DIFC Courts Spread Their Wings

In the DIFC Court I wrote about the 45 hectare free zone in Dubai known as the Dubai International Financial Centre ("DIFC") and the special English speaking common law jurisdiction within the Centre aptly described by its present Chief Justice Michael Hwang SC as a "common law island in a civil law ocean" (address to Lawasia Conference, Kuala Lumpur 1 Nov 2011) which has contributed greatly to the DIFC's success.

When I wrote that article in January 2011 the court's jurisdiction was limited by art 5 of Law No 12 of 2004 to disputes relating to the DIFC. The practical effect of this limit was shown by Sir Anthony Colman's decision in Corinth Pipeworks S.A. v Barclay's Bank PLC of 8 Feb 2011 which I discussed in my case note of 20 March 2011. In that case the court refused to entertain an action arising out of an allegedly false statement by an employee of the defendant bank made within Dubai but outside the Centre on the ground that it had no connection with the DIFC.

By a decree dated 31 Oct 2011 HH Sheikh Mohammed bin Rashid Al Maktoum, the ruler of Dubai who is also Vice-President and Prime Minister of the United Arab Emirates, has extended the DIFC courts' jurisdiction to cover any business dispute from any part of the world (see the DIFC courts' press release of 31 Oct 2011).

The significance of this announcement is that it should shortly be possible to resolve a much wider range of cases, including intellectual property licensing and maybe even some infringement disputes, before an English speaking common law tribunal applying rules of procedure modelled on the Civil Procedure Rules. Since the UAE is party to a number of international and regional agreements on the enforcement of judgments it may be possible to refer cases from other parts of the Middle East or North Africa. Clearly the parties have to consent to the jurisdiction of the DIFC courts unless they come within its jurisdiction on some other ground. No doubt that can be done by a choice of jurisdiction clause specifying the DIFC courts in a licence or other agreement.

Should anybody wish to discuss this article or the topic in general he or she should not hesitate to contact me on +44 161 850 0080 or complete my on-line contact form.

Background Reading

Jane Lambert "The Legal Order of the United Arab Emirates" 11 Nov 2011

Sir Anthony Evans "Dispute Resolution in the DIFC" 16 Feb 2009 (DIFC website)

Sir Anthony Evans "Dispute Resolution in the DIFC" Oct 2008 (DIFC website)

Michael Hwang SC "The Courts of the DIFC - A Common Law Island in a Civil Law Ocean" (DIFC website)

Jane Lambert "DIFC Courts" 7 Jan 2011 (JD Supra website)

The Legal Order of the United Arab Emirates

I have written several articles on Dubai ("Why Dubai or the Rest of the Gulf for that Matter", 14 Jan 2011), the Dubai International Financial Centre ("DIFC"), "The DIFC Courts", 7 Jan 2011, their jurisdiction (Corinth Pipeworks SA v Barclays Bank Plc 20 March 2011) and rules of court (12 May 2011), the DIFC laws of confidence (27 Jan 2011), passing off (7 April 2011) and data protection (1 Aug 2011) and the new dispute resolution policy for .ae domain names (22 Jan 2011). Dubai is, of course, a member of the United Arab Emirates ("UAE") and it is high time for me to discuss the legal context in which the DIFC is set.

The UAE

The UAE is a federation of the following hereditary monarchies or emirates:

• Abu Dhabi
• Ajman
• Dubai
• Fujairah
• Ras al-Khaimah
• Sharjah, and
• Umm al-Quwain.

These emirates have a combined population of 8.26 million in a land area of 83,600 square kilometres. Their federal capital is Abu Dhabi.

UAE's Constitution

The UAE's constitution was adopted by the rulers of the emirates on 2 Dec 1971. Art 1 describes the Union as "an independent, sovereign, federal state" which "any other independent Arab country may join". Art 6 declares that:

"The Union is a part of the Great Arab Nation to which it is bound by the ties of religion, language, history and common destiny .

The people of the Union are one people, and one part of the Arab Nation."

Art 3 declares that

"The member Emirates shall exercise sovereignty over their own territories and territorial waters in all matters, which are not within the jurisdiction of the Union as assigned in this Constitution."

