WEBVTT
00:00:13.839 --> 00:00:21.600
Hello, and welcome back to our podcast series where we explore privacy and data protection laws around the world.
00:00:21.760 --> 00:00:26.079
I'm Katie Birch and I'm joined with my colleague Maria Maloney.
00:00:26.480 --> 00:00:27.280
Hello, everyone.
00:00:27.600 --> 00:00:36.399
In this series, we examine how different jurisdictions regulate personal data and what that means for organizations who operate internationally.
00:00:36.799 --> 00:00:42.000
In the past, we have done Qatar's personal data privacy protection law.
00:00:42.320 --> 00:00:47.200
We covered the UAE federal law and some of their free zones.
00:00:47.439 --> 00:00:53.920
We also done India's data protection law and the Kingdom of Saudi Arabia's.
00:00:54.159 --> 00:01:03.679
But today we are turning our attention to Bahrain's personal data protection law along with its accompanying decisions.
00:01:04.400 --> 00:01:06.159
So as always, I'm joined by Dr.
00:01:06.239 --> 00:01:16.480
Maria Maloney, and together we're going to explore how the framework works, how it compares to the GDPR and its neighboring jurisdictions.
00:01:17.120 --> 00:01:29.840
And so yeah, I'll begin by asking you the first question, Maria, which is where does Bahrain's personal data protection law sit within the broader global privacy landscape?
00:01:30.319 --> 00:01:31.120
Thanks, Katie.
00:01:31.439 --> 00:01:32.959
That's an interesting question.
00:01:33.200 --> 00:01:40.640
So Bahrain enacted its personal data protection law, which is called Law Number 30 of 2018.
00:01:40.799 --> 00:01:44.400
And it came into force in August 9, 2019.
00:01:44.640 --> 00:02:02.319
And there was that this was a significant step for the kingdom, the Kingdom of Bahrain, and it marked its transition towards a comprehensive, standalone kind of data protection regime, rather than what they had relied on previously, which would have been kind of fragmented sectoral rules.
00:02:02.560 --> 00:02:06.400
So this was the one that kind of consolidated it across industries.
00:02:06.640 --> 00:02:17.280
What's particularly notable about this law is that Bahrain was one of the earlier adopters of a full privacy framework in the Gulf region.
00:02:17.360 --> 00:02:23.439
So you're talking back in 2019, the GDPR had just been in force like one year.
00:02:24.479 --> 00:02:44.479
So alongside jurisdictions like the DIFC that's in the United Arab Emirates, and we covered that in the free zones in one of our podcasts, it positions itself as a regional leader in recognizing personal data protection as both a regulatory requirement and a trust enabler for digital economies.
00:02:44.560 --> 00:02:58.639
So again, it wants to be like one of the leaders, one of the primary places in the Gulf region where you know people or organizations could come to and expect a good level of data protection for their personal data.
00:02:58.960 --> 00:03:08.319
From a structural perspective, the law clearly reflects a broader global convergence in privacy governance and is heavily influenced by the GDPR principles.
00:03:08.400 --> 00:03:15.919
So we've seen that again in the United Arab Emirates kind of free zones, they were also very heavily influenced by the GDPR.
00:03:16.159 --> 00:03:27.840
We see familiar concepts from the GDPR, such as lawful basis for processing data, data subject rights, accountability obligations, and restrictions on cross-border transfers.
00:03:28.319 --> 00:03:34.639
However, Bahrain has adopted these principles to its own legal and economic context.
00:03:34.800 --> 00:03:45.919
And again, we've seen that in many of our podcasts that they kind of they they borrow from the GDPR, but then they interpret it for their own culture, for their own needs and their own kind of their own context.
00:03:46.159 --> 00:03:58.560
So while the foundations are recognizable and they're kind of GDPR inspired, the operationalization of the law is more flexible and in some areas less prescriptive than the GDPR.
00:03:58.879 --> 00:04:09.919
From an implementation standpoint, this is important because it means organizing organizations operating across jurisdictions can leverage existing GDPR aligned governance frameworks.
00:04:10.000 --> 00:04:18.399
So if you're coming from Europe or if you you you deal with Europe, you can kind of port your you know the existing governance that you have for the GDPR.
00:04:18.480 --> 00:04:29.040
You can you can use a lot of it here when you move to Bahrain, such as their roper structures, their risk assessments, their accountability mechanisms are all very similar to the GDPR.
00:04:29.519 --> 00:04:41.199
But it's still you kind of still need to be mindful of the local nuances, particularly around regulatory oversight, enforcement practices, and specific procedural requirements.
00:04:41.600 --> 00:04:59.120
And we this is not the first time that we've seen this, you know, we're seeing kind of a trend in the Gulf where they you know they they ensure that they have adequacy with the GDPR, they take the principles from the GDPR, but then they kind of they uh adapt them to their own requirements.
00:04:59.360 --> 00:05:07.920
So when you think about it, like the the GDPR came in in 2018, Bahrain came in, their law came in in 2018.
00:05:09.120 --> 00:05:23.279
Um it came in 2018 as well, but it came into force in 2019, you had Qatar in 2016, and then you had the United Arab Emirates coming in in 2021, and then India finally in 2023.
00:05:23.600 --> 00:05:31.279
So when you look at it in that context, it is an earlier uh data protection framework.
00:05:31.920 --> 00:05:48.079
Okay, so Katie, uh my question for you then is when we discussed Qatar the last time, and prior to Qatar we discussed United Arab Emirates, we saw slightly different jurisdictional approaches, and I've just spoken about that as well for Bahrain.
00:05:48.240 --> 00:05:56.240
Um, who does Bahrain's law, data protection law, apply to thank you, uh Maria?
00:05:56.399 --> 00:06:10.319
So it applies to every resident inside the kingdom and businesses inside the kingdom, and anyone who processes data using means or tools situated inside the kingdom.
00:06:10.399 --> 00:06:37.279
So it's a lot more territorially focused than the GDPR, like the GDPR and the Indian DPDP apply to processing that targets European or Indian individuals, whereas from the wording of this law, uh Bahrain national who's not inside the kingdom, it seems that it wouldn't apply to them.
00:06:37.920 --> 00:06:54.959
As for the material scope, it also applies to all processing, whether it's fully partial or non-automatic, to all data when it forms part of a filing system or is intended to form part of a filing system.
00:06:55.120 --> 00:07:03.680
So that's digital and non-digital data because we did see in India that it only applies to the digital data.
00:07:04.079 --> 00:07:04.720
Yeah, exactly.
00:07:04.800 --> 00:07:05.360
Yeah, yeah.
00:07:05.519 --> 00:07:08.079
So it's both like the GDPR essentially.
00:07:08.399 --> 00:07:16.480
Yeah, so in material scope it's like the GDPR, and in territorial scope, it's more like guitar.
00:07:18.079 --> 00:07:18.399
Okay.
00:07:19.920 --> 00:07:29.199
So your question, Maria, what are the what do the core definitions look like in Bahrain's law?
00:07:30.000 --> 00:07:30.879
Thanks, Katie.
00:07:31.199 --> 00:07:45.199
Um essentially at the core of Bahrain's personal data protection law, there are a set of key concepts that will feel very familiar to anyone who's been working with uh privacy frameworks, especially the GDPR.
00:07:45.600 --> 00:07:57.120
These include definitions of personal data, sensitive personal data, which will be special category data under the GDPR, processing, as well as the roles of the data controller and the data processor.
00:07:57.199 --> 00:08:01.120
They're all very similar and they they they exist in the Bahrain law as well.
00:08:01.680 --> 00:08:09.680
Personal data is broadly defined as any information relating to an identifiable individual, and again, very similar to the GDPR there.
00:08:10.079 --> 00:08:24.000
While sensitive personal data captures higher risk categories such as health data, biometric information, religious beliefs, and again, like the GDPR, the this type of data triggers enhanced protections.
00:08:24.560 --> 00:08:36.720
Processing is also defined as a comprehensive way of covering the full life cycle of the data activities, from collection of the data to storage and through to disclosure and deletion.
00:08:36.960 --> 00:08:42.639
Okay, so again, you see the kind of the data lifecycle that would be very similar to the GDPR.
00:08:43.039 --> 00:08:56.639
But from a governance perspective, the distinction between data controllers and data processors is particularly important because controllers determine the purpose and the means of processing while the processor acts on behalf of the controller.
00:08:57.679 --> 00:09:03.200
This mirrors the accountability structures that we see in mature regimes like the GDPR.
00:09:04.000 --> 00:09:09.440
When we step back and compare this to other frameworks, some interesting differences emerge.
00:09:09.759 --> 00:09:26.240
However, the GDPR remains the most detailed and granular framework in terms of definitions and providing a very high level, a high level of legal precision that supports consistent interpretation across the member states.
00:09:27.600 --> 00:09:37.279
We saw in the Indian DPDP Act that they took a different kind of conceptual approach using terminology like the data principle and the data fiduciary.
00:09:37.759 --> 00:09:58.960
So even though the functionality would be similar to the GDPR, the you know the D DPDP Act kind of reframed things and shifted things slightly to kind of place the individual in the core to the to the core of the of the legislation and reflecting kind of principle-based uh kind of um approaches to data protection.
00:09:59.519 --> 00:10:04.240
In Bahrain then aligns much more closely to the GDPR model.
00:10:04.559 --> 00:10:12.080
Its terminology and structural approach will be immediately recognizable to organizations who have already worked with the GDPR.
00:10:12.320 --> 00:10:18.080
But from an operational standpoint, this creates a degree of interoperability, like I said before.
00:10:18.159 --> 00:10:34.320
And so anything that you've used with the GDPR, you know, uh in a GDPR aligned governance framework can be extended to Bahrain uh relatively easily, except of course, like we said, uh changing the the nuances for the cultural context.
00:10:35.440 --> 00:10:37.600
So I hope that makes that clear.
00:10:38.080 --> 00:10:48.720
Question four, then for you, Katie, is does Bahrain rely primarily on consent, or are there multiple lawful bases like we see in the GDPR?
00:10:49.519 --> 00:10:50.879
Thank you, Maria.
00:10:51.039 --> 00:10:56.720
So I mean, I suppose as a direct answer to that question, I would say both.
00:10:57.519 --> 00:11:04.320
It's almost like every other regime we've explored so far so far.
00:11:04.559 --> 00:11:18.320
Consent is the cornerstone for lawful processing, but they also make a stipulation that where you're not relying on consent, you can still process data according to a few certain situations.
00:11:19.120 --> 00:11:32.399
So the alternative lawful basis that they provide is basically performance of a contract, compliance with the legal obligation, vital interests, and legitimate interests.
00:11:32.480 --> 00:11:34.879
So that's not very different at all.
00:11:35.679 --> 00:11:40.320
But you do you do need consent for transferring personal data outside the kingdom.
00:11:40.399 --> 00:11:44.879
But we do have a question on that later on, so I won't go that much into that.
00:11:45.600 --> 00:11:47.279
But yeah, yeah.
00:11:47.600 --> 00:11:54.080
It's sounds complicated, but like you say, we'll talk about that further on in the podcast.
00:11:54.720 --> 00:11:58.639
Yeah, it's it's good to note all of these differences.
00:11:59.039 --> 00:12:04.080
Um they they also have special lawful basis for special category data.
00:12:04.399 --> 00:12:06.799
Like for like Article 9, then basically.
00:12:07.200 --> 00:12:07.840
Yeah.
00:12:08.639 --> 00:12:30.879
So what they have is a legal obligation, incapacity to consent, where the data is manifestly made public, pursuing your defense of legal claims, preventative medicine, medical diagnosis, healthcare, unions, charities, public tasks, and here's here's the interesting one, in my opinion.
00:12:31.440 --> 00:12:42.480
You can process special category data where you're detecting inequality based on special category data.
00:12:42.799 --> 00:12:43.200
Interesting.
00:12:43.600 --> 00:12:46.240
If you get what I mean, yeah.
00:12:46.559 --> 00:13:00.639
Yeah, so if there's a if there's a question mark about um inequality, then that's your law, that's your lawful basis for processing that data to investigate whether there is inequality.
