To print this text, all you want is to be registered or login on Mondaq.com.
The Kingdom of Bahrain is increasing its laws on the safety of people and their private information. On the 17th of March 2022, the Bahraini Ministry of Justice, Islamic Affair and Endowments (the”Ministry“) issued ten ministerial resolutions relating to varied parts of the Private Knowledge Safety Regulation established underneath Legislative Decree No. (3) of 2018 (the”PDPL).
This replace will handle the selections the Ministry imposed with a purpose to regulate and enhance the method of private information in mild of the PDPL.
Transferring Private Knowledge Outdoors the Kingdom
Related to Article 12 of the PDPL, the primary ministerial decision issued lists all of the international locations and territories that, upon the Private Knowledge Safety Authority (the”
Authority“), offers enough legislative and regulatory safety for private information. It will information the info controller (the particular person entrusted with the processing of private information) on the place he can switch the non-public information, understanding such information can be protected, with out the necessity to acquire a allow from the authority. Such allow is simply wanted within the case of a switch executed to international locations and territories that aren’t enlisted, are inside a regional or worldwide group, or transferred to a different information controller or a 3rd celebration exterior the dominion based mostly on a contract.
Technical and Organizational Measures
To make sure the suitable stage of safety is bearing in mind for the info to be processed, the info controller shall adhere to the next:(i) apply all or some technical and organizational measures wanted throughout the processing operations, (ii)conduct a knowledge safety impression evaluation throughout the technique of procedures which can assist establish and reduce the info safety dangers of a undertaking, (iii) open communication channels between the info controller and the info topic (the particular person topic of information) or their authorized representatives to report if there’s any breach, (iv) implement guidelines for inner investigation to disclose the explanations that led to the breach, (v) present coaching applications to staff on such measures and protocols associated thereto.
Notification to the Authority
In response to Decision No. 44 of 2022, the info controller shall give prior discover to the Authority of any wholly or partially automated processing operation, or set of such operations, supposed to serve a single objective or a number of associated functions via the authority’s web site. The Authority could have ten days previous to the date of receiving the discover to request the completion of any deficiency within the notification. Within the instances stipulated in Article 15(1) of the PDPL, the info controller shall acquire a previous written permission from the authority. Acquiring such prior notification won’t imply that the info controller is obligated to acquire the consent of the info topic.
Procedures of Processing Delicate Private Knowledge
Within the occasion of the info controller giving prior discover to the authority, as talked about within the paragraph above, it’s prohibited to course of delicate private information with out the consent of the info topic. Nonetheless, the info controller might course of with out the consent of the info topic if one of many instances set forth in Article 5 of PDPL is current.
Through the processing of any delicate private information, the info controller should abide by the next:(i) it shall be carried out throughout the scope of the consent of the info topic and the authority, (ii) he shall use technical measures to ensure the security from any breach, (iii) not maintaining the info for a interval exceeding the interval specified by the info topic.
Knowledge Safety Guardian
An information safety guardian is any pure or authorized particular person (firms) registered underneath the Knowledge Safety Guardians Register both internally or externally, helping the info controller in exercising his rights and adhering to his duties. Decision No.46 of 2022 elaborates on the necessities of changing into an inner/exterior information safety guardian.
In the meantime Decision No. 47 of 2022 specifies the registration and renewal charges of registering underneath the Knowledge Safety Guardians Register. Such charges could also be exempted relying on the financial institution assertion for the final three months of the involved celebration with a duplicate of the annual report of the accounting audit for the final fiscal 12 months.
Rights of the Knowledge Topic
The principle obligation of the PDPL is to guard the info topic from any breach and violation of his private information. Therefore, the info controller should take up all measures with a purpose to guarantee such safety is accessible to the topic, by informing him of the choice distributed for the processing of the non-public information and setting guidelines and procedures to ease the info topic’s proper to withdraw his consent.
Lodging Complaints
Anybody having a reliable curiosity or capability might lodge a written grievance to the authority if he believes that there could be a breach of any provision of the PDPL. After the grievance is submitted and accepted by the authority, they shall notify the events accused of their proper. The decision provides out a interval not exceeding seven working days from the date of the grievance for the accused to reply with their protection. Nonetheless, when the grievance is carried out underneath critical issues accompanied with robust proof, the chairman of the board might examine with none prior discover. The authority will examine and resolve on the grievance in accordance with Chapter One in all Part Three from the PDPL.
Controls and Ensures for Sustaining Confidentiality of the Knowledge with Respect to Submitting and Conducting Legal Proceedings and Associated Judgments
In accordance with Article 7 of the PDPL, entities and people approved to course of information associated to submitting and initiating a prison case are prohibited from disclosing, transmitting, publishing, broadcasting, circulating, or offering such information to every other celebration not involved with it in in keeping with the regulation. They shall use technical methods or any applicable means to make sure an enough stage of safety and privateness throughout the technique of the info, whether or not it’s carried out in an automatic or non-automated method, with a purpose to protect it in a means that ensures its confidentiality and safety.
Public Entry to Private Knowledge Register
The non-public information recorded within the registers could also be accessible to the general public by the consent of the info topic. The information controller can be required to tell the info topic on the aim of making the register with every other vital info in accordance with the circumstances of the case and shall replace the register usually and make sure that it is shielded from any sort of hacking or information manipulation . Moreover, Decision No. 51 of 2022 signifies the content material that ought to be included within the register, resembling the info kind, objective of the info assortment, and the date of the final replace to the register.
Concluding Remarks
For the reason that PDPL has come into power together with current ministerial resolutions, it has created a precedent for the businesses and organizations within the Kingdom of Bahrain to comply with and shield their prospects and worker’s private information by defining the strategies and technique of processing such information in a means that offers them confidence.
The content material of this text is meant to offer a normal information to the subject material. Specialist recommendation ought to be sought about your particular circumstances.
POPULAR ARTICLES ON: Privateness from Bahrain