However, art 2 provides that the Union is to exercise sovereignty in matters assigned to it by the constitution throughout the territories of the emirates. Art 4 precludes the cession of that sovereignty.

Aims of the UAE

The aims of the Union as set out in art 10 are as follows:

• the maintenance of the UAE's independence and sovereignty
• safeguarding its security and stability
• the defence against any aggression upon its existence or the existence of its member states
• the protection of the rights and liabilities of the people of the Union
• the achievement of close co–operation between the emirates for their common benefit in realising these aims and in promoting their prosperity and progress in all fields
• the provision of a better life for all citizens together with respect by each emirate for the independence and sovereignty of the other emirates in their internal affairs within the framework of the constitution.

Economic Union

Art 11 establishes an "economic and customs union" between the emirates with free movement of capital and goods. Free movement of labour is implicit in art 8 which provides that the citizens of the Union shall have a single nationality.

Institutions

Art 45 establishes the following federal institutions:

1. Supreme Council,
2. President and his Deputy,
3. Council of Ministers,
4. Federal National Council, and
5. the Union Judiciary.

Supreme Council

The Supreme Council consists of the rules of the emirates or their deputies and is the highest authority of the Union (art 46). It exercises executive and legislative powers.

President

One of its most important functions of the rulers assembled in the Supreme Council is to choose the President and Vice-President from among their number pursuant to art 51. The President and Vice-President hold office for 5 years and exercise wide executive powers under art 54. However, a convention appears to be developing that the ruler of Abu Dhabi is ipso facto the President of the UAE. The incumbent is Khalifa bin Zayed Al Nahyan who inherited that office from his father, the first President of the Union.

Council of Ministers

Art 55 of the constitution establishes a Council of Ministers consisting of a prime minister, a deputy prime minister and a number of ministers chosen from citizens of the UAE known for their competence and experience. The Council has responsibility for such matters as defence, foreign affairs, internal affairs, justice, posts and telecommunications, education and public health.

Federal National Council

Art 68 provides for a Federal National Council consisting of 40 members representing the emirates in rough proportion to their population. The Council constitutes the popular element of government though not necessarily a democratic one since art 69 allows each emirate to choose the method of selection of its representatives.

Union Judiciary

Art 95 establishes a Union Supreme Court and Union Primary Tribunals.

Legal System

In addition to the Union Judiciary, each emirate has its own courts. Except for the DIFC (which is a common law enclave) the legal system is based on civil or Roman law though Islamic law remains for family and inheritance matters.

Further Information

Anyone wishing to discuss this article should call me on 0800 862 0055 or get in touch by twitter, Linkedin, Facebook, or my contact form.

Qatar Financial Centre Data Protection Regulations

On 1 Aug 2011 I referred to an article by James Mitchell of "Privacy Laws and Business" which claimed that the DIFC Data Protection Law made in 2007 was the first data protection law in any Arab country (see "DIFC Data Protection Law", 1 Aug 2011). It seems that Mr. Mitchell and I may have been wrong because the Qatar Financial Centre Data Protection Regulations were made by Mohamed bin Ahmed bin Jassim Al Thani, Minister of Economy and Commerce of the State of Qatar, as long ago as 17 Oct 2005.

Overview

Like the DIFC Data Protection Law, the QFC Regulations seem to have been influenced by the EU Data Protection Directive (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data OJ L 281 , 23/11/1995 P 31 - 50) and the British Data Protection Act 1998. Doubtless that is because art 25 (1) of the Directive requires EU member states to

"provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection."

Accordingly, the QFC regulations provide for notification, conditions for legitimate processing, rights of access for data subjects and a range of remedies. The regulations are admirably brief cramming these provisions into 17 pages. They are supplemented by the Data Protection Rules which take up another 12 pages.

Application

These regulations came into force on the 17 Oct 2005 and apply to the Qatar Financial Centre. Art 2 of the Regulations provide that to the fullest extent permitted by the QFC law Qatari the laws concerning the subject matter of the legislation that apply to the rest of Qatar shall not apply to the Centre.