00:13:01.279 --> 00:13:01.519
Yeah.
00:13:02.159 --> 00:13:22.159
If it's if it's equality based on their definition, um obviously like the racial, ethnic, religious, so yeah, you you if basically DEI, you know, if you're if you're investigating or kind of implementing DEI, that is your lawful basis.
00:13:22.320 --> 00:13:26.080
So that that's something unique we haven't seen.
00:13:26.559 --> 00:13:31.440
Yeah, DEI, diversity, equality, and what's the third one?
00:13:32.240 --> 00:13:33.440
Inclusion, I suppose.
00:13:34.480 --> 00:13:37.679
Yeah, just I suppose as an example, but yeah.
00:13:38.080 --> 00:13:39.440
Yeah, interesting.
00:13:39.840 --> 00:13:40.159
Okay.
00:13:40.879 --> 00:13:47.200
Um so again, very quite similar, not not exactly the same, but quite similar to the GDPR.
00:13:47.679 --> 00:13:49.440
The bulk of it, the bulk of it's similar.
00:13:49.600 --> 00:14:00.799
The fact that consent is the default is quite similar to all the countries we've explored so far, which is all Gulf regions and um and Asian countries too.
00:14:01.039 --> 00:14:15.759
So they share that similarity, and basically almost everything is the same, but they do have that interesting detection of inequality consideration, um which is worth the note.
00:14:15.840 --> 00:14:25.039
So yeah, it's interesting because that means if they if they have a lawful basis for processing that data, it doesn't necessarily have to be consent.
00:14:25.600 --> 00:14:42.720
So they can investigate they can investigate uh kind of uh allegations of bias or inequality without actually asking the consent of the individual to process their sensitive personal data, which is an interesting approach.
00:14:43.279 --> 00:14:44.480
That is interesting.
00:14:44.879 --> 00:14:45.440
Yeah.
00:14:46.960 --> 00:14:47.120
Okay.
00:14:48.559 --> 00:14:52.559
Yeah, there's something different about Bahrain special category data.
00:14:52.879 --> 00:14:53.679
Absolutely, yeah.
00:14:53.840 --> 00:14:54.080
Yeah.
00:14:54.639 --> 00:15:04.159
Um so the next question for yourself, Maria what data subject rights do individuals have under Bahrain's law?
00:15:04.639 --> 00:15:20.559
Okay, so again, I think we're gonna see a lot of similarity with the GDPR because when we look at the data subject rights under Bahrain's personal data, we see you know, it's a very familiar and a very pragmatic approach to data subject rights.
00:15:21.039 --> 00:15:29.840
Individuals are granted the right to access their personal data, which allows them to understand what information is being processed about them and for what purposes.
00:15:30.399 --> 00:15:37.440
But they also have the right to request correction if there's any inaccuracies or incomplete data and that's being stored about them.
00:15:37.840 --> 00:15:42.240
And this is an important mechanism for maintaining the quality and fairness of processing.
00:15:42.480 --> 00:15:48.159
And in addition, individuals, individuals can object to certain types of processing, like in the GDPR.
00:15:48.480 --> 00:15:57.679
But this is particularly relevant where processing is based on legitimate interests or where there may be an imbalance between the organization and the individual.
00:15:57.919 --> 00:16:00.480
So again, very similar to the GDPR there.
00:16:00.799 --> 00:16:12.480
But there is also a specific right to object to direct marketing, reflecting a clear recognition of the risks associated with unsolicited communication and profiling activities.
00:16:12.879 --> 00:16:15.200
So again, they take the profiling quite seriously.
00:16:16.000 --> 00:16:20.960
From a comparative perspective, the GDPR provides a more expansive suite of rights.
00:16:21.440 --> 00:16:34.399
In addition to access and rectification, it includes rights such as erasure, the so-called right to be forgotten, as well as data portability, which enables individuals to move their data from one service to another.
00:16:34.960 --> 00:16:45.279
These rights, these additional rights reflect the GDPR's kind of broader ambition to give individuals a higher degree of control over their personal data in the digital economy.
00:16:46.159 --> 00:17:02.879
From an operational perspective, what this means is that organizations adopting a global governance model can often use their GDPR high watermark in other jurisdictions in terms of rights management and offering uh the rights to their to their clients.
00:17:03.440 --> 00:17:23.599
However, they should also bear in mind that they still need to tailor their processes to reflect jurisdiction-specific nuances, as we've said before, and this is this happens in most jurisdictions, particularly in how rights are exercised, how they're responded to, and how they're enforced at a kind of a local level.
00:17:24.640 --> 00:17:42.160
So like when we're comparing the rights under the GDPR and Bahrain, the right to be informed is very strong under the GDPR, where it's kind of it's more or less implied, um, but not specifically called out under the uh Bahrain law.
00:17:42.240 --> 00:17:49.359
But the right to access, the right to rectification, and the right to erasure are very similar in both uh frameworks.
00:17:49.680 --> 00:18:06.240
But when you come to the right to restrict processing, again the GDPR trumps the Bahrain law because in the Bahrain law it's there, but it's not specific as it is, uh not as specific as it is um in the GDPR under Article 18.
00:18:07.279 --> 00:18:17.920
The right to data portability uh in the GDPR Article 20, um there's no explicit right uh to data portability with the Bahrain law.
00:18:18.480 --> 00:18:37.920
And uh so basically we still have the right to object, we have the right to uh object to direct marketing as well under the Bahrain law, but um the right to automated decision making or profiling is is present, but it's not as uh strong or expansive as the GDPR.
00:18:38.400 --> 00:18:42.640
And then the right to withdraw consent and the right to launch a complaint as well are kind of similar.
00:18:42.880 --> 00:18:53.759
So you know there are a few exceptions there, but in general, you know, the rights uh under the Bahrain law are very similar to the rights under the GDPR.
00:18:54.480 --> 00:19:10.400
So um now regarding supervisory authorities, Katie, my question for you is who oversees compliance with uh under the the Bahrain law uh thanks Maria.
00:19:10.720 --> 00:19:36.559
So the the Bahraini Authority is the personal data protection authority, and they're actually overseen by the Minister of Justice, who basically is a check on their work, basically ensures their overall harmonization with the rest of Bahrain's legal system, and make sure they're carrying out their duties too.
00:19:36.880 --> 00:20:01.200
So they have a long list of duties, just a couple of them, obviously overseeing compliance, inspecting data controllers, informing and educating the public, they accredit the well, this is uh related to a question that we haven't asked yet, but accrediting the data protection guardians, managing and investigating complaints.
00:20:01.680 --> 00:20:05.039
So, yeah, a lot of it, a lot of it is very similar.
00:20:05.279 --> 00:20:09.599
Uh, a couple of notes just about enforcement in particular.
00:20:09.920 --> 00:20:19.200
Civil compensation is possible for breaches for any individuals have incurred damage arising from a data controller.
00:20:19.680 --> 00:20:28.559
And very interestingly and uniquely, there's possible criminal penalties for violations of certain parts of this law.
00:20:28.880 --> 00:20:30.000
Oh gosh.
00:20:30.240 --> 00:20:30.880
Yeah.
00:20:31.200 --> 00:20:38.400
So and is that on the behalf of the controller, so the controller can have criminal charges taken against them, is it?
00:20:38.880 --> 00:21:00.720
Honestly, I would say perhaps it perhaps the data protection guardian, or if they could maybe look at the chain of causation and figure out, you know, if the data protection guardian perhaps advised against something and someone went ahead and done it.
00:21:02.160 --> 00:21:05.359
Uh that's a that's an imagined scenario.
00:21:05.519 --> 00:21:07.359
Um I'm actually not sure.
00:21:07.519 --> 00:21:08.880
I'll t I'll tell you what it says.
00:21:09.039 --> 00:21:10.240
Uh see what you think.
00:21:10.400 --> 00:21:12.160
It's article 58.
00:21:12.799 --> 00:21:23.359
It says a person shall be liable to imprisonment for a term not exceeding one year or a fine in the following circumstances.
00:21:24.720 --> 00:21:27.359
So I won't go through them all.
00:21:27.440 --> 00:21:42.079
There's a lot, there's a list um of over over half a dozen, but basically contraventions of the uh transfers of personal data abroad.
00:21:42.640 --> 00:21:48.160
Um where you process personal data.
00:21:48.319 --> 00:21:59.279
This is related to another question, but where you process personal data without uh notifying the authority uh of authorization, which again we're going to talk about later.
00:22:00.160 --> 00:22:03.279
So my interpretation would be that it's something blatant.
00:22:03.440 --> 00:22:07.200
So if you blatantly disregard the law, then you could yeah.
00:22:07.440 --> 00:22:07.839
Yeah.
00:22:08.480 --> 00:22:08.720
Yeah.
00:22:08.880 --> 00:22:10.400
Like here here's another one.
00:22:10.559 --> 00:22:20.160
If you withhold from the authority information records or documents that the authority should have access to to carry out its duties.
00:22:20.400 --> 00:22:27.200
So if you obstruct an investigation, if you delay their inspectors in an ongoing investigation.
00:22:28.079 --> 00:22:31.279
Um okay, so that makes sense.
00:22:31.599 --> 00:22:32.799
It's yeah, it is blatant.
00:22:32.880 --> 00:22:36.160
It is, yeah, you're it is a blatant disregard.
00:22:36.480 --> 00:22:38.240
Yeah, blatant disregard, yeah, yeah.
00:22:38.400 --> 00:22:38.480
Okay.
00:22:38.960 --> 00:22:43.279
So that's interesting though that they would feel the need to actually include that.
00:22:44.079 --> 00:22:44.400
Yeah.
00:22:44.880 --> 00:23:13.920
It's again, it's it can be quite tricky whenever we go through so many things and maybe 75 to 90 percent of it is quite similar to the GDPR, quite similar to other regimes, and then it's just you know, but you really have to pay attention to the to the differences because that's where you know you can rattle off all the lawful bases and all the rights, but you know, the point where you get tripped up where one thing's different can be quite important.
00:23:14.319 --> 00:23:25.839
Yes, so you can maybe because you think you know the GDPR, you can feel quite confident that you know we should be okay in other jurisdictions, but like you say, it's the nuances that could really trip you up and get you into the city.
00:23:25.920 --> 00:23:26.240
For sure.
00:23:26.559 --> 00:23:26.799
Yeah.
00:23:27.039 --> 00:23:27.519
Yeah.
00:23:28.240 --> 00:23:29.119
Yeah, that's true.
00:23:29.359 --> 00:23:30.799
And that's a big nuance.
00:23:31.279 --> 00:23:32.960
Yeah, exactly.
00:23:47.200 --> 00:24:02.000
So we'll we'll go on to question seven for yourself, Maria, and it's about well, what what we understand, what I touched mentioned earlier, what we understand is data protection officers.
00:24:02.160 --> 00:24:09.759
So does Bahrain require organizations to appoint someone responsible for privacy compliance?
00:24:10.480 --> 00:24:11.440
Thanks, Katie.
00:24:11.680 --> 00:24:19.359
So Bahrain's law also introduces a role that is very similar to the data protection officer that we have in the GDPR.
00:24:19.519 --> 00:24:19.839
Okay.
00:24:20.480 --> 00:24:24.160
It's similar, but again, the the terminology is different.
00:24:24.319 --> 00:24:30.720
They call this individual the data protection guardian, as you mentioned in your previous uh answer.
00:24:31.119 --> 00:24:36.960
And the role sits at the center of an organization's privacy governance framework, very similar to the DPO.
00:24:37.519 --> 00:24:53.279
Um, the data protection guardian is responsible for monitoring compliance with the law, ensuring that internal policies and procedures are aligned with the regulatory requirements, and that data protection is embedded into the day-to-day operations, again, very similar to the DPO.
00:24:53.680 --> 00:25:06.720
They also act as a key point of contact with the regulator, facilitating communication, responding to inquiries, and supporting any kind of supervisory or investigative processes that may take place.
