Saudi Arabia: First Woman Appointed to Saudi Bar Association Board

Saudi Gazette, 23 March 2022: Saudi Arabia’s Justice Minister and Chairman of the Saudi Bar Association has announced they have issued an Order appointing the first woman to the Association’s board.

They are one of five new members appointed.

The new members are Ethar Al-Daej, Jasser Al-Jasser, Dr Osama Al-Qahtani, Anas Al-Zamil, Dr Louay Al-Akkas.

The Minister has also approved the professional conduct rules for lawyers.

They are aimed at developing the legal profession and enhancing its professional standards as well as transparency and responsibility.

In addition, they are aimed at strengthening legal protections for lawyers as well as their clients and redefining their responsibility towards clients, colleagues, judicial authorities and society.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.

Saudi Arabia: Full Implementation of Personal Data Protection Law Postponed

Arab News, 23 March 2022: Saudi Arabia’s Authority for Data and Artificial Intelligence has announced it has postponed the full implementation of the Personal Data Protection Law until 17 March 2023.

They were responding to feedback received.

They have received feedback from various stakeholders. Also reported in Al Madina on 22 March 2022. For full story, click here.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.

Saudi Arabia: Judicial Costs System to be Implemented From 17 March 2022

Okaz, 16 March 2022: Saudi Arabia’s Justice Ministry has announced the judicial costs system will be implemented from 17 March 2022.

The Implementing Regulations to the Law will specify the details of the criteria for estimating judicial costs for lawsuits and requests.

The system will improve the efficiency of the justice system and enhance the use of alternative methods of dispute resolution.

It will also help reduce malicious and fictitious lawsuits and improve preventive justice and the documentation of contracts.

The system does not apply to general penal cases, disciplinary cases and requests related to them, or  cases and requests which fall within the jurisdiction of the personal status courts, except for cassation requests or re-examination requests. For full story, click here.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.

Saudi Arabia: Consultation on Draft Rules and Regulations to Protect Customers of Banks and Other Financial Institutions Launched

Saudi Gazette, 15 March 2022: Saudi Arabia’s Central Bank has launched a consultation on draft rules and regulations to protect the interests of customers of banks and other financial institutions. It will last for 30 days.

The consultation has been launched as part of the Bank’s efforts to protect the rights of consumers in getting fair and transparent treatment in financial services in line with global best practices in this area.

The Bank has identified several principles which banks and other financial institutions must comply with when dealing with customers. They must deal with customers fairly, honestly and equitably, as well as take care of them, especially those on low incomes and education, the elderly and those with special needs.

Financial institutions must also protect the privacy of information and data, as well as customers from fraud. The Bank has asked them to enforce technical and control systems to limit and detect fraud, embezzlement or misuse and take the necessary action if they occur.

Financial institutions must provide the best products, services and prices to meet the customer’s needs and desires as well as address customer’s complaints and set policies which help detect potential conflicts of interest.

The Bank has urged financial institutions to encourage customers to read contracts, their appendices and any other document which requires the customer’s approval or signature to provide information to customers clearly and accurately and avoid misinformation, fraud and deception.

The financial firms must also include all the terms and conditions in the application form for obtaining the product or service, provided the warning statements include the possible consequences when using the product or service other than what was agreed on, as well as informing the customer of any change which occurs at least 30 days from the entry into force of this change.

The Bank has also banned financial institutions from requesting a customer’s signature on any blank document or complete data of the incomplete document. Financial institution must also protect and preserve clients’ documents and signatures.

The general rules of conduct state that financial institutions must not make any change with an increase in fees and commissions which natural customers must pay after obtaining the service or product and signing the contract or agreement or the like.

There will be an exemption in the fees and commissions related to the third party provided it is related to the customer’s use of the financed asset and the customer must be notified of this when concluding the contract. The financial institution must put the list of fees and commissions in a clear place on its building and branches as well as on its websites as well.

Financial institutions must not exceed the fees, commissions and costs of administrative services they obtain from natural customers or the equivalent of 1% of the financing amount or 5,000 Riyals, whichever is less.

It may be deducted only after the contract is signed, with the exception of real estate appraisal fees, which may be deducted after the customer obtains initial approval to grant real estate financing.

The Bank has instructed financial institutions to explain to customers all the information, services and products provided to them clearly and transparently. This will include information regarding prices, commissions, fines, types of risks and benefits and the rights and duties of the customer.

Financial institutions must ensure all electronic channels are available intact and in a safe way. In the event of customers incurring any direct loss as a result of hacking of these channels or because of a security breach, they must be compensated for any resulting losses.

