After six months, the Saudis will be on a date with the entry into force of a unique decision, which is to consider the communications and messages of advertising companies without obtaining the customer’s permission in advance as a crime punishable by law.
According to the Personal Data Protection Law and its enforcement, publishing or copying the information and phone numbers of others and any information about them related to their origins, or copying or copying official documents that identify the owner of personal data, is considered a crime unless the regulations provide for exceptions.
With the exception of educational materials sent by public authorities, the party that obtained the personal data may not use the means of communication, including postal and electronic addresses, of the owner of the personal data to send advertising or awareness materials, except after obtaining the consent of the target recipient that the sender of the materials provides a clear mechanism Enables the target recipient to express their desire to stop sending it to them when they want it.
Okaz newspaper quotes lawyer Khaled Abu Rashid as saying that the system confirmed that it is not permissible to process personal data or change the purpose of processing it without the consent of its owner, and companies may not collect personal data except from its owner directly.
According to the system, the controlling authority may not disclose personal data unless the owner of the personal data agrees to disclosure in accordance with the provisions of the system, or if the personal data was collected from a publicly available source.
Or if the entity requesting disclosure is a public entity for security purposes, to implement another system, to fulfill judicial requirements, or if the disclosure is necessary to protect public health or safety, protect the life of an individual or certain individuals, or protect their health.
And if the disclosure will be limited to its subsequent processing in a way that does not lead to the identification of the owner of the personal data or any other individual specifically. The regulations specify the controls and procedures related to this.
What are the penalties?
Abu Rashid says that “the system confirmed that anyone who discloses or publishes sensitive data in violation of the provisions of the system shall be punished with imprisonment for a period not exceeding (two years) and a fine not exceeding (three million) riyals, or one of these two penalties; if he intended to harm the data owner or with intent achieve personal benefit.
The Public Prosecution is responsible for investigating and prosecuting before the court for violations stipulated in the law.
According to what Okaz quoted lawyer Nisreen Ali Al-Ghamdi, a member of the Saudi Lawyers Association, “the system emphasized that the control authority would destroy the personal data as soon as the purpose of its collection was completed, while limiting the right to access health data – including medical files – to the least number of employees possible.” or workers and to the extent necessary to provide the necessary health services.