Abu Dhabi Global Market Consultation Paper No. 10 - Data Protection Regulations

CONSULTATION PAPER
NO 10 OF 2015
13 JULY 2015
DATA PROTECTION REGULATIONS

2
INTRODUCTION

1. The Board of Directors (the "Board") of Abu Dhabi Global Market ("ADGM") have issued this
   Consultation Paper to invite public comment on the Board's proposals to issue regulations governing data protection to be called the Data Protection Regulations (the “Regulations”). A proposed draft of the Regulations is set out at Annex A to this Paper.
2. We have summarised the main provisions of the Regulations in this Consultation Paper. The summaries
   provided within should be read as an introduction to the provisions only – many of the precise details and specifics are contained in the draft Regulations themselves. Where terms are capitalised in this paper, they (unless context requires otherwise) should be taken to have the definitions ascribed to such terms in the Regulations. WHO SHOULD READ THIS PAPER?
3. The proposals in this Consultation Paper would be of interest to individuals, organisations and investors
   with an interest in establishing a presence in ADGM or otherwise doing business in ADGM, and their professional advisors. HOW TO PROVIDE COMMENTS
4. All comments should be in writing and sent to the address or email specified below. If sending your
   comments by email, please use the Consultation Paper number in the subject line. You may, if relevant, identify the organisation you represent in providing your comments. The Board reserves the right to publish, including on its website, any comments you provide, unless you expressly request otherwise at the time of making comments. Comments supported by reasoning and evidence will be given more weight by the Board. WHAT HAPPENS NEXT?
5. The deadline for providing comments on this proposal is 11 August 2015. Once we receive your
   comments, we will consider whether any modifications are required to this proposal. The Board will then proceed to enact the Regulations. You should not act on these proposals until the Regulations are issued. We shall issue a notice on our website telling you when this happens. COMMENTS TO BE ADDRESSED TO:
   Consultation Paper No. 10 of 2015
   Abu Dhabi Global Market
   Abu Dhabi Global Market Square
   Al Maryah Island
   PO Box 111999
   Abu Dhabi, UAE
   Email: consultation@adgm.com
   Telephone: +971 (0)2 333 0888

3
DATA PROTECTION REGULATIONS
SCOPE AND APPROACH TO THE DATA PROTECTION REGULATIONS
6. This Consultation Paper aims to determine whether there is a need for a set of standalone data
protection regulations in ADGM, as an alternative to the individual provisions currently legislating for some level of data protection in the Employment Regulations 2015. In this regard, we considered EU legislation as the most appropriate basis for preparing the draft standalone Regulations, and it is therefore the current EU Data Protection Directive 95/46/EC (the "EU Directive") on which the Regulations are based. Broadly speaking, this imposes standards on the collection, use and distribution of individual personal data to be met by those entities in control of such data.
7. The Board is aware of the current proposals by the European Commission for the adoption of a new
"General Data Protection Regulation" to replace the current EU Directive. Although this has recently been approved by the European Council, tripartite discussions between the main EU authorities to agree its final text are yet to commence, with a final version of the proposed regulation expected at the end of 2015. It is then unlikely to come into force until two years following its publication, during which time the EU Directive will still be applicable. The draft Regulations have mot attempted to preempt any proposed modifications.
8. The Regulations will apply to any person based in the ADGM who, either alone or jointly with others,
determines the purposes and processing methods of any Personal Data (collectively defined as "Data Controllers"). Personal Data is defined widely to include any information relating to a natural person or a natural person who can, either directly or indirectly, be identified by reference to an identification number or to one or more factors relating to that persons’ physical, physiological, mental, economic, cultural or social identity.
9. The Regulations contain provisions under the following Part headings:
a. Part 1, General Rules on the Processing of Personal Data (e.g., requirements for secure and legitimate Processing of Personal Data, specific treatment of Sensitive Personal Data, governance of transfers of Personal Data outside the ADGM); b. Part 2, Rights of Data Subjects (e.g., rights to access, rectify, erase or block Personal Data or object to their Processing);
c. Part 3, Notifications to the Registrar (e.g., specific notifications to be made to the Registrar,
the Registrar’s maintenance of a register of such notifications); d. Part 4, The Registrar (e.g., powers of the Registrar to access and request information, issue warnings or make recommendations to Data Controllers); e. Part 5, The Board (e.g., the power of the Board to make rules to accompany the Regulations); f. Part 6, Remedies, Liability and Sanctions (e.g., directions imposed by the Registrar in instances of contraventions of the Regulations, lodging of claims with the Registrar by those adversely affected by such contraventions, and a right of compensation for those suffering damage by virtue of such contraventions); and