The QFC Authority

The Regulations are administered by the QFC Authority, the body whose powers and constitution were considered in my article on the Qatar Financial Centre of 1 April 2011. Art 19 (2) confers upon the Authority powers to:

(a) access personal data processed by data controllers or data processors;

(b) collect all the information necessary for the performance of its supervisory duties;

(c) prescribe forms to be used for any of the purposes of the Regulations;

(d) issue warnings or admonishments and make recommendations to data controllers; and

(e) bring contraventions of the regulations to the attention of ant tribunal.

The Authority keeps a register of personal data processing pursuant to art 18 of the Regulations. It has power to make rules to implement the Regulations under art 21.

Duty to Keep Records

Data controllers are required by art 17 (1) to establish and maintain a record of all wholly or partly automatic personal data processing operations or set of such operations intended to secure a single purpose or several related purposes. Rule 4.1 of the Rules specify that such records must include:

(a) a description of the personal data processing being carried out;

(b) an explanation of the purpose for the personal data processing;

(c) the data subjects or class of data subjects whose personal data is being processed;

(D) a description of the class of personal data being processed; and

(E) a list of the jurisdictions to which personal data may be transferred by the data controller, along with an indication as to whether the particular jurisdiction has been assessed as having adequate levels of protection for the purposes of the transfer prohibition provisions to be discussed below.

Duty to Notify

Rule 4.2 of the Rules require data holders to "notify the QFC Authority of any of the following Personal Data Processing operations undertaken other than in accordance with a permit issued by the QFC Authority:

(A) any Personal Data Processing operation or set of operations involving the Processing of Sensitive Personal Data; and

(B) any Personal Data Processing operation or set of operations involving the transfer of Personal Data to a Recipient outside of the QFC which is not subject to laws and regulations which ensure an adequate level of protection."

Such notification must include:

"(A) the name of the Data Controller;

(B) the address of the Data Controller;

(C) the name, address, telephone number, fax number and e-mail address of the Person within the Data Controller responsible for making the application for the permit;

(D) the reason for which notification is being provided;

(E) a general description of the Personal Data Processing being carried out;

(F) an explanation of the purpose of the Personal Data Processing;

(G) the Data Subjects or class of Data Subjects whose Personal Data is being processed;

(H) a description of the class of Personal Data being processed; and

(I) a statement of which jurisdictions to which Personal Data will be transferred by the Data Controller, along with an indication as to whether the particular jurisdiction has been assessed as having adequate level of protection for the purposes of Articles 9 and 10 of the Data Protection Regulations."

Data Controllers' Obligations

Art 6 (1) of the Regulations requires data controllers to ensure that the personal data that they process is:

(A) processed fairly, lawfully and securely;

(B) processed for specified, explicit and legitimate purposes in accordance with the data subject’s rights and not further processed in a way incompatible with those purposes or rights;

(C) adequate, relevant and not excessive in relation to the purposes for which it is collected or further processed;

(D) accurate and, where necessary, kept up to date; and

(E) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data was collected or for which they are further processed.

Data controllers are obliged by art 6 (3) to establish and maintain systems and controls that enable the to satisfy themselves that they comply with the above requirements.

Legitimate Processing

The conditions for legitimate data processing are set out in art 7:

(1) the data subject has unambiguously given his consent;

(2) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(3) Processing is necessary for compliance with any legal obligation to which the data controller is subject;

(4) Processing is necessary in order to protect the vital interests of the data subject;

(5) Processing is necessary for the performance of a task carried out in the interests of the QFC or in the exercise of QFC Authority, Regulatory Authority, Tribunal or Appeals Body functions or powers vested in the data controller or in a third party to whom the personal data is disclosed; or

(6) Processing is necessary for the purposes of the legitimate interests pursued by the data controller or by the third party or parties to whom the personal Data is disclosed, except where such interests are overridden by compelling legitimate interests of the data subject relating to the data subject's particular situation.