00:25:07.279 --> 00:25:15.839
They oversee broader governance practices very often, ensuring that accountability is not just documented, but is actually operationalized across the organization.
00:25:16.160 --> 00:25:18.559
Again, very similar to the DPO.
00:25:19.119 --> 00:25:25.039
When we compare this to other frameworks, the closest equivalent would be that the DPO under the GDPR.
00:25:25.519 --> 00:25:35.839
The DPO has a similar independent oversight role with responsibilities around monitoring compliance, advising on obligations, and acting as a liaison with the supervisory authorities.
00:25:36.240 --> 00:25:45.200
The emphasis in both regimes is on embedding expertise within the organization to ensure continuous rather than reactive compliance.
00:25:45.359 --> 00:25:45.680
Okay.
00:25:47.039 --> 00:25:50.799
Now, uh again, I compare this to the DPDP Act.
00:25:50.880 --> 00:25:53.359
Uh in India, we see something slightly different.
00:25:53.519 --> 00:26:00.240
So the data protection officer is only mandatory for what was termed significant data produceries.
00:26:00.319 --> 00:26:04.960
And we discussed those in our uh in our podcast about um uh India.
00:26:05.279 --> 00:26:13.359
And that means the obligation is risk-based and not universally applied, like in these two exact r and in the Bahrain.
00:26:13.599 --> 00:26:22.640
And this reflects a more targeted model of governance, uh focusing on regulatory expectations and on the organization with a higher impact or scale.
00:26:22.880 --> 00:26:31.759
Okay, so we're talking in India, it was more, you know, the higher the processing, the more inclinated inclined you might be to have um a DPO.
00:26:32.319 --> 00:26:44.640
Whereas, you know, with uh with the GDPR, Bahrain is very similar to the GDPR in that you know, any kind of personal data processing would indicate that you would need um somebody within your organization like a DPO.
00:26:45.759 --> 00:26:57.839
From an organizational perspective, the takeaway is that while the titles may differ, so you have the data protection guardian and you have the data protection officer, the underlying functions are they converge kind of globally.
00:26:58.240 --> 00:27:07.200
Organizations need a clearly defined role, responsible for privacy oversight, regulatory engagement, a practical implementation of governance frameworks.
00:27:07.519 --> 00:27:19.519
And for those already operating under the GDPR, extending the DPO function to cover Bahrain is often a natural and efficient approach, provided the local requirements are properly understood.
00:27:19.599 --> 00:27:28.319
And again, we're looking there at the the nuances, but you know, the data data protection guardian a very similar role to what we have under the GDPR.
00:27:29.680 --> 00:27:34.079
So next question is about cross-border transfers, and it's for you, Katie.
00:27:34.720 --> 00:27:39.039
How does Bahrain regulate international data transfers?
00:27:39.440 --> 00:27:40.559
Thank you, Maria.
00:27:40.720 --> 00:27:54.240
So transfers are permitted to countries they're permitted with basically no complications to countries that are itemized in a list in one of their decrees, which we talked about earlier.
00:27:54.400 --> 00:28:08.000
So it's decree order number 42 of 2022 on transfers, and they have 73 countries listed as giving an adequate level of protection.
00:28:08.160 --> 00:28:09.599
They also have another route.
00:28:09.759 --> 00:28:21.440
If you want to transfer to a country not on that list, you need the authorization of the authority, and that can be conditional on certain measures that you have in place.
00:28:21.839 --> 00:28:28.640
So where you're transferring via authorization, you need to do it according to a contract.
00:28:28.720 --> 00:28:33.119
And they have listed a few things that need to be itemized in the contract.
00:28:34.160 --> 00:28:42.720
So obviously, they need to stipulate this exact scope of the processing, they need to follow data minimization and storage limitation.
00:28:43.279 --> 00:28:46.720
The data needs to be accurate, relevant, and up to date.
00:28:46.960 --> 00:28:52.240
They need to demonstrate that they have technical and organizational measures to keep it safe.
00:28:52.559 --> 00:28:58.319
And they also need to give the data subject a fair processing notice that lets them know about the transfer.
00:28:59.200 --> 00:29:10.079
And they they have to make sure that whatever processor or joint controller, whoever it is in the other country, can help facilitate data subject's rights.
00:29:10.319 --> 00:29:23.839
So it is very similar to the GDPR, like they have their list of 73 adequate countries, and then they have their obligation on the controller to bring in safeguards.
00:29:24.400 --> 00:29:33.119
Otherwise, so it's it's quite like the uh GDPR, again, like the Indian one, it's a bit opposite.
00:29:33.279 --> 00:29:45.599
They had they didn't say, well, we have a list of adequate countries, we have a list of blacklisted countries, and then Qatar is a bit more strict that they they do need approval.
00:29:45.759 --> 00:29:52.079
So I'd say of everything we've seen so far, this is definitely one of the closest to the GDPR.
00:29:52.480 --> 00:29:54.799
Okay, and it's kind of like a whitelist as well, isn't it?
00:29:54.880 --> 00:29:56.880
That as opposed to a blacklist that India has.
00:29:56.960 --> 00:29:57.279
Yeah.
00:29:57.519 --> 00:29:58.000
Yeah.
00:29:58.319 --> 00:29:59.279
Very good.
00:30:00.240 --> 00:30:03.599
So yeah, that's cross-border transfers.
00:30:03.839 --> 00:30:08.640
I will move on uh here to question nine for yourself, Maria.
00:30:09.039 --> 00:30:14.960
What security obligations do organizations have when they're processing personal data?
00:30:15.759 --> 00:30:17.519
So when thanks for that, Katie.
00:30:17.599 --> 00:30:32.960
So when we turn to security obligations under Bahrain's personal data protection law, we see a clear emphasis on the need for organizations to move beyond just policy and like they really kind of require you know practical application of security.
00:30:33.119 --> 00:30:49.759
Uh, controllers are required to implement appropriate technical security measures, like in the GDPR, and these would include things like encryption, access controls, and system monitoring to ensure that personal data is protected against unauthorized access, loss or misuse.
00:30:50.240 --> 00:30:54.319
Uh, but most importantly, the law doesn't stop at technology.
00:30:54.480 --> 00:30:58.160
There's also a strong expectation around organizational safeguards.
00:30:58.319 --> 00:31:12.240
This means putting in place internal policies, staff training, role-based access controls, and you know, in general, just governance structures that ensure that data protection is consistently applied across the organization.
00:31:12.319 --> 00:31:16.160
So, again, very much back to the GDPR kind of approach there.
00:31:16.400 --> 00:31:23.440
Um, in other words, security is not just an IT issue, it's an organizational responsibility.
00:31:23.759 --> 00:31:28.319
Um, confidentiality protections are another key component.
00:31:28.480 --> 00:31:40.720
Organisations must ensure that personal data is only accessible to those who are authorised to process it and that appropriate controls are in place to prevent accidental or unlawful disclosure.
00:31:41.039 --> 00:31:56.960
From a comparative perspective, this aligns very closely with Article 32 of the GDPR, which requires, as we know, organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
00:31:57.920 --> 00:32:17.599
The language and intent are remarkably consistent, again, reflecting that broader global convergence in privacy governance is important to Bahrain and making it easier for organizations to port their existing governance structure to Bahrain when moving into that jurisdiction.
00:32:17.839 --> 00:32:32.880
So we like we've looked at the DPDP Act in India, um, and that also uh incorporates security obligations, um, and they kind of require their data fiduciaries to implement reasonable safeguards to prevent personal data breaches.
00:32:33.039 --> 00:32:38.640
While the wording may be less prescriptive than the GDPR, the underlying expectations is the same.
00:32:38.880 --> 00:32:45.039
Organizations must be able to demonstrate that they have taken active steps to protect personal data.
00:32:45.279 --> 00:33:00.000
So, in that regard, you know, most of the laws that we've looked at so far are similar in that they do expect a level of security around the protection of personal data as well.
00:33:01.039 --> 00:33:14.960
So, from an operational standpoint, there is this is one of the clearest areas of global alignment, security governance, combining technical controls, organizational measures, and accountability mechanisms.
00:33:15.119 --> 00:33:28.000
It's now kind of became it's become baseline or you know, kind of fundamental to most data protection regimes across the various different jurisdictions that we've been looking at in this podcast.
00:33:28.319 --> 00:33:43.119
For organizations building a global compliance architecture, this is where integration between privacy and security tooling becomes critical, enabling not just compliance on paper but evidence of controls in operation over time.
00:33:43.279 --> 00:33:59.599
And we'll only see that increase as well as we start to see AI being considered by these jurisdictions because, as we know from the EU AI Act, uh AI governance is all about evidence as opposed to just policies and paper-based governance.
00:33:59.759 --> 00:34:11.280
So, so yeah, there's definitely a merge there between data protection and security across various different jurisdictions, and now we're seeing it with AI as well.
00:34:11.440 --> 00:34:13.280
So, yeah.
00:34:13.840 --> 00:34:17.760
Okay, so moving on to question 10 then uh for you, Katie.
00:34:18.159 --> 00:34:30.000
Are there any unique attributes to the law in Bahrain that we that kind of uh sets it apart from other uh jurisdictions that we've been looking at in this podcast series?
00:34:30.480 --> 00:34:32.800
Okay, so thank you for that, Maria.
00:34:32.960 --> 00:34:41.920
There is a bit of a unique attribute within the Bahrain law, which is the concept of prior authorization.
00:34:42.960 --> 00:35:15.119
So Article 15 of the law says that a processor is gonna need written prior authorization from the Ministry of Justice to use automated processing where it draws links between personal data between two different controllers, where they use automated processing of biometric data for the verification of an individual's identity, and where they use CCTV.
00:35:16.000 --> 00:35:19.679
So that's a bit of an interesting one.
00:35:19.840 --> 00:35:32.800
The controllers are going to need to notify the authority who's overseen by the Ministry of Justice for any wholly or partially automated processing operations and for the use of CCTV.
00:35:33.440 --> 00:35:49.039
So where authorization is granted, they have a few considerations that they have to follow, which are quite similar to the technical and organizational measures and the kind of data protection principles as well.
00:35:49.119 --> 00:36:29.519
But I suppose they just need to be able to demonstrate proof that they will uphold these four points when they complete this processing activity, and the four points are transparency, in which includes informing the data subjects of the exact use of the data, the second point is purpose limitation, the third point is basically access controls on a need-to-know basis for the data, and then the fourth is you need to demonstrate how you're going to facilitate data subject rights.
00:36:29.679 --> 00:36:33.599
So sorry, again, when was that when is that required?
00:36:33.840 --> 00:36:35.760
What scenario is that required?
00:36:36.159 --> 00:36:43.599
Okay, so it's required if you're using automated processing and CCTV.
00:36:43.679 --> 00:36:59.599
The automated processing does have a couple of conditions like where you use automated processing using biometric data, or where you use automated processing that links personal data between different controllers.
00:36:59.679 --> 00:37:04.079
So I would say maybe credit agencies might be doing that.
00:37:04.480 --> 00:37:04.719
Okay.
00:37:09.199 --> 00:37:18.480
Yeah, combine a lot of data from even broker, brokers and stuff would get a lot of data from different from different sources.
00:37:18.719 --> 00:37:47.119
So basically, if you put data from different sources into automated decision making process, you're going to need to write out the bat explain how you're going to be transparent, how there's going to be no scoop creep, that authorization is restricted to a need-to-no basis, and how you're going to facilitate data subject rights.
00:37:47.199 --> 00:37:49.440
So it's it's less after the fact.
00:37:49.519 --> 00:38:06.480
I mean, technically, people could be processing data contrary to the law, but the authority would only find out through an investigation, whereas in this situation you need to you need to show that you're compliant before you even start that processing activity.
00:38:06.880 --> 00:38:10.800
That's good because it makes people think and it makes them get a plan together.
00:38:10.960 --> 00:38:19.679
So when they have a plan together, they're more inclined to actually follow the plan than like you say, you know, what are we supposed to do now that we've been caught or something like that, you know?