Financial institutions have also committed to apply more than one standard for identity verification when accessing electronic services, taking the necessary measures to reduce electronic fraud and include the purpose for which text messages containing the verification code were sent to customers.

The Bank has stressed financial institution must not benefit from any returned amounts which may arise because of an error or a technical malfunction. It has also advised of the need for amounts to be returned to affected customers without delay and other customers who were exposed to the same error within five working days and without waiting for a claim, in addition to repairing the defect or malfunction.

Financial institutions must also inform the affected customers about the error and the remedial measures taken through one of the documented channels and announce this through all available channels.

Financial institutions should provide multiple channels to receive complaints, inquiries and requests to enable customers to submit complaints according to their preference easily and conveniently. These channels may include toll free numbers, branches or websites, smart phone applications and e-mails. It must also put the complaints handling mechanism in a conspicuous place in the building of the financial institution and its branches.

If the customer is not satisfied with the outcome of the treatment of their complaint and wants to escalate the complaint, they must be provided with the mechanism to approach the higher authorities in the financial institution or be directed to the competent authority in line with their preference.

Financial institutions must also provide a free phone number which customers can use from inside or outside the Kingdom to submit complaints and inquiries. The number must be published on the home page of the financial institution’s website clearly for the client as well as other channels.

Financial institutions should take humanitarian cases into account when dealing with customers who have emergency financial difficulties and find appropriate solutions for them before starting to take legal measures against them.

In addition, financial institutions and their employees must not discriminate between clients in an unfair way based on race, gender, religion, colour, age, disability or marital status.

Banks, money exchanges, payment service companies and firms issuing credit and debit cards have to ensure their business customers don’t pass or impose additional fees on holders of credit cards and Mada cards when paying through point-of-sale devices, operations through payment service providers and e-commerce websites.

Banks, money exchanges and payment service companies must also set the upper limit for transfers, daily withdrawals, point-of-sale operations, online purchases and payment operations. They have to notify customers of this limit when they obtain the service and review it at least once a year.

Banks and other firms must also inform customers of the cash withdrawal limit and fees for withdrawals through technical devices and systems such as exchange machines and not calculate the annual fees for credit or monthly discount cards until after they are activated by the customer. The card issuer has the right to cancel the card if it is not activated within 90 days of the issued date.

The regulations also state the firm receiving the transfer must ensures the beneficiary’s name matches the IBAN number and the transfer amount will be returned to the issuing authority if there is a difference between them.

All customer data recorded in the transfer form will be verified and the customer notified before agreeing to carry out the transfer process within the expected date of the arrival of the transfer amount to the transferee, as well as the amount of fees and commissions, including fees imposed by the third party, if any, and their details, along with the net amount which will be received by the transferee.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.

Saudi Arabia: Consultation on Draft Regulations to Saudi Arabia’s Personal Data Protection Law closes 25 March 2022

SDAIA, the Saudi Data & Artificial Intelligence Authority, has just released draft Regulations to the new Personal Data Protection Law, due to come into effect on 23 March 2022. The draft Regulations provide helpful clarity on many aspects of the PDPL, although ambiguity remains on a variety of topics.

Any business likely to be affected by the Law should scrutinise the draft Regulations, and consider making submissions on any areas of concern. Further information on the consultation process is available here.

The draft Regulations contain a number of significant issues, and we have not sought to address them all here. We do, however, make some observations about transfers of personal data outside the Kingdom. Unless well drafted, with practical considerations in mind, the transfer provisions have significant potential to cause issues for international businesses and for businesses that rely on cloud services hosted outside the Kingdom. This topic caused the most concern when the Law was first published in September 2022.

Do the draft Regulations satisfactorily address these concerns? Probably not, but with some adjustments they might work.

In summary, the potentially bureaucratic requirements around regulatory approvals prior to transfers abroad, as well as the question of whether the consent of the data subject negates the need to obtain such approval, would benefit from further scrutiny by SDAIA.

In Art. 28.1, the draft Regulations restate a basic requirement to host and process personal data in the Kingdom – but they also contemplate personal data being transferred outside. Such transfers would be subject to the controller undertaking a privacy impact assessment and obtaining the written approval of the relevant ‘regulatory authority’ (such as an industry sector regulator) having liaised with the ‘competent authority’ (being SDAIA, initially) on a case by case basis.

Our main concern here is the bureaucratic aspect. If each regulatory authority needs to liaise with SDAIA, and also set up a process by which controllers apply to the regulatory authority for approval, this is unlikely to be efficient in practice. The Law indicates that there will be a registration portal for data controller (presumably operated by SDAIA, as the competent authority); if controllers could obtain general approval were simply by mentioning their proposed transfer activities as part of the registration process, then this would seem practical and effective. This approach is not what is indicated in the draft Regulations, and the ambiguity around reference to a ‘case by case’ approach raises further concerns.