Sensitive Personal Data

"Sensitive personal data" is defined as personal data revealing or relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership and health or sex life." Art 8 (1) provides that sensitive personal data shall not be processed unless:

(A) the data subject has given his explicit consent to the processing of that personal data;

(B) Processing is necessary for the purposes of carrying out the obligations and specific rights of the data Controller in the field of employment law;

(C) Processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his consent;

(D) the Processing is carried out by a foundation, association or any other non-profit-seeking body in the course of its legitimate activities with appropriate guarantees that the processing relates solely to the members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data is not disclosed to a third party without the consent of the data subjects;

(E) the processing relates to personal data which is manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims;

(F) Processing is necessary for compliance with any legal obligation to which the data controller is subject;

(G) Processing is necessary to uphold the legitimate interests of the data controller recognised in the international financial markets, provided that such is pursued in accordance with international financial standards and except where such interests are overridden by compelling legitimate interests of the data subject relating to the data subject's particular situation;

(H) Processing is necessary to comply with auditing, accounting or anti money laundering obligations that apply to a data controller; or

(I) Processing is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where that Personal Data is processed by a health professional subject under national laws or regulations established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy.

However, these conditions do not apply where a data controller obtains a permit to process sensitive personal data from the QFC Authority and applies "adequate safeguards" with respect to the processing of such data (art 8 (2)). Rule 2 of the Rules sets out the procedure for applying for such a permit.

Transfer of Data outside the QFC

Subject to the following exceptions, a data controller may only transfer personal data to a recipient located in a jurisdiction outside the QFC if an adequate level of protection for that personal data is ensured by laws and regulations that are applicable to the recipient (art 9 (1)). The adequacy of the level of protection depends on all the circumstances including but not limited to

(A) the nature of the data;

(B) the purpose and duration of the proposed processing operation or operations;

(C) if the data does not emanate from the QFC, the country of origin and country of final destination of the personal data; and

(D) any relevant laws to which the recipient is subject, including professional rules and security measures (art 9 (2)).

Guidance for assessing such adequacy is provided by rule 3.1 of the Rules.

Alternatively, data may be transferred outside the QFC if any of the following conditions are met:

(A) the QFC Authority has granted a permit for the transfer or the set of transfers and the data controller applies adequate safeguards with respect to the protection of the personal data;

(B) the data subject has given his unambiguous consent to the proposed transfer;

(C) the transfer is necessary for the performance of a contract between the data subject and the data controller or the implementation of pre-contractual measures taken in response to the data subject's request;

(D) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller and a third party;

(E) the transfer is necessary or legally required on grounds important in the interests of the QFC, or for the establishment, exercise or defence of legal claims;

(F) the transfer is necessary in order to protect the vital interests of the data subject;

(G) the transfer is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case;

(H) the transfer is necessary for compliance with any legal obligation to which the data controller is subject;

(I) the transfer is necessary to uphold the legitimate interests of the data Controller recognised in the international financial markets, provided that such is pursued in accordance with international financial standards and except where such interests are overridden by legitimate interests of the data subject relating to the Data Subject's particular situation; or

(J) the transfer is necessary to comply with auditing, accounting or anti money laundering obligations that apply to a data controller which is established in the QFC.

The procedure for obtaining a permit is set out in rule 3.2 of the Rules.

Information to Data Subjects

Art 11 (1) of the Regulations requires data controllers to provide the following information to their data subjects as soon as they begin to collect information from them:

(A) the identity of the data controller;

(B) the purposes of the processing for which the personal data are intended; and

(C) any further information in so far as such is necessary, having regard to the specific circumstances in which the personal data are collected, to guarantee fair processing in respect of the data subject, such as:

(i) the recipients or categories of recipients of the personal data;

(ii) whether replies to questions are obligatory or voluntary, as well as the possible consequences of failure to reply;

(iii) the existence of the right of access to and the right to rectify the personal data;

(iv) whether the personal data will be used for direct marketing purposes; and

(v) whether sensitive personal data will be processed and whether it will be transferred outside the QFC.

If they process data that are not collected from the data subject, data controllers should supply the above information to the data subject as soon as they start to record the data together with particulars of the data or categories of data concerned. If the data are to be disclosed to a third party the data controller must supply such information at the time of the disclosure (art 12 (1) of the Regulations).

Processing by Third Parties

Art 13 of the Regulations prohibits the processing of personal data except on the instructions of a data controller unless required to do so by law.

