An Overview of Saudi Arabia’s new Telecoms & Information Technology Law – Part I
Saudi Arabia Focus
Nick O’ConnellPartner, Head of Digital & Data - Saudi Arabia
Saudi Arabia has recently issued a ‘new’ telecommunications law, which replaces the ‘old’ telecommunications law from 2001. In this article, the first in a two-part series, we provide a brief overview of the new law, with reference to the old Law. At the time of writing this article, the anticipated By-laws (Implementing Regulations) of the Telecoms & IT Law have not yet been published.Saudi Arabia has recently issued a ‘new’ telecommunications law, the Telecommunications and Information Technology Law 2022 (“Telecoms & IT Law” or the “new Law”). The new Law was issued under Council of Ministers Resolution No. 592 (dated 01/11/1443H; 31 May 2022) and approved by Royal Decree No. M/106 (dated 02/11/1443H; 2 June 2022). It was published on 10 June 2022, and came into effect on 8 December 2022, 180 days after publication in Umm al Qura, the official gazette. The Telecoms & IT Law replaces the ‘old’ Telecommunications Law 2001 (“Telecoms Law” or the “old Law”) issued under Council of Ministers Resolution No. 74 (dated 05/03/1422H; 27 May 2001)) approved pursuant to the Royal Decree No. M/12 (dated 12/03/1422H; 3 June 2001).The new Law is without prejudice to the validity of licences issued prior to its implementation, although such licensees are required to ensure compliance with the new Law’s requirements within twelve months of the new Law coming into effect (so, by early December 2023). The Ministry of Communications & Information Technology is the responsible ministry, although authority responsible for the telecommunications and information technology sector, and the application of the new Law, is the Communications, Space & Technology Commission (the “Commission”). (The Commission, known locally as “CST”, was until recently known as “CITC” (the Communications & Information Technology Commission).)
Significantly, the new Law is subject to the responsibilities and duties of the National Cybersecurity Authority. The Commission needs to work with service providers to ensure that their operations are compliant with NCA requirements; and the NCA has powers to ensure compliance.
The scope of the old Telecoms Law was somewhat ambiguous, with the definitions of “telecommunications”, “telecommunications service” and “telecommunications network” not sitting particularly well with each other, seeming to lead to a limited scope of application.
The most significant changes can be found in Chapter 2 of the Telecoms & IT Law, which relates to licensing considerations. The scope of the old Telecoms Law was somewhat ambiguous, with the definitions of “telecommunications”, “telecommunications service” and “telecommunications network” not sitting particularly well with each other, seeming to lead to a limited scope of application. As is apparent from the name of the new Law, one driver behind the change in the legislation is to make clear that it extends to information technology related activities and not simply telecommunications.
Under the new Law, as was the case under the old Law, it is necessary to obtain a licence from the Commission before providing telecommunications services to the public or using a telecommunications network to do so. The new Law clearly states that a licence is required from the Commission before providing infrastructure for public telecommunications services. The use of numbering resources and frequency spectrum also require licences from the Commission, as do the provision of .sa domain name services.
The Board of the Commission is able to require that licences, permits or registration be required from the Commission in other circumstances. Some of these circumstances are specific: acquiring or using telecoms or IT equipment, or establishing a private communications network. Others are more general: providing certain services relating to telecoms or information technology, the nature of which (and the associated provisions) are to be determined by the Commission. The new Law specifically provides that the Commission shall classify licensing, registration and permitting into categories and set special terms and conditions, with which licensees, registrants and permit holders shall be required to comply. This does not seem materially different from the old Law, pursuant to which the Commission was authorised to classify and identify types of licences and the associated conditions.
Otherwise, two key differences are apparent. The first is that the new Law specifically contemplates the regulation of digital content platforms; no surprise here, given that there was a public consultation on the topic in early 2022. The second is that the new Law hints that the Commission may be able to require licensing of private communications networks; something specifically excluded from the application of the old Law. (Like the old Law, the new Law requires the approval of the Commission before connecting a private communications network to the public telecommunications network.)
