UAE - ADGM: Government and Public Agency Exemption

The ADGM Data Protection Regulations 2021 (ADGM DPR) partially incorporates the government and public agency exemption, limiting its application to specific circumstances rather than providing a blanket exemption.

Text of Relevant Provisions

ADGM DPR s.44(2):

"(2) Sections 44(1)(a), 44(1)(b) and 44(1)(c) do not apply to activities carried out by public authorities in the exercise of their public powers."

Analysis of Provisions

The ADGM DPR does not provide a comprehensive exemption for government and public agencies. Instead, it offers a limited exemption in specific contexts. Section 44(2) states that certain derogations for international transfers of personal data "do not apply to activities carried out by public authorities in the exercise of their public powers".

This provision specifically exempts public authorities from relying on three particular grounds for international transfers when they are exercising their public powers:

1. The data subject's explicit consent (s.44(1)(a))
2. The necessity for performance of a contract between the data subject and the controller or implementation of pre-contractual measures taken at the data subject's request (s.44(1)(b))
3. The necessity for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person (s.44(1)(c))

The rationale behind this exemption is likely twofold:

1. To prevent public authorities from relying on consent as a basis for international transfers, recognizing the potential power imbalance between public authorities and individuals.
2. To acknowledge that public authorities, when exercising their public powers, are typically not engaged in contractual relationships with data subjects in the same way private entities might be.

It's important to note that this exemption is narrow in scope. It does not exempt public authorities from the ADGM DPR entirely, nor does it exempt them from all provisions related to international transfers. Public authorities must still comply with the general data protection principles and other requirements of the ADGM DPR.

Implications

This limited exemption has several implications:

1. Public authorities must find alternative legal bases for international transfers when exercising their public powers. They may need to rely on other derogations listed in s.44, such as important reasons of public interest or the establishment, exercise, or defense of legal claims.
2. Public authorities are still subject to the general provisions of the ADGM DPR, including data protection principles, data subject rights, and security requirements.
3. When public authorities are not exercising their public powers (e.g., in commercial activities), they may be able to rely on consent or contractual necessity for international transfers.
4. Private entities working with public authorities should be aware that these authorities may have different legal bases for international transfers compared to private sector partners.
5. Data protection officers and legal advisors working with public authorities in ADGM need to carefully consider the legal bases for international transfers, especially when the authority is exercising its public powers.

This approach in the ADGM DPR strikes a balance between recognizing the unique position of public authorities while still maintaining a high standard of data protection across both public and private sectors.