Security of Processing

Data controllers are required by art 14 (1) to" implement appropriate technical and organisational measures" to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access and against all other unlawful forms of processing, in particular where sensitive personal data is processed or data are transferred outside the QFC. Art 14 (2) provides that regard may be had to the cost of implementation and the nature of the data when determining the appropriateness of those measures. Data controllers who contract out their processing should choose data processors providing sufficient guarantees in respect of the technical security measures and organisational measures governing the processing to be carried out, and must ensure compliance with the above measures (art 14 (3)).

Data Subjects' Rights

Art 15 of the Regulations confers on data subjects the right to request at reasonable intervals and without excessive delay or expense:

(1) confirmation as to whether personal data relating to him is being processed and, if so, information at least as to the purposes of the processing, the categories of personal data concerned and the recipients or categories of recipients to whom the personal data is disclosed;

(2) communication to him in an intelligible form of the personal data undergoing processing and of any available information as to its source; and

(3) as appropriate, the rectification, erasure or blocking of personal data the processing of which does not comply with the provisions of the regulations.

Data subjects also have the right under art 16 to:

(A) object at any time on reasonable grounds relating to his particular situation to the processing of personal data relating to him; and

(B) be informed before personal data is disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object to such disclosures or uses.

Enforcement

A person who believes on reasonable grounds that he has been adversely affected by a contravention of the regulations in respect of the processing of his personal data or as regards the exercise of their rights under the above articles may file a claim with the QFC Authority under art 23 of the Regulations. The process for lodging a claim is set out in rule 5.1 of the Rules and guidance is given in rule 5.2. The QFC Authority may enquire into any claim filed with it. If it believes the claim to be well founded the QFC Authority may direct the data holder:

"(A) to do or refrain from doing any act or thing within such time as may be specified in the direction; or

(B) to refrain from Processing any Personal Data specified in the direction or to refrain from Processing Personal Data for a purpose or in a manner specified in the direction."

Art 22 (2) provides a right of appeal to the tribunal referred to above.

Further Information

Anyone wishing to discuss this article, the QFC data protection law or data protection generally should call me on 0800 862 0055 or fill in my contact form.

Angels Den in Qatar

According to its website Angels Den is a network of 4,000 business angels and 10,000 entrepreneurs. It is organized in every region of the United Kingdom except Northern Ireland plus Hong Kong, Singapore and Qatar.

Angels Den in Qatar has two regional managers, Elaine Gold and Dave Trevena.

Gold has a website and blog on her personal interests with a specific emphasis on living and working in the Middle East. Her latest post is "'Be an Angel' - Invest in Qatar" dated 16 Sept 2011. After explaining what an angel is, the article asks whether the angel model can work in the Gulf.

Trevena is commercial director of Distinction which is part of the Kepco Group that claims to "introduce new ideas and innovative companies, technologies, products and services to the Qatari market place." Distinction's website has articles on Qatar, starting a business in Qatar, finding investment in Qatar through Angels Den and Distinction's services. There is also a blog on Distinction's website with a number of articles by Trevena since 11 Sept 2011.

The Angels Den website has announced two business funding clinics at the Renaissance Hotel in Doha for 29 Sept and 30 Oct 2011.

Any Qatari investor who is minded to become an angel should know something of intellectual property. As good a starting point as any is my primer "What Business Angels and VCs need to know about IP". He or she will need to satisfy him or herself that the business is properly constituted, that there is adequate intellectual property protection in place, that its terms of business, standard contracts and employees' service contracts are robust and that there is full compliance with Qatari and all other applicable laws.

The entrepreneur for his or her part will also need legal advice and representation in negotiating with the angel. Ideally they will draw up a shareholders' agreement with the angel to set out their respective rights and responsibilities.

The Qatar Financial Centre has its own legal system based on the common law with judges from England and other common law jurisdictions (see my articles on the Qatar Financial Centre and the Qatar Financial Centre: Civil and Commercial Court Regulations). Although the Centre's jurisdiction is narrowly defined it should be the jurisdiction of choice in agreements between overseas investors and Qatari nationals wherever possible.

Anyone who wants to discuss any of the topics discussed in this post should get in touch through my contact form.

