, using reasonable judgement, would have considered the university to be genuine.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Employment law considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Background checks</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a risk management point of view an employer should carry out background checks prior to commencement of employment in order to establish the candidate’s academic credentials. This is not as easy as it might sound; in many cases employers outsource this task to a specialist company. Some employers would do this as part of a wider background check in relation to criminal records etc. It goes without saying that where the employer is an educational institution itself then this is an area of huge potential risk and deserves the commensurate focus.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">It is also possible to check the authenticity of credentials by contacting the Commission for Academic Accreditation and/or Ministry of Education.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">As regards existing employees, the employer may consider background checking employees in sensitive positions to ensure they hold the necessary accreditation.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The <em>New York Times</em> has published a list of bogus universities and it is not difficult to search for ‘graduates’ of such universities via social media, so an employer could quickly establish if any of its existing employees fall into this category.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Vicarious liability</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Employers are in a high risk group when it comes to damages indirectly caused by fake degrees. The concept of vicarious liability is one that can make an employer liable for the actions of an employee carried out in the course of their employment.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Termination</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Offers of employment are generally conditional upon verification of academic references, failing which the offer is withdrawn. Where the employee is already in the job for some time and it becomes apparent that his degree is fake then the employer could terminate him for gross misconduct. In all the GCC countries there is a provision in the labour law to this effect. That termination would be without notice and without end of service gratuity.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The employee would be entitled to due process; i.e. he would be entitled to state his defence to the allegation. He may be able to prove that he was an innocent victim in which case the employer would have to decide the appropriate action to take. In some cases it will be irrelevant whether the employee was an unwitting victim or not; i.e. his position absolutely requires him to hold a degree/diploma- e.g. doctor, nurse, engineer etc. In other cases the degree may have been preferable but not mandatory - e.g. sales manager - in which case the employer may decide to retain him as he has performed the job well over the years.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In all gross misconduct terminations legal advice should be sought as there may be other factors to consider (was the degree the primary documentation relied on by the employer? Did the employer become informally aware of the fake degree previously? etc).</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Children of Tomorrow</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Children of Tomorrow is a project launched by Al Tamimi and aimed at raising awareness of child rights at every school in the UAE- public and private.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">We have prepared a video - in both Arabic and English - for distribution to all schools and which provides practical advice in relation to the topic of child safety including:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">the legal consequences if a child is harmed or if a minor commits a crime;</li>\r\n 	<li dir=\"LTR\">what should teachers/staff do if they find signs of abuse, a state of emergency or medical condition;</li>\r\n 	<li dir=\"LTR\">reporting generally;</li>\r\n 	<li dir=\"LTR\">handling situations where a child accesses inappropriate materials shared on WhatsApp/internet etc.</li>\r\n</ul>\r\n<p dir=\"LTR\" align=\"LEFT\">The video will be launched in October and will be followed up with a number of seminars where teachers/schools/stakeholders can ask questions in person.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">If you would like to find out more about this initiative please email us at <a href=\"mailto:a.ponomarova@tamimi.com\">a.ponomarova@tamimi.com</a>.</p>\r\nWith thanks to the authorities and schools who have given us tremendous support with this initiative.\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The fake degree story has just begun and it has a long way to go before its full effects are felt. Employers and regulators are on red alert and need to remain vigilant. Background checking of employees in sensitive positions who are required to hold academic qualifications is an absolute must and failure to do so could lead to the employer being vicariously liable for damage done by that employee as well as obvious reputational harm to the company.</p>\r\n&nbsp;\r\n\r\nAl Tamimi &amp; Company’s <a href=\"https://www.tamimi.com/sectors/education/\">Education team</a> supports education providers on all legal aspects of their operations. For further information please contact <a href=\"https://www.tamimi.com/lawyer/ivor-mcgettigan/\">Ivor McGettigan</a> (<a href=\"mailto:i.mcgettigan@tamimi.com\">i.mcgettigan@tamimi.com</a>).'),
(297372, 28472, 'ClientIP', '83.111.236.141'),
(297373, 28472, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297374, 28472, 'CurrentUserID', '5'),
