An overview of Saudi Arabia’s new Telecommunications & Information Technology Law – Part II
Technology, Media & Telecoms Focus
Saudi Arabia has recently issued a ‘new’ telecommunications law, which replaces the ‘old’ telecommunications law from 2001.
Law Update: Issue 358 - Technology, Media & Telecoms Edition
Nick O'ConnellPartner, Head of Digital & Data, Saudi Arabia
Saudi Arabia has recently issued a ‘new’ telecommunications law, which replaces the ‘old’ telecommunications law from 2001. In this article, the second in a two-part series, we provide a brief overview of the new law, with reference to the old Law. At the time of writing this article, the anticipated By-laws (Implementing Regulations) of the Telecoms & IT Law have not yet been published.
Saudi Arabia has recently issued a ‘new’ telecommunications law, the Telecommunications and Information Technology Law 2022 (“Telecoms & IT Law” or the “new Law”). The new Law was issued under Council of Ministers Resolution No. 592 (dated 01/11/1443H; 31 May 2022) and approved by Royal Decree No. M/106 (dated 02/11/1443H; 2 June 2022). It was published on 10 June 2022, and came into effect on 8 December 2022, 180 days after publication in Umm al Qura, the official gazette. The Telecoms & IT Law replaces the ‘old’ Telecommunications Law 2001 (“Telecoms Law” or the “old Law”) issued under Council of Ministers Resolution No. 74 (dated 05/03/1422H; 27 May 2001)) approved pursuant to the Royal Decree No. M/12 (dated 12/03/1422H; 3 June 2001).
The new Law is without prejudice to the validity of licences issued prior to its implementation, although such licensees are required to ensure compliance with the new Law’s requirements within twelve months of the new Law coming into effect (so, by early December 2023). The Ministry of Communications & Information Technology is the responsible ministry, although authority responsible for the telecommunications and information technology sector, and the application of the new Law, is the Communications, Space & Technology Commission (the “Commission”). (The Commission, known locally as “CST”, was until recently known as “CITC” (the Communications & Information Technology Commission).)
Information sent or received through public telecommunication networks, including telephone calls, are considered confidential. They may not be accessed or recorded except as specified in the Implementing Regulations.
Service providers are required to take all necessary measures to ensure personal data is protected and kept confidential. The new Law refers to an obligation to prevent unauthorized access and disclosure, and to prepare appropriate policies for submission to the Commission for approval. The new Law makes clear that, subject to applicable law, a user’s information cannot be disclosed without the user’s consent. It also specifies that details of data breach incidents need to be communicated to the Commission, and to users, immediately. It will be necessary to consider how the personal data protection provisions in the new Law interplay with other obligations, including under the Commission’s own data protection rules, and with regard to the new Personal Data Protection Law that is expected to be finalised early in 2023.
The provisions relating to frequency spectrum seem very similar to those under the old Law. Frequency spectrum is a natural asset owned by the State. The Commission is responsible for preparing the National Frequency Spectrum Plan, although responsibility for allocation ultimately sits with the Ministry of Communication & Information Technology (subject to approval of the Council of Ministers under the old Law), in consultation with the military and security agencies. The Commission is responsible for managing frequency spectrum allocated for civil and commercial use. The Commission is also responsible for setting necessary controls and standards of conformity relating to exposure to electromagnetic fields, etc. The Commission also has the right to stop the use of devices in contravention of the rules relating to the use of frequency spectrum, and to have competent security agencies assist if required. The Commission is required to maintain a national register of frequency spectrums allocated in the Kingdom; the extent to which this will be publicly available is unclear.
The provisions relating to interconnection and access are also very similar to those under the old Law. The Implementing Regulations will set out basic details relating to interconnection and access, which the Commission may augment. There is a prohibition on service providers entering into any interconnection or access agreement that would endanger people or property, or damaging other communications or information technology networks or services.
There is a basic requirement for service providers to meet reasonable requests from other service providers for interconnectivity or access. (Specific considerations apply to service providers with a dominant market position.) If service providers are unable to reach an agreement, the Commissioner can be approached to issue a binding decision.
If it is necessary to install any equipment, or establish or maintain telecommunication networks within public or private properties in order to provide services, service providers must reach an agreement with the property owner. If it fails to reach an agreement with the property owner, the service provider may approach the Commission for a formal direction. A building owner cannot charge a service provider to grant access in order for the service provider to connect a resident/tenant, nor can a building owner decline to provide access to a service provider for such purposes without lawful reasons. In the event of a dispute, either party may approach the Commission for resolution.
As with the old Law, there is a requirement to obtain the approval of the Board before any merger with another service provider, and there is an obligation to notify the Commission within five working days of an initial agreement. Similarly, anyone purchasing 5% or more of the shares of a service provider, or a percentage that would result in a dominant position in the relevant market, would need to obtain prior approval from the Board.
The provisions prohibiting abuse of a dominant position in the market also seem to mirror those found in the old Law. Abuse of a dominant position is prohibited, and the Implementing Regulations are expected to set out the basis upon which activity is considered an abuse of market dominance. Service providers are also restricted from entering agreements that would prevent, restrict or distort competition.
The new Law requires the Commission, in coordination with other competent entities (presumably entities such as the General Commission for Audio-visual Media, which is responsible for media content standards in the Kingdom), to filter the internet and restrict access to certain services. It also prohibits the bypassing of internet filtering and the facilitation of circumvention measures. This is an interesting development, as it seems to impact the use of technologies such as VPNs, which – anecdotally, at least – seem somewhat commonly used in the Kingdom.
The new Law addresses a number of other considerations, including providing that the Commission shall:
provide technical support and assistance to implement final judgments issued against digital platform service providers.
provide for consumer protection and address consumer complaints, as further detailed in the Implementing Regulations;
act (upon application of a service provider) as a dispute resolution forum for disputes between service providers - subject to a right to refer disputes to the competent court;
set rules around tariff rates, agreements with foreign telecoms companies regarding international roaming or any other telecoms service, and production, sale, promotion or use of calling cards;
set (in coordination with SASO, the Saudi Standards, Metrology and Quality Organization) technical specifications and standards for communications and information technology devices, and take measures necessary to ensure compliance;
set (and manage) the national numbering plan; and
be responsible for Saudi domain names, including registration, regulation, dispute resolution, etc., and coordinating with relevant international organizations.
The new Law also contemplates further details relating to universal service and number portability to be addressed in the Implementing Regulations, as well as further details around emergency measures allowing the Minister to compel service providers to make services available free of charge, require interconnection between service providers in a manner that services the public interest, restricting the use of frequency spectrum, and other matters.
The new Law covers substantially the same subject matter as the old Law, but it does so in a much more coherent document and with broader application. It has a clear focus on the importance of telecommunications and technology in the development of the economy. The Implementing Regulations will add a lot of necessary detail, so – as is often the case – it will be important to ‘watch this space’.
For further information, please contact Nick O'Connell or Zil-ur-Rehman.
Published in May 2023