Intellectual Property Law in Oman

Oman has an estimated population of 3.6 million in a land area of 309,501 square kilometres. It is a member of the Gulf Co-operation Council ("GCC") and the World Trade Organization ("WTO"). Formerly one of the least developed states in the Gulf, the Sultanate has made such rapid progress since 1970 in economic, political and social development that the United Nations Development Programme acclaimed Oman as the most improved country in the world (see the UNDP Human Development Report for 4 Nov 2010).

Treaties

As a member of the WTO Oman is party to TRIPS (the Agreement on Trade Related Aspects of Intellectual Property Rights) and is thereby bound by the obligations discussed in my article on "Intellectual Property Law in Kuwait". As a member of the GCC, the GCC Patent Regulation and Implementing Bylaws apply in Oman. Oman is also party to the Paris and Berne Conventions, the WIPO Copyright and Performances and Phonograms Treaties, the Patent and Trademark Law Treaties, the UPOV Convention and the Patent Co-operation Treaty, Madrid Protocol and Hague Agreement (see the WIPO Treaties Contracting Parties page for Oman).

Legislation

Oman implements its obligations under those treaties through a number of Royal Decrees made in 2000 on patents, copyrights and neighbouring rights, trade marks and unfair competition, industrial designs, geographical indications and semiconductor topographies. The Sultanate's copyright law has been supplemented by Royal Decree No. 65/2008 Promulgating the Law on Copyright and Related Rights and its law on industrial property rights by Royal Decree No 67/2008. Royal Decree No 49/2009 on the protection of plant breeders' rights has come into effect this year the text of which is available in Arabic.

Intellectual Property Office

The Ministry of Commerce and Industry is the intellectual property office for the Sultanate. The English language page of the Ministry's website suggests that it will soon be possible to file patent, utility model and trade mark applications on-line.

Dispute Resolution

Oman has enacted robust arbitration legislation which would resolve licensing, joint venture and other disputes relating to intellectual property. A press release on 16 March 2010 indicated that the Oman Chamber of Commerce and Industry planned to establish an international arbitration centre in the country. A delegation from the Bar of England and Wales visited Oman in December 2010 (see the Bar Council's press release of 3 Dec 2010).

Further Information

Oman is a country of considerable potential and one that I follow particularly closely. Anyone who wishes to discuss this article or any other issue concerning intellectual property law in the Gulf should call me on 0800 862 0055 or complete my contact form.

DIFC Data Protection Law

The 45 hectare free zone in Dubai known as the Dubai International Financial Centre has its own data protection law (DIFC Law No 1 of 2007). According to James Michael, editor of Privacy Laws & Business this is the first data protection law in an Arab country (see his interview with the DIFC data protection commissioner, Nasser H. Saidi of Feb 2007 (Issue 86)).

Why the DIFC has a Data Protection Law

On the day that Syrian troops attack Hama and with civil war raging in Libya one would have been forgiven for thinking that the Arab world would have had more pressing concerns. So why does the DIFC bother? In "Why Data Protection Matters" the DIFC Data Protection Commissioner offers this answer:

"The result of the processing and mishandling –voluntary or involuntary- of personal data can have significant consequences, including credit card and identity theft. It is crucial that individuals’ right to privacy is protected by establishing effective data protection laws and enforcing legal safeguards to secure and protect personal data and its processing. Today governments and regulators world-wide, with the EU countries in the fore-front, are increasingly calling for measures to protect privacy and the adoption of data protection regimes to enforce such safeguards."

In other words, financial institutions in Dubai need to be able to exchange personal data with financial institutions in London and other financial centres in the EU and they can do that only if they offer protection for such data that is comparable to the protection available in the UK and other EU member states.

Application

Art 5 of Law No. 1 of 2007 ("the Law") makes clear that it applies to the DIFC only. There is no comparable legislation for the rest of the emirate or the other emirates of the UAE.

Commencement

According to art 4, the Law replaces a Data Protection Module that had been in force since 2004. The new legislation appears to have been implemented by an order k known as "Enforcement and Compliance Notice Circular No 1" issued by the Data Protection Commissioner ("the Commissioner") on 27 May 2007.

