TMT focus
The rapidly growing and evolving digital landscape requires governments and authorities to adapt and develop new laws to protect against crimes committed on or using the internet. The UAE has been a pioneer in this respect, issuing the Federal-Decree Law no 34 of 2021 Concerning the Fight Against Rumours and Cybercrime (the “New Cybercrimes Law” or the “Law”) in November 2021. The New Cybercrimes Law intends to cover more sophisticated and complex cybercrime issues and repeals the previous cybercrimes law (Federal Decree Law No. 5 of 2012 Concerning Anti-Cybercrimes and its amendments) (the “Previous Cybercrimes Law”). It came into force on 02 January 2022.
The Law captures crimes conducted over the internet including on social media, penalises spreading fake news and publishing misleading advertising, and legislates against failing to respect an individual’s privacy, especially in relation to children. The Law also makes direct references to the new UAE Data Protection Law (Federal Decree Law No. 45 of 2021) and new Penal Code (Federal Decree Law no 31 of 2021), which need to be complied with. Previously, issues such as cyberattacks, personal and government data, electronic robots and cryptocurrency, were not addressed, which have now been introduced and impose hefty penalties (both imprisonment and fines), for non-compliance. The Law works in tandem with the Penal Code and can result in penalties under both the Law and the Penal Code.
This article takes a look at the New Cybercrimes Law from a digital media aspect and summarises the key points you need to consider when conducting any activity online, as a business or an individual. This article should be read in conjunction with our litigators’ view of the New Cybercrimes Law. This article is not an exhaustive review of everything in the New Cybercrimes Law. For example, it does not cover the provisions covering hacking and similar offences in Chapter 1 of the New Cybercrimes Law or relating to electronic payments, crypto assets and cryptocurrencies
Chapter 2, Branch 1 focuses on specific types of content that could give rise to a crime. Articles 20 – 28 provides that anyone who creates, manages or supervises a website or publishes information or software that call for protests or incite propaganda that harm the national unity, social peace or violates the public order or public morals and jeopardizes the interests of the state, or publishes ideas that oppose the UAE, its institutions and its political position or abuses a foreign country, shall be sentenced to imprisonment or face fines up to two million Dirhams (2,000,000). Any crime committed as per these aforementioned Articles (or any other provision under the Law), Law for the benefit of or in favour of a foreign country, terrorist group, organisation or body, are deemed to be crimes undermining ‘State security’.
Under the Previous Cybercrimes Law, publishing pornographic materials, gambling or materials that prejudice public morals were all grouped under one provision. Under the New Cybercrimes Law, each of these crimes are set out in detail including their respective penalties for non-compliance.
Article 33 provides that anyone who incites or seduces another person for or assists in the commission of prostitution or lewdness by using the information network or information technology method, shall face criminal penalties. The penalties increase if the victim is a child. Further, Article 34 covers crimes that harms public morals and involves pornography. Where the pornographic content includes or intends to seduce a child, the penalty is doubled. Similarly, the depiction of Islam should be carefully reviewed. Publishing abuse/blasphemy of the Islamic faith would extend to the act of apostasy and is strictly prohibited under Article 37. The penalties include fines up to one million Dirhams (1,000,000) and/or imprisonment for no more than 7 years.
From a media and regulatory perspective, creating, managing or supervising a website or publishing information that relates to or encourages gambling activities, other than as permitted under the Law, results in detention and/or fines up to five hundred thousand Dirhams (500,000). We are aware of activities that are similar to gambling but are classed as ‘promotions’ under the UAE Laws and require permits from the relevant authorities.
Although spreading defamatory content was prohibited under the Previous Cybercrimes Law, the New Cybercrimes Law makes specific reference to uses of an electronic information system or information technology method to make any alteration or processing of a recording, image or footage for purpose of defamation or abuse of another person under Article 43. In which case, that person shall be sentenced to detention for a period of not less than one year and/or to pay fine of not less than (250,000) two hundred fifty thousand Dirhams and not more than (500,000) five hundred thousand Dirhams. This provision is quite broad in that it applies to using a recording etc. for the purpose of defamation or abuse. On that basis, the requirements of a defamation claim do not necessarily have to be proven, as the key to this provision is the intention behind the publishing of the content.