Our recommendation is for SDAIA to reflect on how it anticipates the approval process to roll out at a practical level, and to adjust (i.e. simplify) the requirements of Art. 28.1, accordingly.

In Art. 28.2, the transfer provisions contain a statement that transfers of personal data to recipients outside the Kingdom can occur for public interest purposes (not defined); or where providing services to individuals (not corporates?) and the transfer is subject to the consent of the data subject and not in a manner contrary to what the data subject might expect. Art 28.2 includes reference to Art. 29, which provides for transfers to jurisdictions not assessed as providing an adequate level of data protection. (Art. 30 contemplates SDAIA developing a list of jurisdictions that it considers to provide an adequate level of protection to personal data.) The implication seems to be that, where the recipient is in a jurisdiction assessed as providing adequate protections, then the consent of the data subject will legitimise such transfers.

One question that arises is whether this provision permitting transfers subject to data subject consent can be read independent of Art. 28.1, requiring approval of the regulatory authority. Being able to rely on consent alone would be a practical approach, particularly if the approval of the regulatory authority will be as bureaucratic as it appears in the current draft.

Our recommendation is for SDAIA to clarify whether Art. 28.1 is “subject to” Art.28.2, thus allowing consent-based transfers without needing to obtain approval as contemplated in Art. 28.1. (If Art. 28.1 is streamlined in the manner discussed above, this point may be of less concern.)

As noted above, Art. 30 contemplates SDAIA developing a list of jurisdictions that it considers to provide an adequate level of protection to personal data. For transfers to jurisdictions not assessed as providing an adequate level of protection, and excluding circumstances where the vital interests of the data subject are at stake, Art. 28.3 of the draft regulations contemplate a requirement for controllers to apply to SDAIA, at least 30 days in advance of proposed transfers.  Art. 29 provides further requirements relating to transfers to such jurisdictions, including a requirement for controllers to undertake risk and impact assessments, and to provide appropriate safeguards (such as adoption of standard clauses, BCRs, etc.) .

The need to apply to SDAIA again seems unnecessarily bureaucratic. Elsewhere, a permit from an authority might be one option available to a controller (rather than a universal requirement for such transfers), and not required in circumstances where risks have been assessed and appropriate safeguards put in place.

Our recommendation is for SDAIA to adjust the requirements of Art. 28.3 so that the need to apply to SDAIA for approval is only required where the controller assesses that the risk to the data subject is high and there is uncertainty about whether proposed safeguards are likely to be adequate.

As noted above, the draft Regulations contain a variety of other concerns, and further scrutiny is essential. We will be happy to share further insight on this significant development, and to provide support in the preparation of submissions to the consultation process if required. Please follow our Digital & Data ‘showcase’ page on LinkedIn, and contact email Nick O’Connell directly for any specific support.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.

Saudi Arabia: Nitaqat Clarification Issued

Saudi Gazette, 7 March 2022: Saudi Arabia’s General Organisation for Social Insurance has issued a Nitaqat clarification.

They have introduced a new mechanism which means Saudi employees will only be included in the firm’s Saudisation programme with their knowledge express consent.

The express consent will be evidenced by a signature on an electronic contract.

The aim is to avoid their names being exploited.

Under the mechanism, when a company or establishment wants to hire a Saudi citizen, the Saudi national must accept the contract sent to them by the firm within seven days.

If they are not, they will not be counted in the Nitaqat programme and the contract will be rejected automatically.

Previously, the Organisation allowed Saudi employees to be calculated in the Nitaqat programme without their approval of the contract.

Where a Saudi employee agrees to the electronic contract, they will receive a message stating they are registered in the social insurance system.

The employee’s wage and insurance subscription number will be mentioned in the message. At the same time, the employer will receive a message stating the employee’s registration has been approved.

In terms of non-Saudi employees, their data will be sent from the Human Resources and Social Development Ministry to the Organisation after their sponsorship is transferred or they enter the Kingdom.

A message will then be sent to the employer from the Organisation stating they have a non-Saudi subscriber who needs to update their information.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.

Saudi Arabia: Excess Cash Must be Disclosed

Saudi Gazette, 25 February 2022: Saudi Arabia’s General Authority of Civil Aviation has issued a circular to all airlines operating in Saudi airports on the necessity of excess cash, jewellery and precious metals being declared.

Airlines must educate passengers who are departing and arriving in the Kingdom about the requirement.

The disclosures must be made to the relevant authorities.

Also reported in Al Riyadh on 24 February 2022. For full story, click here.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.