00:38:19.840 --> 00:38:20.159
Yeah.
00:38:20.639 --> 00:38:31.440
Um as well, I've just a little note here on the difference between the GDPR and the Bahrain personal data protection law on automated decision making, now that you mention it.
00:38:31.599 --> 00:38:35.440
So the difference lies in the scope and the strength and structures of the right.
00:38:35.599 --> 00:38:58.159
Under the GDPR, which is we know Article 22, individuals have a clear, a clearly defined and standalone right not to subject, not to be subject to decisions based solely on automated processing, including profiling, which, like I think that's you know, you've described there, uh, where those decisions produce legal or similarly significant effects.
00:38:58.400 --> 00:39:07.840
This right is supposed supported by explicit safeguards, such as the right to obtain human intervention, express one's point of view, and contest the decision.
00:39:08.000 --> 00:39:18.079
In contrast, the Bahrain PDPL recognises concerns around automated decision making, but does not, but does so in a more limited and less codified manner.
00:39:18.239 --> 00:39:30.559
Uh the right is typically framed around the ability to object to decisions that cause material or moral harms rather than as a broad prohibition on solely automated decisions.
00:39:30.639 --> 00:39:32.880
So it's more like on a case-by-case basis.
00:39:33.039 --> 00:39:49.199
As a result, Bahrain's approach is more reactive and harm-based, whereas the GDPR establishes a proactive principle-driven control over automated decision-making, making it significantly more operationally demanding for organizations.
00:39:49.440 --> 00:40:02.960
But like you say there, um, it's interesting because it's the opposite in that exception there that you give when considering you know uh CCTV and so on.
00:40:03.119 --> 00:40:17.119
The Bahrain law is more uh specific and requires preparation to meet the law or you know, um accountability to meet the requirements of the law than the GDPR.
00:40:17.199 --> 00:40:18.320
So that's interesting.
00:40:19.039 --> 00:40:19.679
It is.
00:40:20.079 --> 00:40:31.119
And also to achieve that prior authorization they need to um submit a DPIA that they undertook.
00:40:31.360 --> 00:40:33.840
So Okay, interesting.
00:40:34.000 --> 00:40:34.639
Yeah.
00:40:35.199 --> 00:40:50.719
So there is accountability there's quite a lot of accountability around, you know, even though the GDPR would be seen as kind of more of an established right around automated decision making, there is still significant accountability within the the Bahrain law as well.
00:40:51.119 --> 00:40:52.320
Yeah, for sure.
00:40:52.559 --> 00:41:05.199
I mean it may be a bit more procedural with stuff like CCTV, because if you're under the GDPR, you just need to complete your DPIA and kind of work from there.
00:41:06.159 --> 00:41:20.239
But here, if you want to use CCTV, you have to do the DPIA, and you know, I don't know how long that process of getting prior authorization would take, you know, if you're gonna be waiting or anything, but yeah.
00:41:21.360 --> 00:41:25.519
It forces organizations to think about their governance, yeah.
00:41:25.840 --> 00:41:26.639
Which is good.
00:41:27.119 --> 00:41:33.280
So move on to the next question for yourself, Maria, which is still kind of on the same topic.
00:41:33.519 --> 00:41:46.559
So does Bahrain have a specific AI governance framework, or are AI systems primarily regulated through existing law and regulations?
00:41:47.360 --> 00:41:48.159
Thanks, Katie.
00:41:48.480 --> 00:41:59.840
Well, when we look at AI governance of Bahrain, it's important to note that at least for now, there's no standalone AI Act equivalent like to the EU AI Act that we have in the European Union.
00:42:00.079 --> 00:42:06.480
Instead, AI governance is being kind of addressed through a combination of existing legal and policy instruments.
00:42:06.719 --> 00:42:17.199
First, like you have the data protection obligations under the personal data law that we've been looking at in this podcast, and that plays a kind of central role when it when considering AI.
00:42:17.760 --> 00:42:30.800
So, like where AI systems process personal data, organizations must comply with the principles such as lawfulness, fairness, transparency, and accountability, which goes a long way with the AI systems as well.
00:42:30.880 --> 00:42:39.920
You know, effectively they're using the privacy law as a kind of a proxy for governing various different aspects of AI at the moment, anyway.
00:42:40.079 --> 00:42:45.840
Then sectoral regulations also come into play in areas such as finance or telecommunications.
00:42:46.000 --> 00:42:57.360
Regulators may impose additional requirements around risk management, oversight, system integrity, which indirectly shape how AI is deployed within these sectors.
00:42:57.599 --> 00:43:10.800
And then, third, Bahrain's national digital economy and innovation strategies provide a broad kind of policy framework that can also encompass AI adoption.
00:43:11.119 --> 00:43:20.880
So there this framework kind of encourages organizations to use AI while signaling expectations around responsible and secure use.
00:43:21.360 --> 00:43:25.840
When we compare this globally, uh the contrast is quite striking.
00:43:26.000 --> 00:43:32.639
The EU is moving towards a dedicated risk-based regulatory model through the EU AI Act.
00:43:32.719 --> 00:43:36.960
That's again industry agnostic and it cuts across all industries.
00:43:37.199 --> 00:43:46.239
And this AI Act, like the EU AI Act, classifies AI systems according to their level of risk and imposes corresponding obligations.
00:43:46.559 --> 00:43:50.880
This represents a more explicit and structured approach to AI governance.
00:43:51.280 --> 00:43:59.519
We saw in the UAE a slightly different model again, less focused on a single legislative instrument and more on a like on.
00:44:00.159 --> 00:44:09.119
National AI strategies and coordinated governance initiatives, and these would have been supported by sectoral guidance and regulatory activity.
00:44:09.920 --> 00:44:25.440
India is still in a formative phase when it comes to AI, it's actively developing its AI governance approach, but for now it relies largely on existing regulatory frameworks such as its data protection law to manage AI risks.
00:44:26.559 --> 00:44:43.039
So in Bahrain, from a per operational perspective, what this tells us is that AI governance is currently evolving along different trajectories, not just in Bahrain, but across the jurisdictions that we've kind of seen and we've looked at in the podcast.
00:44:43.440 --> 00:44:54.639
In Bahrain, there's no kind of dedicated AI law, and that kind of forces organizations to assume an absence of regulation.
00:44:55.119 --> 00:45:19.599
Instead, in Bahrain, they need to interpret and apply existing frameworks like, like I said, the data protection law and sectoral laws, and they have to apply these laws to various different AI use cases that they would encounter during their work and to make sure that governance is proactive and risk-aware and adaptable as more formal AI regulation inevitably comes down the line.
00:45:19.840 --> 00:45:28.320
But for the time being, they do rely heavily on industry regulation and their data protection law.
00:45:29.280 --> 00:45:34.960
So uh sticking with AI, Katie, this is our last question, and it's for you.
00:45:35.440 --> 00:45:45.039
Given the increasing role of AI in digital services, do you think Bahrain's privacy law provides a sufficient foundation for governing AI systems?
00:45:46.159 --> 00:45:48.239
Thank you for that, Maria.
00:45:48.960 --> 00:46:12.400
Um I think I would answer it going back a bit to what you said in that there are aspects of their current privacy law landscape that have an effect on AI, but at the end of the day, they don't have something specifically for AI as a use case.
00:46:12.559 --> 00:46:54.480
You know, it kind of is caught here and there by different by different existing laws and maybe regulatory standards, but they don't have they don't have something that might address in hard law anyway everything that you might be concerned about in AI, but they do have a couple of soft instruments that I think could form a foundation like what you were asking about, could could be a good foundation, or at least the beginnings of a foundation for governing AI systems if they continue to develop this.
00:46:54.880 --> 00:47:24.480
They have a number of core ethical principles guiding AI use and adoption, published by their information and e-government authority, because they're part they're part of the Gulf Cooperation Council, and they kind of said, well, if you're gonna continue to be part of the Gulf Cooperation Council, everyone is gonna have to adopt a certain amount of policies to govern AI, at least to start with.
00:47:24.639 --> 00:47:27.119
So we've seen that in Qatar as well.
00:47:27.360 --> 00:47:33.039
They had some very nice, uh very nicely laid out infographics and stuff about it.
00:47:33.440 --> 00:47:58.320
But yeah, so the core principles that they've put out is human oversight, safety and security, justice, equity and non-discrimination, privacy and data protection, transparency and explainability, accountability, awareness and education, integrity, sustainability, inclusion and diversity, and international cooperation.
00:47:59.440 --> 00:48:03.280
So isn't it?
00:48:03.519 --> 00:48:05.920
Yeah, yeah, it's quite comprehensive, isn't it?
00:48:06.480 --> 00:48:07.519
It's it's long, yeah.
00:48:07.599 --> 00:48:10.480
It was longer than I thought than I was expecting it to be.
00:48:10.639 --> 00:48:25.679
Um and they have they have more on it than just, you know, it's not just the list alone, they have more guidance um to go with it, but I know it's not hard law, but uh as a as guidance.
00:48:26.320 --> 00:48:28.239
Yeah, it's comprehensive.
00:48:28.320 --> 00:48:28.559
Yeah.
00:48:29.039 --> 00:48:31.039
It could be a sufficient foundation.
00:48:31.199 --> 00:48:38.000
Um And like you say, it gives guidance until hard law come you know comes down the line.
00:48:38.719 --> 00:48:39.679
Yeah, for sure.
00:48:39.920 --> 00:48:46.880
And like especially if this is kind of if people internalize this in practice Yeah.
00:48:47.519 --> 00:48:57.920
And I think if they fall in line like they have with the with their data protection law and they want to kind of follow international standards, that that's a good starting point.
00:48:58.079 --> 00:49:01.920
That you know, comprehensive list of recommendations, you know, guidance.
00:49:03.039 --> 00:49:04.079
I I agree.
00:49:04.400 --> 00:49:12.480
That those principles and the guitar guidance that we seen and I don't know if it was in our last our last podcast episode.
00:49:12.880 --> 00:49:14.000
I think it was, yeah.
00:49:14.320 --> 00:49:23.679
But it's good to see because those are some of the some of the first kind of nationally published official guidelines.
00:49:23.840 --> 00:49:26.559
So it's definitely a stepping stone.
00:49:26.880 --> 00:49:29.039
Yeah, yeah, and it's a sign of things to come.
00:49:29.119 --> 00:49:36.159
And it looks like they are they will stay with the international approach, you know, making it easy for organizations to move into Bahrain.
00:49:36.719 --> 00:49:37.199
Yeah.
00:49:37.360 --> 00:49:39.760
That that was our last question.
00:49:39.920 --> 00:49:50.400
So today we explored Bahrain's personal data protection law, along with a couple of the executive decisions that were issued under it.
00:49:50.639 --> 00:50:03.920
We placed it within the context of the Gulf regional landscape and also compared it to a few broader laws like the GDPR and the Indian law that we had explored before.
00:50:04.239 --> 00:50:23.360
So we seen where it was influenced by the GDPR, where it was influenced by the culture of the Gulf, where it actually is located, and we also did draw a few similarities to the Indian DPDP, which was interesting to see.
00:50:24.480 --> 00:50:35.440
As we've discussed in the past, privacy laws increasingly serve as the foundational layer for broader digital governance, including with emerging issues such as AI.
00:50:35.599 --> 00:50:42.880
And we've seen that as we as our last few questions touched on with Qatar and Bahrain.
00:50:43.280 --> 00:50:52.239
You know, this is, as you said, a sign of what's coming down the line and the principles that countries are taking into mind with things like AI.
00:50:52.320 --> 00:50:55.440
So I think that's it's quite a positive sign.
00:50:56.079 --> 00:51:02.559
So thanks everyone for joining us for this episode of our international privacy law series.
00:51:02.800 --> 00:51:10.079
And we look forward to continuing our journey through global data protection frameworks in the next episode.
00:51:10.400 --> 00:51:11.280
Thanks, Katie.
00:51:11.519 --> 00:51:12.800
Thanks to our listeners.
00:51:13.039 --> 00:51:14.880
See you in the next episode.