The internet has facilitated financial fraud on a large scale. This has increased with the developing interest in digital currencies, as individuals are competing to take advantage of developing trends in the industry. Under Article 41 of the New Cybercrimes Law, individuals who calls for or propagate a competition or crypto-currency or create or manage false portfolios or companies to receive or collect funds from the public for investment, management, utilization or development, without license from the concerned bodies, shall be sentenced to detention for a period of not more than (5) five years and/or to pay fine of not less than (250,000) two hundred fifty thousand Dirhams and not more than (1,000,000) one million Dirhams.
This Law also extends to fraud and begging conducted over the internet. This can include impersonation or false identities created for fraudulent purposes (Article 40), or for extorting and threatening another person to commit a crime, the penalty shall be provisional imprisonment up to 10 years.
The New Cybercrimes Law provides firm rules on misleading or fake advertisements that promote services or goods, both directly or indirectly under Article 48. Additionally, anyone who divulges, publishes, re-publishes, circulates or recirculates fake news or data, or false, malicious, misleading or incorrect reports or rumors that contravenes the officially announced news, or transmits any provocative promotions that arouse or provokes the public opinion, disturbs the public peace, intimidates the people or harms the public interest, the national economy, the public order or the public health can face hefty fines under Article 52.
The New Cybercrimes Law introduces the definitions of data, personal data, secret data and ‘itinerary’ data. It also includes provisions on the protection of personal data relating to children below the age of 18. Article 6 states that anyone who obtains, acquires, modifies, damages, discloses, leaks, deletes, copies, publishes or re-publishes personal data or information without authorisation shall be in violation of the Law. Aggravating circumstances arise where the personal data or information is related to medical examinations, diagnoses, treatment, care or records, bank accounts or data and information of e-payment methods. Further, if anyone receives, keeps, stores , accepts or uses any of these personal data and information knowing that it is unauthorised, and does not delete it, can face detention and / or pay a fine. Article 7 places the same restrictions with regards to confidential government data obtained without authorization and Article 8 on financial, commercial and economic establishments (i.e. bank and company data). It is important to review these provisions in tandem with the new UAE federal data protection law and understand which law would apply in certain circumstances.
Technology is developing at a rapid pace. As the digital world creates more opportunities for us, it also leaves us vulnerable to cybercrimes.
The New Cybercrimes Law is directed at both the owners and operators of an electronic site or information network, so a safe harbor would not be generally available under the Law. Social media platforms, owners of electronic businesses and accounts, websites containing user generated content, and the like, should be aware of the concept of intermediary liability covered under Article 19, when managing or publishing content, data or information which is inconsistent with the media content laws issued by various UAE authorities. Penalties range from thirty thousand Dirhams (30,000) to not more than three hundred thousand Dirhams (300,000) and/or imprisonment up to one year.
Article 53 provides that anyone who uses a website or an electronic account and stores, makes available or publishes illegal content and fails to remove or block access to such content during the period specified in the issued orders set out in this Law or abstains from compliance with one of the issued orders described in this Law shall be sentenced to pay fines of not less than (300,000) three hundred thousand Dirhams and not more than (10,000,000) ten million Dirhams. Further, Article 58 provides that the person in charge of de facto management of the juristic person (i.e. any employee, director, shareholder, or owner of a company that is not the actual violator of the crime) shall be subject to the same penalties prescribed for the actions committed in breach of the provisions of this Law. The juristic person shall be jointly held liable for the judged fines or remedies, if the offence is committed by an employee, in name and in favor of the juristic person. As such, the New Cybercrimes Law applies to the content creator, the party that hosts the user uploaded content and, in the case the content creator is an employee of a company, the company as well.
Article 59 of the Law authorizes a competent authority to issue a takedown notice, and any party that has received such notice is required to respond to the relevant authority within the period specified. Abstaining from compliance can lead to more serious actions being taken against the party(ies) by the competent authorities. We note that this can extend far beyond the UAE if needed, and can affect foreign content and platforms from being made available in the UAE. We note that such takedown requirements are similar to those in other jurisdictions.
Technology is developing at a rapid pace. As the digital world creates more opportunities for us, it also leaves us vulnerable to cybercrimes such as hacking and false news and advertising. It is for these reasons that the UAE Government reformed this area of the law and introduced the New Cybercrimes Law to help protect against online criminals and misinformation.
Companies and individuals operating in the digital media space need to ensure they fully understand the scope of the New Cybercrimes Law and take active steps to implement cybersecurity procedures and internal policies to review content distributed online. This can be challenging when working with third party providers and external content producers.
For further information, please contact Martin Hayward.
Published in June 2022