(297375, 28472, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297376, 28472, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297377, 28473, 'PostID', '8195'),
(297378, 28473, 'PostType', 'law_update_articles'),
(297379, 28473, 'PostTitle', 'Faking It: The Fall-out from the Bogus Degree Epidemic'),
(297380, 28473, 'PostStatus', 'draft'),
(297381, 28473, 'PostDate', '2018-09-03 17:49:22'),
(297382, 28473, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8195'),
(297383, 28473, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8195&amp;action=edit'),
(297384, 28473, 'ClientIP', '83.111.236.141'),
(297385, 28473, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297386, 28473, 'CurrentUserID', '5'),
(297387, 28473, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297388, 28473, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297389, 28474, 'PostID', '8200'),
(297390, 28474, 'PostType', 'law_update_articles'),
(297391, 28474, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297392, 28474, 'PostStatus', 'draft'),
(297393, 28474, 'PostDate', '2018-09-03 17:48:52'),
(297394, 28474, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297395, 28474, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit'),
(297396, 28474, 'ClientIP', '83.111.236.141'),
(297397, 28474, 'UserAgent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
(297398, 28474, 'CurrentUserID', '5'),
(297399, 28474, 'CurrentUserRoles', 'a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
(297400, 28474, 'SessionID', '8b8b3321d51da0c654a7638946bb5a2e7a1cb1666d33dde164fdf06e71d99b5f'),
(297401, 28475, 'PostID', '8200'),
(297402, 28475, 'PostTitle', 'How Does GDPR Affect the Education Sector in the Middle East?'),
(297403, 28475, 'PostStatus', 'draft'),
(297404, 28475, 'PostType', 'law_update_articles'),
(297405, 28475, 'PostDate', '2018-09-03 17:49:48'),
(297406, 28475, 'PostUrl', 'https://www.tamimi.com/?post_type=law_update_articles&p=8200'),
(297407, 28475, 'MetaID', '226854'),
(297408, 28475, 'MetaKey', 'content'),
(297409, 28475, 'MetaValueNew', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8219 alignright\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"482\" height=\"369\" /> It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297410, 28475, 'MetaValueOld', '<p dir=\"LTR\" align=\"LEFT\">The General Data Protection Regulations (\"GDPR\") came into effect on 25 May 2018. The <a href=\"https://www.tamimi.com/law-update-articles/gdpr-a-plain-english-guide-to-the-implications-for-middle-east-marketing-activities/\">GDPR</a>, which replaced the EU’s Data Protection Directive of 1995, represents a significant expansion of personal privacy rights for EU residents.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The politically challenging task of escalating privacy protection from a directive to a binding regulation began in 2009 and involved protracted negotiations among the European Commission (the EU executive body) and its two legislative chambers, the Council of the European Union and the European Parliament. This was partially motivated by the desire for uniform protections for all EU residents and partially necessitated by the needs of regulated entities for consistent compliance requirements across the EU.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why should Middle East institutions pay attention to GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"alignleft  wp-image-8219\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/8.jpg\" alt=\"\" width=\"482\" height=\"369\" />It is widely known that the GDPR has more enforceable legal status in comparison to the previous Data Protection Directive, and it is also substantively more robust in a number of significant ways. The most notable of these for entities located in the Middle East is that, unlike the Data Protection Directive (which mandated compliance by entities with a physical EU presence, such as a processing center or even a server), the GDPR’s coverage extends to entities with no physical EU footprint if they process personal data of EU data subjects residing in the EU. This limited extraterritoriality, while a significant expansion of the reach of EU law to entities outside the EU, does not attach to EU citizens abroad. As such, a Middle East entity involved in a data transaction with an EU resident in the Middle East, for instance, would not be subject to the GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why education providers should pay attention to the GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Middle East-based Education institutions newly affected by the extraterritorial reach of GDPR are those that target distance education programmes to EU residents who are physically located in one of the member states. Such programmes were not initially subject to EU privacy law under the Data Protection Directive if they did not have infrastructure within the EU, but are now covered under the GDPR, even if they have no physical presence within the EU. However, Article 3 of the GDPR suggests that incidental transactions, such as the mere availability of goods or services via a website, are not automatic grounds for subjecting non-EU entities to the GDPR.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">On the face of it, it is tempting to believe that Education institutions that enrol EU residents in the Middle East are entirely exempt from compliance with the GDPR. This would certainly be true for EU residents who initiate their admission application process from outside the EU. In the case where EU applicants start the admissions process from their home countries and obtain visas to enter the Middle East after gaining admission to eligible programmes, the GDPR will apply and such institutions would need to demonstrate compliance. In essence, active student recruitment campaigns targeting EU residents could subject the data collected from such students, whether via automated or non-automated means, to compliance requirements under the GDPR. It may take a few years for a more precise understanding of how the GDPR will be further defined, interpreted, and enforced by the EU and national data protection authorities of its member states. At such early stage, it is probably unlikely that the most expansive interpretation of the regulation’s extraterritorial application would be immediately enforced against non-EU entities. It is clear however that institutions with significant engagement with the EU, either in the form of physical presence or of distance-delivered services, should take immediate steps to ensure compliance with the GDPR.