00:00:13.839 --> 00:00:21.600
Hello, and welcome back to our podcast series where we explore privacy and data protection laws around the world.
00:00:21.760 --> 00:00:26.079
I'm Katie Birch and I'm joined with my colleague Maria Maloney.
00:00:26.480 --> 00:00:27.280
Hello, everyone.
00:00:27.600 --> 00:00:36.399
In this series, we examine how different jurisdictions regulate personal data and what that means for organizations who operate internationally.
00:00:36.799 --> 00:00:42.000
In the past, we have done Qatar's personal data privacy protection law.
00:00:42.320 --> 00:00:47.200
We covered the UAE federal law and some of their free zones.
00:00:47.439 --> 00:00:53.920
We also done India's data protection law and the Kingdom of Saudi Arabia's.
00:00:54.159 --> 00:01:03.679
But today we are turning our attention to Bahrain's personal data protection law along with its accompanying decisions.
00:01:04.400 --> 00:01:06.159
So as always, I'm joined by Dr.
00:01:06.239 --> 00:01:16.480
Maria Maloney, and together we're going to explore how the framework works, how it compares to the GDPR and its neighboring jurisdictions.
00:01:17.120 --> 00:01:29.840
And so yeah, I'll begin by asking you the first question, Maria, which is where does Bahrain's personal data protection law sit within the broader global privacy landscape?
00:01:30.319 --> 00:01:31.120
Thanks, Katie.
00:01:31.439 --> 00:01:32.959
That's an interesting question.
00:01:33.200 --> 00:01:40.640
So Bahrain enacted its personal data protection law, which is called Law Number 30 of 2018.
00:01:40.799 --> 00:01:44.400
And it came into force in August 9, 2019.
00:01:44.640 --> 00:02:02.319
And there was that this was a significant step for the kingdom, the Kingdom of Bahrain, and it marked its transition towards a comprehensive, standalone kind of data protection regime, rather than what they had relied on previously, which would have been kind of fragmented sectoral rules.
00:02:02.560 --> 00:02:06.400
So this was the one that kind of consolidated it across industries.
00:02:06.640 --> 00:02:17.280
What's particularly notable about this law is that Bahrain was one of the earlier adopters of a full privacy framework in the Gulf region.
00:02:17.360 --> 00:02:23.439
So you're talking back in 2019, the GDPR had just been in force like one year.
00:02:24.479 --> 00:02:44.479
So alongside jurisdictions like the DIFC that's in the United Arab Emirates, and we covered that in the free zones in one of our podcasts, it positions itself as a regional leader in recognizing personal data protection as both a regulatory requirement and a trust enabler for digital economies.
00:02:44.560 --> 00:02:58.639
So again, it wants to be like one of the leaders, one of the primary places in the Gulf region where you know people or organizations could come to and expect a good level of data protection for their personal data.
00:02:58.960 --> 00:03:08.319
From a structural perspective, the law clearly reflects a broader global convergence in privacy governance and is heavily influenced by the GDPR principles.
00:03:08.400 --> 00:03:15.919
So we've seen that again in the United Arab Emirates kind of free zones, they were also very heavily influenced by the GDPR.
00:03:16.159 --> 00:03:27.840
We see familiar concepts from the GDPR, such as lawful basis for processing data, data subject rights, accountability obligations, and restrictions on cross-border transfers.
00:03:28.319 --> 00:03:34.639
However, Bahrain has adopted these principles to its own legal and economic context.
00:03:34.800 --> 00:03:45.919
And again, we've seen that in many of our podcasts that they kind of they they borrow from the GDPR, but then they interpret it for their own culture, for their own needs and their own kind of their own context.
00:03:46.159 --> 00:03:58.560
So while the foundations are recognizable and they're kind of GDPR inspired, the operationalization of the law is more flexible and in some areas less prescriptive than the GDPR.
00:03:58.879 --> 00:04:09.919
From an implementation standpoint, this is important because it means organizing organizations operating across jurisdictions can leverage existing GDPR aligned governance frameworks.
00:04:10.000 --> 00:04:18.399
So if you're coming from Europe or if you you you deal with Europe, you can kind of port your you know the existing governance that you have for the GDPR.
00:04:18.480 --> 00:04:29.040
You can you can use a lot of it here when you move to Bahrain, such as their roper structures, their risk assessments, their accountability mechanisms are all very similar to the GDPR.
00:04:29.519 --> 00:04:41.199
But it's still you kind of still need to be mindful of the local nuances, particularly around regulatory oversight, enforcement practices, and specific procedural requirements.
00:04:41.600 --> 00:04:59.120
And we this is not the first time that we've seen this, you know, we're seeing kind of a trend in the Gulf where they you know they they ensure that they have adequacy with the GDPR, they take the principles from the GDPR, but then they kind of they uh adapt them to their own requirements.
00:04:59.360 --> 00:05:07.920
So when you think about it, like the the GDPR came in in 2018, Bahrain came in, their law came in in 2018.
00:05:09.120 --> 00:05:23.279
Um it came in 2018 as well, but it came into force in 2019, you had Qatar in 2016, and then you had the United Arab Emirates coming in in 2021, and then India finally in 2023.
00:05:23.600 --> 00:05:31.279
So when you look at it in that context, it is an earlier uh data protection framework.
00:05:31.920 --> 00:05:48.079
Okay, so Katie, uh my question for you then is when we discussed Qatar the last time, and prior to Qatar we discussed United Arab Emirates, we saw slightly different jurisdictional approaches, and I've just spoken about that as well for Bahrain.
00:05:48.240 --> 00:05:56.240
Um, who does Bahrain's law, data protection law, apply to thank you, uh Maria?
00:05:56.399 --> 00:06:10.319
So it applies to every resident inside the kingdom and businesses inside the kingdom, and anyone who processes data using means or tools situated inside the kingdom.
00:06:10.399 --> 00:06:37.279
So it's a lot more territorially focused than the GDPR, like the GDPR and the Indian DPDP apply to processing that targets European or Indian individuals, whereas from the wording of this law, uh Bahrain national who's not inside the kingdom, it seems that it wouldn't apply to them.
00:06:37.920 --> 00:06:54.959
As for the material scope, it also applies to all processing, whether it's fully partial or non-automatic, to all data when it forms part of a filing system or is intended to form part of a filing system.
00:06:55.120 --> 00:07:03.680
So that's digital and non-digital data because we did see in India that it only applies to the digital data.
00:07:04.079 --> 00:07:04.720
Yeah, exactly.
00:07:04.800 --> 00:07:05.360
Yeah, yeah.
00:07:05.519 --> 00:07:08.079
So it's both like the GDPR essentially.
00:07:08.399 --> 00:07:16.480
Yeah, so in material scope it's like the GDPR, and in territorial scope, it's more like guitar.
00:07:18.079 --> 00:07:18.399
Okay.
00:07:19.920 --> 00:07:29.199
So your question, Maria, what are the what do the core definitions look like in Bahrain's law?
00:07:30.000 --> 00:07:30.879
Thanks, Katie.
00:07:31.199 --> 00:07:45.199
Um essentially at the core of Bahrain's personal data protection law, there are a set of key concepts that will feel very familiar to anyone who's been working with uh privacy frameworks, especially the GDPR.
00:07:45.600 --> 00:07:57.120
These include definitions of personal data, sensitive personal data, which will be special category data under the GDPR, processing, as well as the roles of the data controller and the data processor.
00:07:57.199 --> 00:08:01.120
They're all very similar and they they they exist in the Bahrain law as well.
00:08:01.680 --> 00:08:09.680
Personal data is broadly defined as any information relating to an identifiable individual, and again, very similar to the GDPR there.
00:08:10.079 --> 00:08:24.000
While sensitive personal data captures higher risk categories such as health data, biometric information, religious beliefs, and again, like the GDPR, the this type of data triggers enhanced protections.
00:08:24.560 --> 00:08:36.720
Processing is also defined as a comprehensive way of covering the full life cycle of the data activities, from collection of the data to storage and through to disclosure and deletion.
00:08:36.960 --> 00:08:42.639
Okay, so again, you see the kind of the data lifecycle that would be very similar to the GDPR.
00:08:43.039 --> 00:08:56.639
But from a governance perspective, the distinction between data controllers and data processors is particularly important because controllers determine the purpose and the means of processing while the processor acts on behalf of the controller.
00:08:57.679 --> 00:09:03.200
This mirrors the accountability structures that we see in mature regimes like the GDPR.
00:09:04.000 --> 00:09:09.440
When we step back and compare this to other frameworks, some interesting differences emerge.
00:09:09.759 --> 00:09:26.240
However, the GDPR remains the most detailed and granular framework in terms of definitions and providing a very high level, a high level of legal precision that supports consistent interpretation across the member states.
00:09:27.600 --> 00:09:37.279
We saw in the Indian DPDP Act that they took a different kind of conceptual approach using terminology like the data principle and the data fiduciary.
00:09:37.759 --> 00:09:58.960
So even though the functionality would be similar to the GDPR, the you know the D DPDP Act kind of reframed things and shifted things slightly to kind of place the individual in the core to the to the core of the of the legislation and reflecting kind of principle-based uh kind of um approaches to data protection.
00:09:59.519 --> 00:10:04.240
In Bahrain then aligns much more closely to the GDPR model.
00:10:04.559 --> 00:10:12.080
Its terminology and structural approach will be immediately recognizable to organizations who have already worked with the GDPR.
00:10:12.320 --> 00:10:18.080
But from an operational standpoint, this creates a degree of interoperability, like I said before.
00:10:18.159 --> 00:10:34.320
And so anything that you've used with the GDPR, you know, uh in a GDPR aligned governance framework can be extended to Bahrain uh relatively easily, except of course, like we said, uh changing the the nuances for the cultural context.
00:10:35.440 --> 00:10:37.600
So I hope that makes that clear.
00:10:38.080 --> 00:10:48.720
Question four, then for you, Katie, is does Bahrain rely primarily on consent, or are there multiple lawful bases like we see in the GDPR?
00:10:49.519 --> 00:10:50.879
Thank you, Maria.
00:10:51.039 --> 00:10:56.720
So I mean, I suppose as a direct answer to that question, I would say both.
00:10:57.519 --> 00:11:04.320
It's almost like every other regime we've explored so far so far.
00:11:04.559 --> 00:11:18.320
Consent is the cornerstone for lawful processing, but they also make a stipulation that where you're not relying on consent, you can still process data according to a few certain situations.
00:11:19.120 --> 00:11:32.399
So the alternative lawful basis that they provide is basically performance of a contract, compliance with the legal obligation, vital interests, and legitimate interests.
00:11:32.480 --> 00:11:34.879
So that's not very different at all.
00:11:35.679 --> 00:11:40.320
But you do you do need consent for transferring personal data outside the kingdom.
00:11:40.399 --> 00:11:44.879
But we do have a question on that later on, so I won't go that much into that.
00:11:45.600 --> 00:11:47.279
But yeah, yeah.
00:11:47.600 --> 00:11:54.080
It's sounds complicated, but like you say, we'll talk about that further on in the podcast.
00:11:54.720 --> 00:11:58.639
Yeah, it's it's good to note all of these differences.
00:11:59.039 --> 00:12:04.080
Um they they also have special lawful basis for special category data.
00:12:04.399 --> 00:12:06.799
Like for like Article 9, then basically.
00:12:07.200 --> 00:12:07.840
Yeah.
00:12:08.639 --> 00:12:30.879
So what they have is a legal obligation, incapacity to consent, where the data is manifestly made public, pursuing your defense of legal claims, preventative medicine, medical diagnosis, healthcare, unions, charities, public tasks, and here's here's the interesting one, in my opinion.
00:12:31.440 --> 00:12:42.480
You can process special category data where you're detecting inequality based on special category data.
00:12:42.799 --> 00:12:43.200
Interesting.
00:12:43.600 --> 00:12:46.240
If you get what I mean, yeah.
00:12:46.559 --> 00:13:00.639
Yeah, so if there's a if there's a question mark about um inequality, then that's your law, that's your lawful basis for processing that data to investigate whether there is inequality.