4 g. Part 7, General Exemptions (e.g., instances where the Board may make Rules to exempt certain Data Controllers from compliance with the Regulations). ISSUE FOR CONSIDERATION SHOULD THE BOARD ADOPT A SET OF STAND ALONE DATA PROTECTION REGULATIONS, OR SHOULD IT RELY UPON INDIVIDUAL DATA PROTECTION PROVISIONS IN EXISTING REGULATIONS?

5
ANNEX A: PROPOSED DATA PROTECTION REGULATIONS

---

Consultation Paper No. 10 of 2015
ANNEX A
DATA PROTECTION REGULATIONS 2015

LNDOCS01/923546.6
DATA PROTECTION REGULATIONS 2015
Part 1 General Rules on the Processing of Personal Data....................................................... 3
Part 2 Rights of Data Subjects................................................................................................. 8
Part 3 Notifications to the Registrar........................................................................................ 8
Part 4 The Registrar................................................................................................................. 9
Part 5 The Board ..................................................................................................................... 9
Part 6 Remedies, Liability and Sanctions.............................................................................. 10
Part 7 General Exemptions.................................................................................................... 11

Annex A
LNDOCS01/923546.6 3
DATA PROTECTION REGULATIONS 2015
Regulations to make provision for the protection of personal data within the Abu Dhabi Global Market and for connected purposes. Date of Enactment: [] 2015 The Board of Directors of the Abu Dhabi Global Market, in exercise of its powers under Article 6(1) of Law No. 4 of 2013 concerning the Abu Dhabi Global Market issued by His Highness the Ruler of the Emirate of Abu Dhabi, hereby enacts the following Regulations–
Part 1 General Rules on the Processing of Personal Data

1. General requirements
   (1) Data Controllers shall ensure that Personal Data which they Process are– (a) Processed fairly, lawfully and securely; (b) Processed for specified, explicit and legitimate purposes in accordance with the Data Subject's rights and not further Processed in a way incompatible with those purposes or rights; (c) adequate, relevant and not excessive in relation to the purposes for which they are collected or further Processed; (d) accurate and, where necessary, kept up to date; and (e) kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal Data were collected or for which they are further Processed. (2) Every reasonable step shall be taken by Data Controllers to ensure that Personal Data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further Processed, are erased or rectified.
2. Requirements for legitimate Processing
   Personal Data may only be Processed if–
   (a) the Data Subject has given his written consent to the Processing of that Personal Data; (b) Processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract; (c) Processing is necessary for compliance with any regulatory or legal obligation to which the Data Controller is subject; (d) Processing is necessary in order to protect the vital interests of the Data Subject; (e) Processing is necessary for the performance of a task carried out in the interests of the Abu Dhabi Global Market or in the exercise of the Board's, the Court's, the Registrar's or the Regulator's functions or powers vested in the Data Controller or in a Third Party to whom the Personal Data are disclosed; or