Saudi Arabia: Legal Practice Law Amended

Saudi Gazette, 18 February 2022: Saudi Arabia’s Justice Minister has announced the Cabinet has approved proposed amendments to the Kingdom’s Legal Practice Law.

The amendments specify new conditions for foreign law firms in Saudi Arabia.

They create a regulatory framework for foreign law firms and include a number of conditions which foreign offices must meet to obtain a licence to practice the profession in the Kingdom.

In addition, they include a number of provisions which will contribute to improving the efficiency of the profession.

The amendment reduces the period of experience required to obtain a lawyer’s licence in the Kingdom from three to two years.

The rule which allowed unlicenced agents to plead has also been repealed.

This move is aimed at protecting the legal profession, improving its standards and developing the control of professional obligations and responsibilities.

There are also procedures for filing and reviewing disciplinary cases, boosting the principles of integrity and transparency and ensuring the necessary guarantees are provided.

They are aimed at developing and supporting the law profession in the country.

The Justice and Commerce Ministries and Saudi Bar Association have been involved in the drafting of the amendments.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.

Saudi Arabia: Commercial Concealment Deadline Will Not be Extended

Saudi Gazette, 15 February 2022: The National Programme to Combat Commercial Concealment has announced the deadline to comply will not be extended.

The deadline is 16 February this year.

The compliance deadline was previously extended to 16 February 2022 on 23 August 2021.

Those who do not comply after this date will be jailed for up to five years and/or fined up to five million Riyals.

Illegal assets and funds of those involved in these offences will also be confiscated. Also reported in Al Riyadh on 14 February 2022. For full story, click here.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.

Saudi Arabia: Banks Cannot Open Accounts for Entities Involved in Illegal Operations

Saudi Gazette, 6 February 2022: Saudi Arabia’s Central Bank has announced local banks in the Kingdom are banned from allowing accounts to be opened by entities which are involved in illegal operations.

The Bank has also instructed banks to notify customers about their accounts being frozen at least 30 days before they are frozen.

The changes are contained in updated Bank Account Rules which are mandatory and have to be enforced by Saudi banks from 2 February 2022.

Banks will be able to carry out outgoing remittance transactions and cheques sold by customers who are account holders.

Under the amendments, banks cannot open bank accounts for investment companies, investment funds, foreign financial institutions, including investment companies in the Gulf countries or their intermediaries who sell their products illegally in the Kingdom and collect money in Saudi Riyals and foreign currencies.

Saudi banks can also not facilitate these illegal businesses in any way.

However, there are exemptions for the categories of entities which the Saudi Capital Market Authority allows to invest in shares of Saudi joint stock companies.

All Saudi national banks will have to submit a statement at the end of March annually to the Bank in the correct form.

This statement will have to include an inventory of unclaimed accounts and abandoned accounts whose holders have been cut off from the bank.

The statement will have to comply with the nature and category of accounts and account numbers without mentioning personal information, as of the end of December of the previous year.

These unclaimed and abandoned accounts should be internally audited every two years and the report submitted to the audit committee.

The annual audit programme is not linked to any other periodic programmes related to the accounts.

Under the amendments, Saudi banks have the right to freeze the account once the validity of the official employment contract has expired or the requirement to update banking information has not been complied with.

The account can also be frozen where financial and personal information and addresses of account holders is not submitted.

In addition, banks are banned from enabling customers to personally carry out banking operations using the account after the validity of their ID has expired unless they have renewed or updated the Know Your Customer information.

There will be an exemption for all deposits. This will include incoming local and international transfers. Exemptions will also be given to accounts of Government employees whose salaries are received through the banks, but their accounts were frozen or they were unable to provide national identity cards because of any legal problems.

These employees will have 180 days from the date of the expiry of their IDs or from the last date for the update.

Banks must open accounts for any customers who make a request of this kind provided they submit all the required documents and meet the conditions for the account opening process.

The banks must agree to open the account without putting conditions to deposit any amounts at the time of opening the account. In the event of any amounts not being deposited within 90 days after opening the account, the banks must close the account.

However, there will be an exemption for the accounts of Government agencies. This has been approved by the Finance Ministry. The Ministry will determine the exemption period for amounts to be deposited.

The bank accounts of prisoners will be opened when they approach the banks accompanied by security guards affiliated with the General Administration of Prisons. The banks must obtain a letter from the prison administration in the city where the prison is located. It must be addressed to the bank branch mentioning the prisoner’s name, ID or iqama number and their intention to open the account.

To view more news items and other content we have available, visit lexis.ae/demo to book a demo and start your free trial of Lexis® Middle East.

Want to learn more about Lexis® Middle East? Visit, https://www.lexis.ae/lexis-middle-east-law/.