00:13:01.279 --> 00:13:01.519
Yeah.
00:13:02.159 --> 00:13:22.159
If it's if it's equality based on their definition, um obviously like the racial, ethnic, religious, so yeah, you you if basically DEI, you know, if you're if you're investigating or kind of implementing DEI, that is your lawful basis.
00:13:22.320 --> 00:13:26.080
So that that's something unique we haven't seen.
00:13:26.559 --> 00:13:31.440
Yeah, DEI, diversity, equality, and what's the third one?
00:13:32.240 --> 00:13:33.440
Inclusion, I suppose.
00:13:34.480 --> 00:13:37.679
Yeah, just I suppose as an example, but yeah.
00:13:38.080 --> 00:13:39.440
Yeah, interesting.
00:13:39.840 --> 00:13:40.159
Okay.
00:13:40.879 --> 00:13:47.200
Um so again, very quite similar, not not exactly the same, but quite similar to the GDPR.
00:13:47.679 --> 00:13:49.440
The bulk of it, the bulk of it's similar.
00:13:49.600 --> 00:14:00.799
The fact that consent is the default is quite similar to all the countries we've explored so far, which is all Gulf regions and um and Asian countries too.
00:14:01.039 --> 00:14:15.759
So they share that similarity, and basically almost everything is the same, but they do have that interesting detection of inequality consideration, um which is worth the note.
00:14:15.840 --> 00:14:25.039
So yeah, it's interesting because that means if they if they have a lawful basis for processing that data, it doesn't necessarily have to be consent.
00:14:25.600 --> 00:14:42.720
So they can investigate they can investigate uh kind of uh allegations of bias or inequality without actually asking the consent of the individual to process their sensitive personal data, which is an interesting approach.
00:14:43.279 --> 00:14:44.480
That is interesting.
00:14:44.879 --> 00:14:45.440
Yeah.
00:14:46.960 --> 00:14:47.120
Okay.
00:14:48.559 --> 00:14:52.559
Yeah, there's something different about Bahrain special category data.
00:14:52.879 --> 00:14:53.679
Absolutely, yeah.
00:14:53.840 --> 00:14:54.080
Yeah.
00:14:54.639 --> 00:15:04.159
Um so the next question for yourself, Maria what data subject rights do individuals have under Bahrain's law?
00:15:04.639 --> 00:15:20.559
Okay, so again, I think we're gonna see a lot of similarity with the GDPR because when we look at the data subject rights under Bahrain's personal data, we see you know, it's a very familiar and a very pragmatic approach to data subject rights.
00:15:21.039 --> 00:15:29.840
Individuals are granted the right to access their personal data, which allows them to understand what information is being processed about them and for what purposes.
00:15:30.399 --> 00:15:37.440
But they also have the right to request correction if there's any inaccuracies or incomplete data and that's being stored about them.
00:15:37.840 --> 00:15:42.240
And this is an important mechanism for maintaining the quality and fairness of processing.
00:15:42.480 --> 00:15:48.159
And in addition, individuals, individuals can object to certain types of processing, like in the GDPR.
00:15:48.480 --> 00:15:57.679
But this is particularly relevant where processing is based on legitimate interests or where there may be an imbalance between the organization and the individual.
00:15:57.919 --> 00:16:00.480
So again, very similar to the GDPR there.
00:16:00.799 --> 00:16:12.480
But there is also a specific right to object to direct marketing, reflecting a clear recognition of the risks associated with unsolicited communication and profiling activities.
00:16:12.879 --> 00:16:15.200
So again, they take the profiling quite seriously.
00:16:16.000 --> 00:16:20.960
From a comparative perspective, the GDPR provides a more expansive suite of rights.
00:16:21.440 --> 00:16:34.399
In addition to access and rectification, it includes rights such as erasure, the so-called right to be forgotten, as well as data portability, which enables individuals to move their data from one service to another.
00:16:34.960 --> 00:16:45.279
These rights, these additional rights reflect the GDPR's kind of broader ambition to give individuals a higher degree of control over their personal data in the digital economy.
00:16:46.159 --> 00:17:02.879
From an operational perspective, what this means is that organizations adopting a global governance model can often use their GDPR high watermark in other jurisdictions in terms of rights management and offering uh the rights to their to their clients.
00:17:03.440 --> 00:17:23.599
However, they should also bear in mind that they still need to tailor their processes to reflect jurisdiction-specific nuances, as we've said before, and this is this happens in most jurisdictions, particularly in how rights are exercised, how they're responded to, and how they're enforced at a kind of a local level.
00:17:24.640 --> 00:17:42.160
So like when we're comparing the rights under the GDPR and Bahrain, the right to be informed is very strong under the GDPR, where it's kind of it's more or less implied, um, but not specifically called out under the uh Bahrain law.
00:17:42.240 --> 00:17:49.359
But the right to access, the right to rectification, and the right to erasure are very similar in both uh frameworks.
00:17:49.680 --> 00:18:06.240
But when you come to the right to restrict processing, again the GDPR trumps the Bahrain law because in the Bahrain law it's there, but it's not specific as it is, uh not as specific as it is um in the GDPR under Article 18.
00:18:07.279 --> 00:18:17.920
The right to data portability uh in the GDPR Article 20, um there's no explicit right uh to data portability with the Bahrain law.
00:18:18.480 --> 00:18:37.920
And uh so basically we still have the right to object, we have the right to uh object to direct marketing as well under the Bahrain law, but um the right to automated decision making or profiling is is present, but it's not as uh strong or expansive as the GDPR.
00:18:38.400 --> 00:18:42.640
And then the right to withdraw consent and the right to launch a complaint as well are kind of similar.
00:18:42.880 --> 00:18:53.759
So you know there are a few exceptions there, but in general, you know, the rights uh under the Bahrain law are very similar to the rights under the GDPR.
00:18:54.480 --> 00:19:10.400
So um now regarding supervisory authorities, Katie, my question for you is who oversees compliance with uh under the the Bahrain law uh thanks Maria.
00:19:10.720 --> 00:19:36.559
So the the Bahraini Authority is the personal data protection authority, and they're actually overseen by the Minister of Justice, who basically is a check on their work, basically ensures their overall harmonization with the rest of Bahrain's legal system, and make sure they're carrying out their duties too.
00:19:36.880 --> 00:20:01.200
So they have a long list of duties, just a couple of them, obviously overseeing compliance, inspecting data controllers, informing and educating the public, they accredit the well, this is uh related to a question that we haven't asked yet, but accrediting the data protection guardians, managing and investigating complaints.
00:20:01.680 --> 00:20:05.039
So, yeah, a lot of it, a lot of it is very similar.
00:20:05.279 --> 00:20:09.599
Uh, a couple of notes just about enforcement in particular.
00:20:09.920 --> 00:20:19.200
Civil compensation is possible for breaches for any individuals have incurred damage arising from a data controller.
00:20:19.680 --> 00:20:28.559
And very interestingly and uniquely, there's possible criminal penalties for violations of certain parts of this law.
00:20:28.880 --> 00:20:30.000
Oh gosh.
00:20:30.240 --> 00:20:30.880
Yeah.
00:20:31.200 --> 00:20:38.400
So and is that on the behalf of the controller, so the controller can have criminal charges taken against them, is it?
00:20:38.880 --> 00:21:00.720
Honestly, I would say perhaps it perhaps the data protection guardian, or if they could maybe look at the chain of causation and figure out, you know, if the data protection guardian perhaps advised against something and someone went ahead and done it.
00:21:02.160 --> 00:21:05.359
Uh that's a that's an imagined scenario.
00:21:05.519 --> 00:21:07.359
Um I'm actually not sure.
00:21:07.519 --> 00:21:08.880
I'll t I'll tell you what it says.
00:21:09.039 --> 00:21:10.240
Uh see what you think.
00:21:10.400 --> 00:21:12.160
It's article 58.
00:21:12.799 --> 00:21:23.359
It says a person shall be liable to imprisonment for a term not exceeding one year or a fine in the following circumstances.
00:21:24.720 --> 00:21:27.359
So I won't go through them all.
00:21:27.440 --> 00:21:42.079
There's a lot, there's a list um of over over half a dozen, but basically contraventions of the uh transfers of personal data abroad.
00:21:42.640 --> 00:21:48.160
Um where you process personal data.
00:21:48.319 --> 00:21:59.279
This is related to another question, but where you process personal data without uh notifying the authority uh of authorization, which again we're going to talk about later.
00:22:00.160 --> 00:22:03.279
So my interpretation would be that it's something blatant.
00:22:03.440 --> 00:22:07.200
So if you blatantly disregard the law, then you could yeah.
00:22:07.440 --> 00:22:07.839
Yeah.
00:22:08.480 --> 00:22:08.720
Yeah.
00:22:08.880 --> 00:22:10.400
Like here here's another one.
00:22:10.559 --> 00:22:20.160
If you withhold from the authority information records or documents that the authority should have access to to carry out its duties.
00:22:20.400 --> 00:22:27.200
So if you obstruct an investigation, if you delay their inspectors in an ongoing investigation.
00:22:28.079 --> 00:22:31.279
Um okay, so that makes sense.
00:22:31.599 --> 00:22:32.799
It's yeah, it is blatant.
00:22:32.880 --> 00:22:36.160
It is, yeah, you're it is a blatant disregard.
00:22:36.480 --> 00:22:38.240
Yeah, blatant disregard, yeah, yeah.
00:22:38.400 --> 00:22:38.480
Okay.
00:22:38.960 --> 00:22:43.279
So that's interesting though that they would feel the need to actually include that.
00:22:44.079 --> 00:22:44.400
Yeah.
00:22:44.880 --> 00:23:13.920
It's again, it's it can be quite tricky whenever we go through so many things and maybe 75 to 90 percent of it is quite similar to the GDPR, quite similar to other regimes, and then it's just you know, but you really have to pay attention to the to the differences because that's where you know you can rattle off all the lawful bases and all the rights, but you know, the point where you get tripped up where one thing's different can be quite important.
00:23:14.319 --> 00:23:25.839
Yes, so you can maybe because you think you know the GDPR, you can feel quite confident that you know we should be okay in other jurisdictions, but like you say, it's the nuances that could really trip you up and get you into the city.
00:23:25.920 --> 00:23:26.240
For sure.
00:23:26.559 --> 00:23:26.799
Yeah.
00:23:27.039 --> 00:23:27.519
Yeah.
00:23:28.240 --> 00:23:29.119
Yeah, that's true.
00:23:29.359 --> 00:23:30.799
And that's a big nuance.
00:23:31.279 --> 00:23:32.960
Yeah, exactly.
00:23:47.200 --> 00:24:02.000
So we'll we'll go on to question seven for yourself, Maria, and it's about well, what what we understand, what I touched mentioned earlier, what we understand is data protection officers.
00:24:02.160 --> 00:24:09.759
So does Bahrain require organizations to appoint someone responsible for privacy compliance?
00:24:10.480 --> 00:24:11.440
Thanks, Katie.
00:24:11.680 --> 00:24:19.359
So Bahrain's law also introduces a role that is very similar to the data protection officer that we have in the GDPR.
00:24:19.519 --> 00:24:19.839
Okay.
00:24:20.480 --> 00:24:24.160
It's similar, but again, the the terminology is different.
00:24:24.319 --> 00:24:30.720
They call this individual the data protection guardian, as you mentioned in your previous uh answer.
00:24:31.119 --> 00:24:36.960
And the role sits at the center of an organization's privacy governance framework, very similar to the DPO.
00:24:37.519 --> 00:24:53.279
Um, the data protection guardian is responsible for monitoring compliance with the law, ensuring that internal policies and procedures are aligned with the regulatory requirements, and that data protection is embedded into the day-to-day operations, again, very similar to the DPO.
00:24:53.680 --> 00:25:06.720
They also act as a key point of contact with the regulator, facilitating communication, responding to inquiries, and supporting any kind of supervisory or investigative processes that may take place.