Annex A
LNDOCS01/923546.6 4
(f) Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by the Third Party to whom the Personal Data are disclosed, except where such interests are overridden by compelling legitimate interests of the Data Subject relating to the Data Subject's particular situation.
3. Processing of Sensitive Personal Data
(1) Sensitive Personal Data shall not be Processed unless– (a) the Data Subject has given his written consent to the Processing of such Personal Data; (b) Processing is necessary for the purposes of carrying out the obligations and specific rights of the Data Controller; (c) Processing is necessary to protect the vital interests of the Data Subject or of another person where the Data Subject is physically or legally incapable of giving his consent; (d) Processing is carried out in the course of its legitimate activities with appropriate guarantees by a foundation, association or any other non-profit-seeking body on condition that the Processing relates solely to the members of the body or to persons who have regular contact with it in connection with its purposes and that the Personal Data are not disclosed to a Third Party without the consent of the Data Subjects; (e) the Processing relates to Personal Data which are manifestly made public by the Data Subject, or is necessary for the establishment, exercise or defence of legal claims; (f) Processing is necessary for compliance with any regulatory or legal obligation to which the Data Controller is subject; (g) Processing is necessary to uphold the legitimate interests of the Data Controller recognised in the international financial markets, provided the Processing is undertaken in accordance with applicable standards and except where such interests are overridden by compelling legitimate interests of the Data Subject relating to the Data Subject's particular situation; (h) Processing is necessary to comply with any regulatory, auditing, accounting, anti￾money laundering or counter terrorist financing obligations that apply to a Data Controller or for the prevention or detection of any crime; or (i) Processing is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of healthcare services, and where those Personal Data are Processed by a health professional subject under law or rules established by competent bodies to the obligation of confidence or by another person subject to an equivalent obligation. (2) Subsection (1) shall not apply if– (a) a permit has been obtained from the Registrar to Process Sensitive Personal Data; and (b) the Data Controller applies adequate safeguards with respect to the Processing of the Personal Data.

Annex A
LNDOCS01/923546.6 5
4. Transfers out of the Abu Dhabi Global Market: adequate level of protection
(1) Subject to section 5, a transfer of Personal Data to a Recipient located in a jurisdiction outside the Abu Dhabi Global Market may take place only if an adequate level of protection for those Personal Data are ensured by laws applicable to the Recipient. (2) The adequacy of the level of protection ensured by laws to which the Recipient is subject, as referred to in subsection (1), shall be assessed in the light of all the circumstances surrounding a Personal Data transfer operation or set of Personal Data transfer operations, including, but not limited to– (a) the nature of the data; (b) the purpose and duration of the proposed Processing operation or operations; (c) if the data do not emanate from the Abu Dhabi Global Market, the country of origin and country of final destination of the data; and (d) any relevant laws to which the Recipient is subject, including professional rules and security measures. (3) The Registrar may by written notification designate a jurisdiction as providing an adequate level of protection for Personal Data for the purposes of subsection (1).
5. Transfers out of the Abu Dhabi Global Market in the absence of an adequate level of
protection
A transfer or a set of transfers of Personal Data to a Recipient which is not subject to laws which ensure an adequate level of protection within the meaning of section 4(1) may take place on condition that– (a) the Registrar has granted a permit for the transfer or the set of transfers and the Data Controller applies adequate safeguards with respect to the protection of such Personal Data; (b) the Data Subject has given his written consent to the proposed transfer; (c) the transfer is necessary for the performance of a contract between the Data Subject and the Data Controller or the implementation of pre-contractual measures taken in response to the Data Subject's request; (d) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the Data Subject between the Data Controller and a Third Party; (e) the transfer is necessary for the establishment, exercise or defence of legal claims; (f) the transfer is necessary in order to protect the vital interests of the Data Subject; (g) the transfer is necessary in the interests of the ADGM; (h) the transfer is made at the request of a regulator, police or other government agency; (i) the transfer is made from a register which according to law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case;