The new Law provides the Commission with the power to cancel, suspend, or reject renewal of a licence, registration or permit if the licensee, registrant or permit holder fails to address violation within a reasonable period, or if the entity is no longer in existence, or in other cases to be specified in the Implementing Regulations. The Board has powers to cancel, amend or suspend a licence, registration or permit in the event of changes in the market, in technologies, or in the National Frequency Spectrum Plan. There is also scope for a licensee, registrant or permit holder to apply to the Commission for cancellation, suspension or amendment; if the Commission does not grant the request, it has power to take measures to ensure continuity of service.
The licensee, registrant or permit holder needs to obtain the permission of the Commission in the event of fundamental changes in senior management, fundamental changes in ownership, or assignment of the relevant licence, registration or permit. Approval is deemed to be granted in the event that the Commission does not issue a decision to the contrary within 90 days of the date of the application for permission.
There is a requirement for the Commission to maintain a register recording details of licensees, registrants and permit holders, and their related licences, registrations and permits. Our expectation is that such details will be made available to the public, as has previously been the case under the old Law.
Similar to the old Law, the new Law provides for the Commission (by a decision of the Board) to appoint inspectors to detect and investigate violations, pursuant to the Commission’s power to investigate and prosecute violations. Inspectors need to properly identify themselves when performing their duties. It is not permitted to hinder inspectors, and it is necessary to provide reasonable assistance, such as providing all information and documents they request. Inspectors may seek assistance from security authorities, if necessary, to enable the inspectors to carry out their duties.
The Commission may suspend the service subject of the violation as a precaution. It is required to keep seized items (equipment, etc.) until the matter is decided on by a ‘Violations Committee’, and it may dispose of seized items if a final decision is issued proving the violation. (The new Law requires the Commission to establish one or more Violations Committees, and specifies the make-up of such committees.)
The number of provisions specifying violations under the new Law is significantly reduced relative to the old Law (ten provisions vs. twenty). This seems to be primarily a result of more efficient wording, with no obvious substantive omissions. Much like the old Law, the violations under the new law include a ‘catch-all’ violation (“Any other action that violates the provisions of the Act, the Implementing Regulations or the decisions of the regulatory authority.”), and may otherwise be summarized as follows:
Practising any activity for which a licence, registration or permit is required without first obtaining a licence, registration or permit;
Manufacturing, possessing, selling, renting or distributing any telecommunications or information technology device, equipment, hardware, tool, service, system, software, etc., that does not comply with the Commission’s approved technical specifications, standards, requirements or controls; or without the necessary licence;
Failure to provide the Commission with the required reports, information or documents, or providing misleading information, or otherwise obstructing the Commission;
providing misleading information to the public;
Any practice that prejudices competition in the telecommunications and information technology sector;
Misuse of telecommunications or information technology services; damage, infringement or disruption, or unauthorized use of telecommunication networks, whether intentional, or by negligence or omission.
Penalties available under the new Law are to be proportional to violation. They may include:
a fine not exceeding twenty-five million riyals (about USD 6.7M).
suspension (or blocking, in the case of digital content platforms) of the service the subject of the violation, in whole or in part;
suspension of licence to provide services, or restrictions on renewal of such licence.
publication of the decision, at the expense of the violator.
The violator must cease or correct the violation (depending on the circumstances) within the period specified by the Violations Committee, failing which further penalties may be applied.
The proceeds of a violation are to be paid to the Commission, with some allowance for compensation to affected users. Aggrieved parties may also claim compensation. A violator against whom the Commission has issued a decision has a right of appeal to the Minister; and a further right of appeal to the Board of Grievance would generally be available.
The new Law covers substantially the same subject matter as the old Law, but it does so in a much more coherent document and with broader application. It has a clear focus on the importance of telecommunications and technology in the development of the economy. The Implementing Regulations will add a lot of necessary detail, so – as is often the case – it will be important to ‘watch this space’.
For further information, please contact Nick O’Connell or Zil-ur-Rehman.
Published in March 2023.