00:25:07.279 --> 00:25:15.839
They oversee broader governance practices very often, ensuring that accountability is not just documented, but is actually operationalized across the organization.
00:25:16.160 --> 00:25:18.559
Again, very similar to the DPO.
00:25:19.119 --> 00:25:25.039
When we compare this to other frameworks, the closest equivalent would be that the DPO under the GDPR.
00:25:25.519 --> 00:25:35.839
The DPO has a similar independent oversight role with responsibilities around monitoring compliance, advising on obligations, and acting as a liaison with the supervisory authorities.
00:25:36.240 --> 00:25:45.200
The emphasis in both regimes is on embedding expertise within the organization to ensure continuous rather than reactive compliance.
00:25:45.359 --> 00:25:45.680
Okay.
00:25:47.039 --> 00:25:50.799
Now, uh again, I compare this to the DPDP Act.
00:25:50.880 --> 00:25:53.359
Uh in India, we see something slightly different.
00:25:53.519 --> 00:26:00.240
So the data protection officer is only mandatory for what was termed significant data produceries.
00:26:00.319 --> 00:26:04.960
And we discussed those in our uh in our podcast about um uh India.
00:26:05.279 --> 00:26:13.359
And that means the obligation is risk-based and not universally applied, like in these two exact r and in the Bahrain.
00:26:13.599 --> 00:26:22.640
And this reflects a more targeted model of governance, uh focusing on regulatory expectations and on the organization with a higher impact or scale.
00:26:22.880 --> 00:26:31.759
Okay, so we're talking in India, it was more, you know, the higher the processing, the more inclinated inclined you might be to have um a DPO.
00:26:32.319 --> 00:26:44.640
Whereas, you know, with uh with the GDPR, Bahrain is very similar to the GDPR in that you know, any kind of personal data processing would indicate that you would need um somebody within your organization like a DPO.
00:26:45.759 --> 00:26:57.839
From an organizational perspective, the takeaway is that while the titles may differ, so you have the data protection guardian and you have the data protection officer, the underlying functions are they converge kind of globally.
00:26:58.240 --> 00:27:07.200
Organizations need a clearly defined role, responsible for privacy oversight, regulatory engagement, a practical implementation of governance frameworks.
00:27:07.519 --> 00:27:19.519
And for those already operating under the GDPR, extending the DPO function to cover Bahrain is often a natural and efficient approach, provided the local requirements are properly understood.
00:27:19.599 --> 00:27:28.319
And again, we're looking there at the the nuances, but you know, the data data protection guardian a very similar role to what we have under the GDPR.
00:27:29.680 --> 00:27:34.079
So next question is about cross-border transfers, and it's for you, Katie.
00:27:34.720 --> 00:27:39.039
How does Bahrain regulate international data transfers?
00:27:39.440 --> 00:27:40.559
Thank you, Maria.
00:27:40.720 --> 00:27:54.240
So transfers are permitted to countries they're permitted with basically no complications to countries that are itemized in a list in one of their decrees, which we talked about earlier.
00:27:54.400 --> 00:28:08.000
So it's decree order number 42 of 2022 on transfers, and they have 73 countries listed as giving an adequate level of protection.
00:28:08.160 --> 00:28:09.599
They also have another route.
00:28:09.759 --> 00:28:21.440
If you want to transfer to a country not on that list, you need the authorization of the authority, and that can be conditional on certain measures that you have in place.
00:28:21.839 --> 00:28:28.640
So where you're transferring via authorization, you need to do it according to a contract.
00:28:28.720 --> 00:28:33.119
And they have listed a few things that need to be itemized in the contract.
00:28:34.160 --> 00:28:42.720
So obviously, they need to stipulate this exact scope of the processing, they need to follow data minimization and storage limitation.
00:28:43.279 --> 00:28:46.720
The data needs to be accurate, relevant, and up to date.
00:28:46.960 --> 00:28:52.240
They need to demonstrate that they have technical and organizational measures to keep it safe.
00:28:52.559 --> 00:28:58.319
And they also need to give the data subject a fair processing notice that lets them know about the transfer.
00:28:59.200 --> 00:29:10.079
And they they have to make sure that whatever processor or joint controller, whoever it is in the other country, can help facilitate data subject's rights.
00:29:10.319 --> 00:29:23.839
So it is very similar to the GDPR, like they have their list of 73 adequate countries, and then they have their obligation on the controller to bring in safeguards.
00:29:24.400 --> 00:29:33.119
Otherwise, so it's it's quite like the uh GDPR, again, like the Indian one, it's a bit opposite.
00:29:33.279 --> 00:29:45.599
They had they didn't say, well, we have a list of adequate countries, we have a list of blacklisted countries, and then Qatar is a bit more strict that they they do need approval.
00:29:45.759 --> 00:29:52.079
So I'd say of everything we've seen so far, this is definitely one of the closest to the GDPR.
00:29:52.480 --> 00:29:54.799
Okay, and it's kind of like a whitelist as well, isn't it?
00:29:54.880 --> 00:29:56.880
That as opposed to a blacklist that India has.
00:29:56.960 --> 00:29:57.279
Yeah.
00:29:57.519 --> 00:29:58.000
Yeah.
00:29:58.319 --> 00:29:59.279
Very good.
00:30:00.240 --> 00:30:03.599
So yeah, that's cross-border transfers.
00:30:03.839 --> 00:30:08.640
I will move on uh here to question nine for yourself, Maria.
00:30:09.039 --> 00:30:14.960
What security obligations do organizations have when they're processing personal data?
00:30:15.759 --> 00:30:17.519
So when thanks for that, Katie.
00:30:17.599 --> 00:30:32.960
So when we turn to security obligations under Bahrain's personal data protection law, we see a clear emphasis on the need for organizations to move beyond just policy and like they really kind of require you know practical application of security.
00:30:33.119 --> 00:30:49.759
Uh, controllers are required to implement appropriate technical security measures, like in the GDPR, and these would include things like encryption, access controls, and system monitoring to ensure that personal data is protected against unauthorized access, loss or misuse.
00:30:50.240 --> 00:30:54.319
Uh, but most importantly, the law doesn't stop at technology.
00:30:54.480 --> 00:30:58.160
There's also a strong expectation around organizational safeguards.
00:30:58.319 --> 00:31:12.240
This means putting in place internal policies, staff training, role-based access controls, and you know, in general, just governance structures that ensure that data protection is consistently applied across the organization.
00:31:12.319 --> 00:31:16.160
So, again, very much back to the GDPR kind of approach there.
00:31:16.400 --> 00:31:23.440
Um, in other words, security is not just an IT issue, it's an organizational responsibility.
00:31:23.759 --> 00:31:28.319
Um, confidentiality protections are another key component.
00:31:28.480 --> 00:31:40.720
Organisations must ensure that personal data is only accessible to those who are authorised to process it and that appropriate controls are in place to prevent accidental or unlawful disclosure.
00:31:41.039 --> 00:31:56.960
From a comparative perspective, this aligns very closely with Article 32 of the GDPR, which requires, as we know, organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
00:31:57.920 --> 00:32:17.599
The language and intent are remarkably consistent, again, reflecting that broader global convergence in privacy governance is important to Bahrain and making it easier for organizations to port their existing governance structure to Bahrain when moving into that jurisdiction.
00:32:17.839 --> 00:32:32.880
So we like we've looked at the DPDP Act in India, um, and that also uh incorporates security obligations, um, and they kind of require their data fiduciaries to implement reasonable safeguards to prevent personal data breaches.
00:32:33.039 --> 00:32:38.640
While the wording may be less prescriptive than the GDPR, the underlying expectations is the same.
00:32:38.880 --> 00:32:45.039
Organizations must be able to demonstrate that they have taken active steps to protect personal data.
00:32:45.279 --> 00:33:00.000
So, in that regard, you know, most of the laws that we've looked at so far are similar in that they do expect a level of security around the protection of personal data as well.
00:33:01.039 --> 00:33:14.960
So, from an operational standpoint, there is this is one of the clearest areas of global alignment, security governance, combining technical controls, organizational measures, and accountability mechanisms.
00:33:15.119 --> 00:33:28.000
It's now kind of became it's become baseline or you know, kind of fundamental to most data protection regimes across the various different jurisdictions that we've been looking at in this podcast.
00:33:28.319 --> 00:33:43.119
For organizations building a global compliance architecture, this is where integration between privacy and security tooling becomes critical, enabling not just compliance on paper but evidence of controls in operation over time.
00:33:43.279 --> 00:33:59.599
And we'll only see that increase as well as we start to see AI being considered by these jurisdictions because, as we know from the EU AI Act, uh AI governance is all about evidence as opposed to just policies and paper-based governance.
00:33:59.759 --> 00:34:11.280
So, so yeah, there's definitely a merge there between data protection and security across various different jurisdictions, and now we're seeing it with AI as well.
00:34:11.440 --> 00:34:13.280
So, yeah.
00:34:13.840 --> 00:34:17.760
Okay, so moving on to question 10 then uh for you, Katie.
00:34:18.159 --> 00:34:30.000
Are there any unique attributes to the law in Bahrain that we that kind of uh sets it apart from other uh jurisdictions that we've been looking at in this podcast series?
00:34:30.480 --> 00:34:32.800
Okay, so thank you for that, Maria.
00:34:32.960 --> 00:34:41.920
There is a bit of a unique attribute within the Bahrain law, which is the concept of prior authorization.
00:34:42.960 --> 00:35:15.119
So Article 15 of the law says that a processor is gonna need written prior authorization from the Ministry of Justice to use automated processing where it draws links between personal data between two different controllers, where they use automated processing of biometric data for the verification of an individual's identity, and where they use CCTV.
00:35:16.000 --> 00:35:19.679
So that's a bit of an interesting one.
00:35:19.840 --> 00:35:32.800
The controllers are going to need to notify the authority who's overseen by the Ministry of Justice for any wholly or partially automated processing operations and for the use of CCTV.
00:35:33.440 --> 00:35:49.039
So where authorization is granted, they have a few considerations that they have to follow, which are quite similar to the technical and organizational measures and the kind of data protection principles as well.
00:35:49.119 --> 00:36:29.519
But I suppose they just need to be able to demonstrate proof that they will uphold these four points when they complete this processing activity, and the four points are transparency, in which includes informing the data subjects of the exact use of the data, the second point is purpose limitation, the third point is basically access controls on a need-to-know basis for the data, and then the fourth is you need to demonstrate how you're going to facilitate data subject rights.
00:36:29.679 --> 00:36:33.599
So sorry, again, when was that when is that required?
00:36:33.840 --> 00:36:35.760
What scenario is that required?
00:36:36.159 --> 00:36:43.599
Okay, so it's required if you're using automated processing and CCTV.
00:36:43.679 --> 00:36:59.599
The automated processing does have a couple of conditions like where you use automated processing using biometric data, or where you use automated processing that links personal data between different controllers.
00:36:59.679 --> 00:37:04.079
So I would say maybe credit agencies might be doing that.
00:37:04.480 --> 00:37:04.719
Okay.
00:37:09.199 --> 00:37:18.480
Yeah, combine a lot of data from even broker, brokers and stuff would get a lot of data from different from different sources.
00:37:18.719 --> 00:37:47.119
So basically, if you put data from different sources into automated decision making process, you're going to need to write out the bat explain how you're going to be transparent, how there's going to be no scoop creep, that authorization is restricted to a need-to-no basis, and how you're going to facilitate data subject rights.
00:37:47.199 --> 00:37:49.440
So it's it's less after the fact.
00:37:49.519 --> 00:38:06.480
I mean, technically, people could be processing data contrary to the law, but the authority would only find out through an investigation, whereas in this situation you need to you need to show that you're compliant before you even start that processing activity.
00:38:06.880 --> 00:38:10.800
That's good because it makes people think and it makes them get a plan together.
00:38:10.960 --> 00:38:19.679
So when they have a plan together, they're more inclined to actually follow the plan than like you say, you know, what are we supposed to do now that we've been caught or something like that, you know?