Annex A
LNDOCS01/923546.6 6
(j) the transfer is necessary for compliance with any regulatory or legal obligation to which the Data Controller is subject; (k) the transfer is necessary to uphold the legitimate interests of the Data Controller recognised in the international financial markets, provided that the transfer is carried out in accordance with applicable standards and except where such interests are overridden by legitimate interests of the Data Subject relating to the Data Subject's particular situation; or (l) the transfer is necessary to comply with any regulatory, auditing, accounting, anti￾money laundering or counter terrorist financing obligations that apply to a Data Controller which is established in the Abu Dhabi Global Market, or for the prevention or detection of any crime.
6. Providing information where data have been obtained from the Data Subject
(1) Data Controllers shall provide a Data Subject whose Personal Data it collects from the Data Subject with at least the following information as soon as possible upon commencing to collect Personal Data in respect of that Data Subject– (a) the identity of the Data Controller; (b) the purposes of the Processing for which the Personal Data are intended; and (c) any further information in so far as such is necessary, having regard to the specific circumstances in which the Personal Data are collected, to guarantee fair Processing in respect of the Data Subject, such as– (i) the Recipients or categories of Recipients of the Personal Data; (ii) whether replies to questions are obligatory or voluntary, as well as the possible consequences of failure to reply; (iii) the existence of the right of access to and the right to rectify the Personal Data concerning him; (iv) whether the Personal Data will be used for direct marketing purposes; and (v) whether the Personal Data will be Processed on the basis of section 3(1)(g) or
section 5(k).
(2) A Data Controller need not provide that information otherwise required by subsection (1)(c)(i) to the Data Subject if the Data Controller reasonably expects that the Data Subject is already aware of that information.
7. Providing information where data have not been obtained from the Data Subject
(1) Where Personal Data have not been obtained from the Data Subject, a Data Controller or his representative shall at the time of undertaking the Processing of Personal Data or if a disclosure to a Third Party is envisaged, no later than the time when the Personal Data are first Processed or disclosed, provide the Data Subject with at least the following information– (a) the identity of the Data Controller; (b) the purposes of the Processing;

Annex A
LNDOCS01/923546.6 7
(c) any further information in so far as such further information is necessary, having regard to the specific circumstances in which the Personal Data are Processed, to guarantee fair Processing in respect of the Data Subject, such as– (i) the categories of Personal Data concerned; (ii) the Recipients or categories of Recipients; (iii) the existence of the right of access to and the right to rectify the Personal Data concerning him; (iv) whether the Personal Data will be used for direct marketing purposes; and (v) whether the Personal Data will be Processed on the basis of section 9(1)(g) or
section 5(k).
(2) Subsection (1) shall not apply to require– (a) the Data Controller to provide information which the Data Controller reasonably expects the Data Subject to possess; or (b) the provision of such information if it is reasonably impracticable or would involve a disproportionate effort.
8. Confidentiality
Any person acting under a Data Controller or a Data Processor, including the Data Processor himself, who has access to Personal Data shall not Process them except on instructions from the Data Controller, unless he is required to do so by law.
9. Security of Processing
(1) The Data Controller shall implement appropriate technical and organisational measures to protect Personal Data against wilful, negligent, accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access and against all other unlawful forms of Processing, in particular where the Processing of Personal Data is performed pursuant to sections 3 or 5. (2) Having regard to the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the Processing and the nature of the Personal Data to be protected. (3) The Data Controller shall, where Processing is carried out on its behalf, choose a Data Processor providing sufficient guarantees in respect of the technical security measures and organisational measures governing the Processing to be carried out, and shall ensure compliance with those measures. (4) In the event of an unauthorised intrusion, either physical, electronic or otherwise, to any Personal Data database, the Data Controller or the Data Processor carrying out the Data Controller’s function at the time of the intrusion, shall inform the Registrar of the incident as soon as reasonably practicable.