Secondary Legislation

The law is supplemented by the Data Protection Regulations 2007 ("the Regulations") which are made by the DIFC Authority pursuant to art 27 (1) of the Law. It is also necessary to refer to the Enforcement and Compliance Notices known as "Circulars" made by the Commissioner from time to time. According to the DIFC website there have been two such circulars so far:

• Circular No. 1 of 27 May 2007 which has already been mentioned as it appears to serve the same purpose as a commencement order in England; and
• Circular No. 2 of 27 Aug 2009.

The legislative institutions of the DIFC are introduced in my short article on the DIFC Courts.

The Commissioner

Art 21 (1) of the Law provides for the appointment of the Commissioner by the President of the DIFC. The Commissioner is required by art 7 (1) to administer the Law and Regulations. The Commissioner has powers under art 25 that are broadly comparable to those conferred by Part VI of the Data Protection Act 1998 on the Information Commissioner in England.

Duty to Notify

Art 19 (2) requires data controllers (that is to say, persons in the DIFC who alone or jointly with others determine the purposes and means of processing personal data (para 3 of the Schedule)) to notify the Commissioner of their processing. Regulation 6 of the Regulations sets out in detail the content of such notification. Art 2 of Circular No. 1 set a deadline of 30 June 2007 for such registration in the case of existing businesses.

General Requirements

The equivalent of the data protection principles in the British legislation are set out in art 8 (1) of the Law:

"Data Controllers must ensure that Personal Data which they Process is:

(a) Processed fairly, lawfully and securely;
(b) Processed for specified, explicit and legitimate purposes in accordance with the Data Subject’s rights and not further Processed in a way incompatible with those purposes or rights;
(c) adequate, relevant and not excessive in relation to the purposes for which it is collected and/or further Processed;
(d) accurate and, where necessary, kept up to date; and
(e) kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal Data was collected or for which they are further Processed."

As in the UK there are special provisions for the processing of sensitive personal data which is defined as personal data "revealing or concerning (directly or indirectly) racial or ethnic origin, communal origin, political affiliations or opinions, religious or philosophical beliefs, criminal record, trade-union membership and health or sex life."

Sensitive Personal Data
Sensitive personal processing requires a permit from the Commissioner under art 10 (2) of the Law unless the requirements of art 10 (1) are met. The procedure for obtaining such a permit are set out in Regs 2 to 4.

Data Subjects' Rights
Data subjects have the following rights under art 17 (1) of the Law:

"(a) confirmation as to whether or not Personal Data relating to him is being Processed and information at least as to the purposes of the Processing, the categories of Personal Data concerned, and the Recipients or categories of Recipients to whom the Personal Data are disclosed;
(b) communication to him in an intelligible form of the Personal Data undergoing Processing and of any available information as to its source; and
(c) as appropriate, the rectification, erasure or blocking of Personal Data the Processing of which does not comply with the provisions of the Law."

In addition, they are entitled

"(a) to object at any time on reasonable grounds relating to his particular situation to the Processing of Personal Data relating to him; and
(b) to be informed before Personal Data is disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object to such disclosures or uses."

Transfer of Data Abroad
Art 11 (1) prohibits the transfer of personal data outside the DIFC without a permit from the Commissioner under art 12 except to a country or territory listed by the Commissioner that offers comparable protection for personal data. The latest list includes the countries of the European Economic Area including the United Kingdom, Channel Islands and the Isle of Man and, interestingly, the USA to companies that comply with the Commerce Department's "Safe Harbor" Policy. Reg 5 of the Regulations sets out the procedure for obtaining a permit for the transfer of personal data outside the DIFC.

Enforcement
The Commissioner has very extensive powers of investigation and enforcement under art 25 (3). These include the power to fine under art 25 (3) (f) and to initiate a claim for compensation under art 35 for contravention of the law to the detriment of a data subject under art 26 (3) (g). Data subjects may complain in the first instance to the Commissioner under art 33 (1) who may mediate between the data subject and data controller under art 33 (2). Data controllers may appeal from the Commissioner to the DIFC Court under art 34 (1). The DIFC Court is, of course, a common law English language court before which I and other members of the English Bar can appear.