00:38:19.840 --> 00:38:20.159
Yeah.
00:38:20.639 --> 00:38:31.440
Um as well, I've just a little note here on the difference between the GDPR and the Bahrain personal data protection law on automated decision making, now that you mention it.
00:38:31.599 --> 00:38:35.440
So the difference lies in the scope and the strength and structures of the right.
00:38:35.599 --> 00:38:58.159
Under the GDPR, which is we know Article 22, individuals have a clear, a clearly defined and standalone right not to subject, not to be subject to decisions based solely on automated processing, including profiling, which, like I think that's you know, you've described there, uh, where those decisions produce legal or similarly significant effects.
00:38:58.400 --> 00:39:07.840
This right is supposed supported by explicit safeguards, such as the right to obtain human intervention, express one's point of view, and contest the decision.
00:39:08.000 --> 00:39:18.079
In contrast, the Bahrain PDPL recognises concerns around automated decision making, but does not, but does so in a more limited and less codified manner.
00:39:18.239 --> 00:39:30.559
Uh the right is typically framed around the ability to object to decisions that cause material or moral harms rather than as a broad prohibition on solely automated decisions.
00:39:30.639 --> 00:39:32.880
So it's more like on a case-by-case basis.
00:39:33.039 --> 00:39:49.199
As a result, Bahrain's approach is more reactive and harm-based, whereas the GDPR establishes a proactive principle-driven control over automated decision-making, making it significantly more operationally demanding for organizations.
00:39:49.440 --> 00:40:02.960
But like you say there, um, it's interesting because it's the opposite in that exception there that you give when considering you know uh CCTV and so on.
00:40:03.119 --> 00:40:17.119
The Bahrain law is more uh specific and requires preparation to meet the law or you know, um accountability to meet the requirements of the law than the GDPR.
00:40:17.199 --> 00:40:18.320
So that's interesting.
00:40:19.039 --> 00:40:19.679
It is.
00:40:20.079 --> 00:40:31.119
And also to achieve that prior authorization they need to um submit a DPIA that they undertook.
00:40:31.360 --> 00:40:33.840
So Okay, interesting.
00:40:34.000 --> 00:40:34.639
Yeah.
00:40:35.199 --> 00:40:50.719
So there is accountability there's quite a lot of accountability around, you know, even though the GDPR would be seen as kind of more of an established right around automated decision making, there is still significant accountability within the the Bahrain law as well.
00:40:51.119 --> 00:40:52.320
Yeah, for sure.
00:40:52.559 --> 00:41:05.199
I mean it may be a bit more procedural with stuff like CCTV, because if you're under the GDPR, you just need to complete your DPIA and kind of work from there.
00:41:06.159 --> 00:41:20.239
But here, if you want to use CCTV, you have to do the DPIA, and you know, I don't know how long that process of getting prior authorization would take, you know, if you're gonna be waiting or anything, but yeah.
00:41:21.360 --> 00:41:25.519
It forces organizations to think about their governance, yeah.
00:41:25.840 --> 00:41:26.639
Which is good.
00:41:27.119 --> 00:41:33.280
So move on to the next question for yourself, Maria, which is still kind of on the same topic.
00:41:33.519 --> 00:41:46.559
So does Bahrain have a specific AI governance framework, or are AI systems primarily regulated through existing law and regulations?
00:41:47.360 --> 00:41:48.159
Thanks, Katie.
00:41:48.480 --> 00:41:59.840
Well, when we look at AI governance of Bahrain, it's important to note that at least for now, there's no standalone AI Act equivalent like to the EU AI Act that we have in the European Union.
00:42:00.079 --> 00:42:06.480
Instead, AI governance is being kind of addressed through a combination of existing legal and policy instruments.
00:42:06.719 --> 00:42:17.199
First, like you have the data protection obligations under the personal data law that we've been looking at in this podcast, and that plays a kind of central role when it when considering AI.
00:42:17.760 --> 00:42:30.800
So, like where AI systems process personal data, organizations must comply with the principles such as lawfulness, fairness, transparency, and accountability, which goes a long way with the AI systems as well.
00:42:30.880 --> 00:42:39.920
You know, effectively they're using the privacy law as a kind of a proxy for governing various different aspects of AI at the moment, anyway.
00:42:40.079 --> 00:42:45.840
Then sectoral regulations also come into play in areas such as finance or telecommunications.
00:42:46.000 --> 00:42:57.360
Regulators may impose additional requirements around risk management, oversight, system integrity, which indirectly shape how AI is deployed within these sectors.
00:42:57.599 --> 00:43:10.800
And then, third, Bahrain's national digital economy and innovation strategies provide a broad kind of policy framework that can also encompass AI adoption.
00:43:11.119 --> 00:43:20.880
So there this framework kind of encourages organizations to use AI while signaling expectations around responsible and secure use.
00:43:21.360 --> 00:43:25.840
When we compare this globally, uh the contrast is quite striking.
00:43:26.000 --> 00:43:32.639
The EU is moving towards a dedicated risk-based regulatory model through the EU AI Act.
00:43:32.719 --> 00:43:36.960
That's again industry agnostic and it cuts across all industries.
00:43:37.199 --> 00:43:46.239
And this AI Act, like the EU AI Act, classifies AI systems according to their level of risk and imposes corresponding obligations.
00:43:46.559 --> 00:43:50.880
This represents a more explicit and structured approach to AI governance.
00:43:51.280 --> 00:43:59.519
We saw in the UAE a slightly different model again, less focused on a single legislative instrument and more on a like on.
00:44:00.159 --> 00:44:09.119
National AI strategies and coordinated governance initiatives, and these would have been supported by sectoral guidance and regulatory activity.
00:44:09.920 --> 00:44:25.440
India is still in a formative phase when it comes to AI, it's actively developing its AI governance approach, but for now it relies largely on existing regulatory frameworks such as its data protection law to manage AI risks.
00:44:26.559 --> 00:44:43.039
So in Bahrain, from a per operational perspective, what this tells us is that AI governance is currently evolving along different trajectories, not just in Bahrain, but across the jurisdictions that we've kind of seen and we've looked at in the podcast.
00:44:43.440 --> 00:44:54.639
In Bahrain, there's no kind of dedicated AI law, and that kind of forces organizations to assume an absence of regulation.
00:44:55.119 --> 00:45:19.599
Instead, in Bahrain, they need to interpret and apply existing frameworks like, like I said, the data protection law and sectoral laws, and they have to apply these laws to various different AI use cases that they would encounter during their work and to make sure that governance is proactive and risk-aware and adaptable as more formal AI regulation inevitably comes down the line.
00:45:19.840 --> 00:45:28.320
But for the time being, they do rely heavily on industry regulation and their data protection law.
00:45:29.280 --> 00:45:34.960
So uh sticking with AI, Katie, this is our last question, and it's for you.
00:45:35.440 --> 00:45:45.039
Given the increasing role of AI in digital services, do you think Bahrain's privacy law provides a sufficient foundation for governing AI systems?
00:45:46.159 --> 00:45:48.239
Thank you for that, Maria.
00:45:48.960 --> 00:46:12.400
Um I think I would answer it going back a bit to what you said in that there are aspects of their current privacy law landscape that have an effect on AI, but at the end of the day, they don't have something specifically for AI as a use case.
00:46:12.559 --> 00:46:54.480
You know, it kind of is caught here and there by different by different existing laws and maybe regulatory standards, but they don't have they don't have something that might address in hard law anyway everything that you might be concerned about in AI, but they do have a couple of soft instruments that I think could form a foundation like what you were asking about, could could be a good foundation, or at least the beginnings of a foundation for governing AI systems if they continue to develop this.
00:46:54.880 --> 00:47:24.480
They have a number of core ethical principles guiding AI use and adoption, published by their information and e-government authority, because they're part they're part of the Gulf Cooperation Council, and they kind of said, well, if you're gonna continue to be part of the Gulf Cooperation Council, everyone is gonna have to adopt a certain amount of policies to govern AI, at least to start with.
00:47:24.639 --> 00:47:27.119
So we've seen that in Qatar as well.
00:47:27.360 --> 00:47:33.039
They had some very nice, uh very nicely laid out infographics and stuff about it.
00:47:33.440 --> 00:47:58.320
But yeah, so the core principles that they've put out is human oversight, safety and security, justice, equity and non-discrimination, privacy and data protection, transparency and explainability, accountability, awareness and education, integrity, sustainability, inclusion and diversity, and international cooperation.
00:47:59.440 --> 00:48:03.280
So isn't it?
00:48:03.519 --> 00:48:05.920
Yeah, yeah, it's quite comprehensive, isn't it?
00:48:06.480 --> 00:48:07.519
It's it's long, yeah.
00:48:07.599 --> 00:48:10.480
It was longer than I thought than I was expecting it to be.
00:48:10.639 --> 00:48:25.679
Um and they have they have more on it than just, you know, it's not just the list alone, they have more guidance um to go with it, but I know it's not hard law, but uh as a as guidance.
00:48:26.320 --> 00:48:28.239
Yeah, it's comprehensive.
00:48:28.320 --> 00:48:28.559
Yeah.
00:48:29.039 --> 00:48:31.039
It could be a sufficient foundation.
00:48:31.199 --> 00:48:38.000
Um And like you say, it gives guidance until hard law come you know comes down the line.
00:48:38.719 --> 00:48:39.679
Yeah, for sure.
00:48:39.920 --> 00:48:46.880
And like especially if this is kind of if people internalize this in practice Yeah.
00:48:47.519 --> 00:48:57.920
And I think if they fall in line like they have with the with their data protection law and they want to kind of follow international standards, that that's a good starting point.
00:48:58.079 --> 00:49:01.920
That you know, comprehensive list of recommendations, you know, guidance.
00:49:03.039 --> 00:49:04.079
I I agree.
00:49:04.400 --> 00:49:12.480
That those principles and the guitar guidance that we seen and I don't know if it was in our last our last podcast episode.
00:49:12.880 --> 00:49:14.000
I think it was, yeah.
00:49:14.320 --> 00:49:23.679
But it's good to see because those are some of the some of the first kind of nationally published official guidelines.
00:49:23.840 --> 00:49:26.559
So it's definitely a stepping stone.
00:49:26.880 --> 00:49:29.039
Yeah, yeah, and it's a sign of things to come.
00:49:29.119 --> 00:49:36.159
And it looks like they are they will stay with the international approach, you know, making it easy for organizations to move into Bahrain.
00:49:36.719 --> 00:49:37.199
Yeah.
00:49:37.360 --> 00:49:39.760
That that was our last question.
00:49:39.920 --> 00:49:50.400
So today we explored Bahrain's personal data protection law, along with a couple of the executive decisions that were issued under it.
00:49:50.639 --> 00:50:03.920
We placed it within the context of the Gulf regional landscape and also compared it to a few broader laws like the GDPR and the Indian law that we had explored before.
00:50:04.239 --> 00:50:23.360
So we seen where it was influenced by the GDPR, where it was influenced by the culture of the Gulf, where it actually is located, and we also did draw a few similarities to the Indian DPDP, which was interesting to see.
00:50:24.480 --> 00:50:35.440
As we've discussed in the past, privacy laws increasingly serve as the foundational layer for broader digital governance, including with emerging issues such as AI.
00:50:35.599 --> 00:50:42.880
And we've seen that as we as our last few questions touched on with Qatar and Bahrain.
00:50:43.280 --> 00:50:52.239
You know, this is, as you said, a sign of what's coming down the line and the principles that countries are taking into mind with things like AI.
00:50:52.320 --> 00:50:55.440
So I think that's it's quite a positive sign.
00:50:56.079 --> 00:51:02.559
So thanks everyone for joining us for this episode of our international privacy law series.
00:51:02.800 --> 00:51:10.079
And we look forward to continuing our journey through global data protection frameworks in the next episode.
00:51:10.400 --> 00:51:11.280
Thanks, Katie.
00:51:11.519 --> 00:51:12.800
Thanks to our listeners.
00:51:13.039 --> 00:51:14.880
See you in the next episode.