Annex A
LNDOCS01/923546.6 8
Part 2 Rights of Data Subjects
10. Right to access to and rectification, erasure or blocking of Personal Data
A Data Subject has the right to require and obtain from the Data Controller upon request, at reasonable intervals and without excessive delay or expense– (a) confirmation in writing as to whether or not Personal Data relating to him are being Processed and information at least as to the purposes of the Processing, the categories of Personal Data concerned, and the Recipients or categories of Recipients to whom the Personal Data are disclosed; (b) communication to him in an intelligible form of the Personal Data undergoing Processing and of any available information as to their source; and (c) as appropriate, the rectification, erasure or blocking of Personal Data the Processing of which does not comply with the provisions of these Regulations.
11. Right to object to Processing
(1) A Data Subject has the right–
(a) to object, at any time on reasonable grounds relating to his particular situation, to the Processing of Personal Data relating to him; and (b) to be informed before Personal Data are disclosed for the first time to Third Parties or used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object to such disclosures or uses. (2) Where there is a justified objection, the Processing instigated by the Data Controller shall no longer include those Personal Data.
Part 3 Notifications to the Registrar
12. Requirement to notify the Registrar
(1) A Data Controller shall establish and maintain records of any Personal Data Processing operations or set of such operations intended to secure a single purpose or several related purposes. (2) The Board may make rules prescribing– (a) the information in relation to Personal Data Processing operations that shall be recorded for the purposes of subsection (1); (b) the circumstances in which a Data Controller shall notify the Registrar of any operations referred to in subsection (1); and (c) the content of any such notification and any fees to be paid on such notification.
13. Register of notifications
The Registrar shall keep a register of Personal Data Processing operations notified in accordance with
section 12.

Annex A
LNDOCS01/923546.6 9
Part 4 The Registrar
14. General Powers of the Registrar
(1) The Registrar has such functions and powers as may be conferred on it by or under these Regulations and any other enactment. (2) Without limiting the generality of subsection (1), such powers and functions of the Registrar include the powers and functions, so far as are reasonably practicable, to– (a) access Personal Data Processed by Data Controllers or Data Processors; (b) collect all the information necessary for the performance of its supervisory duties; (c) prescribe forms to be used for any of the purposes of these Regulations; and (d) issue warnings and make recommendations to Data Controllers.
15. Production of information
(1) The Registrar may require a Data Controller by written notice to– (a) give specified information; or (b) produce specified documents which relate to the Processing of Personal Data. (2) The Data Controller in respect of whom a requirement is made pursuant to subsection (1) shall comply with that requirement.
Part 5 The Board
16. Power to make rules
(1) The Board may make rules in respect of any matters related to the Processing of Personal Data. (2) In particular, the Board when exercising the power in subsection (1) may make rules in respect of– (a) forms, procedures and requirements under these Regulations; (b) the keeping of the register of notifications; and (c) the conduct of the Registrar and its officers, employees and agents in relation to the exercise of powers and performance of functions under these Regulations. (3) Where the Board issues a standard or code of practice, the Board may incorporate such a standard or code into the rules by reference and in such circumstances, except to the extent that the rules otherwise provide, a person who is subject to the provisions of any such standard or code shall comply with such provisions as if they were provisions of the rules. (4) Where any rules made for the purpose of these Regulations purport to be made in exercise of a particular power or powers, they shall be taken also to be made in the exercise of all powers under which they may be made.