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Whose data does GDPR protect?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Personal data of all living individuals physically within the EU (\"EU data subjects\") are covered by the GDPR. The regulation makes no distinctions based on individual’s permanent places of residence or nationality. The GDPR applies to all such individual’s personal data, defined as any information that can be used to, directly or indirectly, identify a person. These include not only such obvious information as educational, financial, employment-related, and health data, but also photographs, personal phone numbers, and IP addresses.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">How should the education sector prepare for GDPR?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East should consider a number of action points as part of their GDPR compliance preparations as follows:</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Review</strong>: A comprehensive review should be undertaken to determine (i) what personal data is currently held, (ii) how that data was acquired, and (iii) for what purpose it was acquired. Education providers should consider whether they have obtained and hold such personal data in accordance with the requirements of GDPR. If they have not, such data should be deleted, or consideration should be given as to how its continued storage / use may be rendered GDPR-compliant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Privacy policies</strong>: privacy policies are a key element of the new regime. Education providers should review their existing privacy policies, and make all amendments necessary to bring them into line with the GDPR’s requirements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Consent</strong>: this is unlikely to be the most appropriate lawful basis for the processing of personal data by Education providers going forward. The GDPR requires that consent must be able to be withdrawn as easily as it is given and processing must immediately stop. Clearly, this is not practical given Education providers’ obligations to protect the safety and welfare of their students. Education establishments will need to look to other bases provided in the GDPR to ensure that their processing activities are lawful. This is a more complex legal question, and will be based on a case-by-case basis, the operation of the education provider in relation to the data.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Consent must be given for the processing or flow of personal data to third-parties, so in order to become GDPR compliant, education providers must be aware of where various pieces of data are going and why.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><strong>Data Security and Third-Party Agreements</strong>: a comprehensive, written information security programme should be developed and implemented to protect the security, confidentiality and integrity of personal data held. A review of arrangements with all third-parties engaged to handle, store or otherwise process personal data collected and/or stored by the institution should be undertaken. The GDPR requires all data controllers to have binding contracts with the parties that process data on their behalf. For education providers, it is important that all current service level agreements and other contracts with third-party suppliers are carefully reviewed and amended to ensure they are GDPR-compliant.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Supervisory authorities and penalties</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Under the GDPR, EU member states have to designate qualified supervisory authorities with specified oversight, investigatory, and enforcement powers to implement its requirements . These authorities will oversee compliance, provide consultation and prior approvals, and receive and administratively adjudicate complaints against controllers and processors. They can also impose fines of up to two percent of the global revenues for certain penalties, and up to four percent of such revenues for more serious ones.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Just as important as the supervisory authorities’ power to impose penalties is the consultative role they are assigned in reviewing mandatory data protection impact assessments that data controllers and processors must regularly perform in connection with high-risk processing activities prior to implementing them.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The GDPR took years to be adopted, and it may be safe to assume that it will take years before its real impact and practical compliance requirements become fully settled.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Education providers in the Middle East with EU-based operations and those with significant numbers of EU residents as students — particularly those delivering distance education programmes to such students within the EU — should start to map out a strategy of implementing GDPR-compliant practices now.</p>\r\n<p dir=\"LTR\" align=\"LEFT\"><img class=\"aligncenter  wp-image-8220\" src=\"https://www.tamimi.com/wp-content/uploads/2018/09/9.jpg\" alt=\"\" width=\"944\" height=\"160\" /></p>'),
(297411, 28475, 'MetaLink', 'content'),
(297412, 28475, 'EditorLinkPost', 'https://www.tamimi.com/wp-admin/post.php?post=8200&amp;action=edit');