Contact
Further information about data protection in the DIFC can be obtained from the The Data Protection Administrator at the
Dubai International Financial Centre Authority
Level 14, The Gate
PO Box 74777,
Dubai, United Arab Emirates
Email: administrator@dp.difc.ae
Tel : +971 4 362 2623
Fax: +971 4 362 2656

Further Information
Should you require further information or advice in a specific case or representation in a mediation or appeal or application to the DIFC Court, do not hesitate to call me on 0800 862 0055 if you are in the UK or use my contact form. As you can see data protection has been one of my interests since 1984.

Intellectual Property Law in Kuwait

Kuwait has an estimated population of just under 3.6 million in a land area of 17,820 square kilometres. It is one of the member states of the Gulf Co-operation Council ("GCC") (see "Gulf Co-operation Council Constitutional Framework" 10 June 2011 and "Patents: Gulf Co-operation Council" 20 Jan 2011).

International Obligations

This small but significant country is one of the founding members of the World Trade Organization ("WTO"). As such it is party to TRIPS (The Agreement on Trade Related Aspects of Intellectual Property Rights) which requires WTO members to give effect to the provisions of that agreement. That includes

• complying with arts 1 to 12 and art 19 of the Paris Convention for the Protection of Industrial Property ("Paris Convention") pursuant to art 2 (1) of TRIPS;
• complying with arts 1 to 21 of the Berne Convention for the Protection of Literary and Artistic Works ("Berne Convention") pursuant to art 9 (1) of TRIPS;
• protect the work of performers, sound recording studios and broadcasters in accordance with art 14 of TRIPS;
• provide for the registration of trade marks pursuant to arts 15 to 21 of TRIPS;
• protect geographical indications pursuant to arts 22 to 24;
• protect industrial designs pursuant to arts 25 and 26;
• provide patents for inventions in all fields of technology provided they are new, involve and inventive step and are capable of industrial application pursuant to arts in accordance with arts 27 to 34;
• protect semiconductor topographies in accordance with certain provisions of the Treaty on IP in Respect of Integrated Circuits ("the Washington Treaty") pursuant to arts 35 to 38 of TRIPS;
• protect undisclosed information pursuant to art 39; and
• provide civil remedies, criminal sanctions and other provisions for the enforcement of intellectual property rights under Part III of the Agreement.

Kuwait has been a member of the WIPO since 14 July 1998 but it does not appear to be party to the Paris or Berne Conventions or the Washington Treaty. Indeed, the only convention listed on the WIPO website to which Kuwait is party is the WIPO Convention.

The Kuwaiti government has entered a number of bilateral investment treaties with a number of countries (though not with HM government) which usually require the protection of intellectual property. Citizens of either party can sometimes claim compensation in ICSID (International Centre for the Settlement of Investment Disputes) against the government of the other party for non-compliance with such a treaty (see Metalclad Corp. v Mexico (30 Aug 2000)).

Legislation

A summary of Kuwait intellectual property laws and related legislation appears in WIPO lex. The main statutes appear to be:

• Law number 4 of 1962 relating to patents, designs and industrial models as amended by law number 3 of 2001 (Arabic and English);
• Law number 64 of 1999 concerning intellectual property rights (Arabic and English); and
• Decree number 68 of 1980 on trade marks as amended by decree no 10 of 1987 (Arabic only).

As Kuwait is party to the GCC, the Patent Regulation and the Implementing Bye-laws of the GCC will also apply.

Dispute Resolution

Industrial property disputes can be resolved through arbitration pursuant to Law No. 11 of 1995 regarding judicial arbitration with respect to civil and commercial matters (Arabic and English). The Kuwait Chamber of Commerce and Industry appears to provide arbitration services.

Intellectual Property Offices

According to WIPO the competent authority for patents and trade marks is the Trade Marks and Patent Department of the Ministry for Commerce and Industry at PO Box 2944, Safat 13030, Kuwait City, Tel +956 22 42 44 26. That Ministry is also responsible for copyright policy.

The GCC Patent Office is at the GCC Offices, PO Box 340227, Riyadh, Saudi Arabia 11333 (see Patents: Gulf Co-operation Council 20 Jan 2011).

Further Information

Anyone requiring further information about this article should call me on 0800 962 0055 or use my contact form. I have two contacts in Kuwait to whom I shall be glad to refer any enquiries on any substantial issue of Kuwaiti law.