Annex A
LNDOCS01/923546.6 10
Part 6 Remedies, Liability and Sanctions
17. Directions and compensation
(1) If the Registrar is satisfied that a Data Controller has contravened or is contravening these Regulations or any rules made under these Regulations, the Registrar may issue a direction to the Data Controller requiring him to do either or both of the following:
(a) to do or refrain from doing any act or thing within such time as may be specified in the direction; or (b) to refrain from Processing any Personal Data specified in the direction or to refrain from Processing Personal Data for a purpose or in a manner specified in the direction. (2) A direction issued under subsection (1) shall contain– (a) a statement of the contravention of these Regulations or rules which the Registrar is satisfied is being or has been committed; and (b) a statement to the effect that the Data Controller may seek a review by the Court of the decision of the Registrar to issue the direction. (3) A Data Controller who fails, without reasonable excuse, to comply with any direction issued by the Registrar under this section shall be liable to a fine of up to []. (4) A person who receives a direction under this section may seek a review by the Court of the decision of the Registrar to issue the direction. (5) A direction issued under subsection (1) is enforceable, on the application of the Registrar or any person authorised in writing by the Registrar, by injunction. (6) An individual who suffers damage by reason of any contravention by a Data Controller of any of the requirements of these Regulations or any rules made under these Regulations is entitled to compensation from the Data Controller for that damage. (7) In proceedings brought against a person by virtue of subsection (6), it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.
18. Lodging claims and mediation
(1) A person who believes on reasonable grounds that he has been adversely affected by a contravention of these Regulations or any rules made under these Regulations in respect of the Processing of their Personal Data and as regards the exercise of their rights under sections 10 and 11 may lodge a claim with the Registrar. (2) Without prejudice to any of its powers under these Regulations, the Registrar may mediate or refer to the Court, any claim between the affected Data Subject referred to in subsection (1) and the relevant Data Controller.

Annex A
LNDOCS01/923546.6 11
Part 7 General Exemptions
19. General exemptions
(1) The Board may make rules exempting Data Controllers from compliance with these Regulations or any parts of these Regulations. (2) Without prejudice to subsection (1), sections 4, 5, 6, 7, 10 and 11 shall not apply to the Board, the Court, the Regulator or the Registrar if the application of these sections would be likely to prejudice the proper discharge by those entities of their powers or functions in so far as such powers or functions are designed for protecting members of the public against– (a) financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons carrying on any Controlled Activities; or (b) dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons carrying on Regulated Activities.
20. Interpretation
In these Regulations, unless the context indicates otherwise, the defined terms listed below shall have the following meanings– "Controlled Activities" means controlled activities as defined in the Commercial Licensing Regulations 2015. "Court" means the Court of First Instance; "Data Controller" means any person in the Abu Dhabi Global Market who alone or jointly with others determines the purposes and means of the Processing of Personal Data; "Data Processor" means any person who Processes Personal Data on behalf of a Data Controller; "Data Subject" shall mean the individual to whom Personal Data relate; "Identifiable Natural Person" means a natural person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity; "Personal Data" means any information relating to an identified natural person or Identifiable Natural Person; "Processing" means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction, and "Processed", "Processes" and "Process" shall be construed accordingly; "Recipient" means any person to whom Personal Data are disclosed, whether a Third Party or not, but does not include any person to whom disclosure is or may be made as a result of, or with a view to, a particular inquiry by or on behalf of that person made in the exercise of any power conferred by law; "Regulated Activities" has the meaning given to it in the Financial Services and Markets Regulations 2015;

Annex A
LNDOCS01/923546.6 12
"Sensitive Personal Data" means Personal Data revealing or concerning (directly or indirectly) racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership and health or sex life; and "Third Party" means any person other than the Data Subject, the Data Controller, the Data Processor and the persons who, under the direct control of the Data Controller or the Data Processor, are authorised to Process the Personal Data.
21. Amendment of the Employment Regulations 2015
(1) Section 51 of the Employment Regulations 2015 is repealed.
(2) The definitions of "Data Subject", "Personal Data" and "Processing" in section 63 of the Employment Regulations 2015 are repealed.
22. Short title, extent and commencement
(1) These Regulations may be cited as the Data Protection Regulations 2015.
(2) These Regulations shall apply in the Abu Dhabi Global Market.
(3) These Regulations shall come into force on the date of their publication. The Board may by rules make any transitional, transitory, consequential, saving, incidental or supplementary provision in relation to the commencement of these Regulations as the Board thinks fit. (4) Rules made under subsection (3) may amend any provision of any other enactment (including subordinate legislation made under such enactment).