Regulation 10 is the first enacted regulation in the MEASA region on the processing of personal data via autonomous and semi-autonomous systems.
Regulation 10 is the first enacted regulation in the MEASA region on the processing of personal data via autonomous and semi-autonomous systems such as artificial intelligence (AI) or generative, machine learning technology.
Dubai, UAE, September 7, 2023: Dubai International Financial Centre (DIFC), the leading global financial centre in the Middle East, Africa, and South Asia (MEASA) region, has enacted amendments to the Data Protection Regulations. The amendments enhance the current data protection framework, keeping the Centre at the forefront of data protection in the region.
Amendments to the Data Protection Regulations
The amendments to the Data Protection Regulations address the means for better, safer, and more ethical management of personal data processing and operations. The updated regulations provide clarity on:
- Personal Data Breach Assessment and Reporting Obligations in Regulation 8, including situations where a temporary custodian finds personal data that has been inadvertently left behind or lost;
- Use and collection of personal data for marketing and communications, particularly regarding appropriate notices when employing systems that may impair individuals rights to restrict or remove their personal data, default cookie settings, and conditions for consent, as set out in Regulation 9;
- Investigations and enforcement powers of the Commissioner when a controller or processor may employ unfair or deceptive practices as defined in Regulation 6.2;
- Personal data processed through digital, generative technology systems under Regulation 10
In particular, Regulation 10 is ground-breaking as it is the first enacted regulation in the MEASA region on the processing of personal data via autonomous and semi-autonomous systems such as artificial intelligence (AI) or generative, machine learning technology. A key feature of Regulation 10 is that it creates space for DIFC to be a platform for interoperability of the many and varied guidelines and principles issued by sovereign governments and non-governmental organisations. Creating a plug-and-play space for the application of ‘best fit’ principles to AI technology development is fundamental, responsible and ethical processing of personal data in such systems.
Commenting on Regulation 10, Jacques Visser, DIFC Commissioner of Data Protection, said: “DIFC’s outcomes-based approach vis-à-vis the application of the DP Law 2020 obligations to the development and use cases for systems provides a more collaborative, transparent way of creating and maintaining an innovative yet safe autonomous system.”
Use cases are expected to be tested through further consultation, inspection, or supervision. The Commissioner’s Office is also considering testing use cases through participation in a regulatory sandbox comprised of technology developers, users, regulators, and non-governmental or quasi-governmental organisations, all of whom have an interest in keeping systems safe and their uses practical for the digital age.
Guidance will be issued to accompany the updated regulations in due course. Further details about the amended Data Protection Regulations can be found in the DIFC Legal Database, which can be accessed here.
Also read: Addressing Security Challenges Beyond 2023: Recommendations for CIOs and Technology Leaders
Do Follow: CIO News LinkedIn Account | CIO News Facebook | CIO News Youtube | CIO News Twitter
About us:
CIO News, a proprietary of Mercadeo, produces award-winning content and resources for IT leaders across any industry through print articles and recorded video interviews on topics in the technology sector such as Digital Transformation, Artificial Intelligence (AI), Machine Learning (ML), Cloud, Robotics, Cyber-security, Data, Analytics, SOC, SASE, among other technology topics.
