Posted by: amj_admin on February 8, 2024 - 6:33 am

The eagerly anticipated Executive Regulations to the Oman Data Protection Law Royal Decree 6/2022 (“PDPL”) were recently issued on 28 January 2024 through Ministerial Decision 34/2024 (“Executive Regulations”).

Some of the key provisions of the Executive Regulations are as follows:

1. Article 10 of the PDPL requires the express consent of data owners to be obtained before the processing of their personal data and stipulates that such data must be processed within a framework of transparency, honesty, and respect for human dignity, whereby “personal data” is defined as data that makes a natural person identifiable, or capable of being identified directly or indirectly, by reference to one or more identifiers, such as name, ID number, electronic identification data, location data, or by reference to one or more factors related to genetic, physical, mental, psychological, social, cultural, or economic identity.

   Article 4 of the Executive Regulations further sheds light on the requirements for the consent to be a valid consent, such requirements being, the consent (i) is issued by a person with full capacity; (ii) is given in a clear manner and without coercion and (iii) issued in writing, electronically, or by any other means specified by the data controller.

2. Article 5 of PDPL provides that the processing of sensitive personal data relating to genetic, biometric, heath data or data relating to ethnic origin, sexual life, political or religious opinions, beliefs, criminal convictions, or related security measures is prohibited unless a permit is obtained from the Ministry of Transport, Communications and Information Technology (“MTCIT”).

   The Executive Regulations now provide guidelines regarding information that is required to be submitted by data processors applying for such permits, provided for under Article 5 of the PDPL and states that the MTCIT has 45 days to decide on the application. If the MTCIT fails to respond within this time limit, the application will be deemed to be automatically rejected. The applicant has the right to appeal such rejection within 60 days from the date of being notified of such rejection before the Minister of MTCIT (“Minister”), but if the Minister fails to respond within 30 days, the appeal will be deemed to be rejected.

3. Article 11 of the PDPL provides for data owners right to have their personal data erased, retrieved, or transferred to another entity by the data controller. The Executive Regulations provide that data controllers have a duty to respond to requests from data owner within 45 days. If the data controller fails to respond to the request or denies it, the data owner has the right to complain to the MTCIT, and if the MTCIT fails to respond within 60 days, the complaint will be deemed to be rejected.

   Article 17 of the Executive Regulations provides for two grounds based on which a data controller may refuse to fulfil a request of the above nature, these being i) if a request is unjustifiably repetitive, and (ii) if a request requires extraordinary effort to fulfil. This in our view, may be seen as unreasonable for data owners who have genuine reasons to request the data controller to erase or transfer their personal data.

4. Article 23 of the PDPL provides that personal data may be transferred outside Oman subject to the standards and procedures to be set out in the Executive Regulations. The Executive Regulations provide clarity on such international transfers of personal data. Article 37 of the Executive Regulations provide that the data owner’s consent is sufficient to transfer its personal data outside borders of Oman provided such transfer of data shall not prejudice national security or the higher interests of the country and there are no requirements to obtain the approval of the MTCIT before doing so. Further, Article 38 also provides that it is the responsibility of the data controller to ensure that the external processing entity i.e outside of Oman to whom such data has been transferred to, has adequate protection in place for such personal data, which may not be less than the level of protection prescribed in PDPL and Executive Regulations. Personal data may be transferred internationally without the consent of the data owner if (i) it is in implementation of an international obligation under an agreement to which the Sultanate of Oman is a party, or (ii) if the transfer was carried out in such a way as to conceal the identity of the data owner, not linking the data to him/her, and is not identifiable in any way whatsoever.
5. According to the PDPL, a number of obligations are imposed on data controllers and processors, which include the obligation to appoint a data protection officer, the selection controls and criteria for which were to be determined by the Executive Regulations. Whilst Article 35 of the Executive Regulations provide for a number of responsibilities which are required to be fulfilled by a data protection officer, it does not provide for the categories of data controllers who are required to appoint a data protection officer, which essentially means that any data controller who is holding personal data of any nature, is required to appoint a data protection officer.
6. Article 44 of the Executive Regulations provides for the imposition of penalties in case of non-compliance with the Executive Regulations. When considering the imposition of any of the penalties, the Minister may in the exercise of his discretion (i) issue an official warning; (ii) suspend the permit until the violation is remediated; (iii) impose a fine not exceeding 2,000 (two thousand) Omani Rials for each violation, and (iv) cancel the permit.

As these Executive Regulations have only recently been issued, much will depend upon their interpretation and application by the MTCIT with reference to the PDPL.

Author details

Anjali Kotak

Associate 

Commercial and Capital Markets 

Al Busaidy, Mansoor Jamal & Co

Tel: +968 24829200

Email: anjali.kotak@amjoman.com

Posted by: amj_admin on July 16, 2018 - 7:52 pm

Oman is poised for a resurgence of investor interest in its extensive and mineral reserves including copper, chromite, gypsum, limestone, marble and potash.  The development of the mining and quarrying sector is a key pillar of the Sultanate’s economic diversification strategy as set out in the current ninth five-year plan 2016-2020.

A recent uptick in applications for copper mining licences reflects both Oman’s efforts to attract investment in the sector, and higher copper prices supported by increased electrification and growing global supply deficits. The grant of a copper mining licence, the first since 2004, to Al Hadeetha Resources (AHR) in June, marks the resumption of copper mining after a lengthy hiatus (output of copper ore dropped to zero in 2016). AHR is a joint venture between Australian-based mining firm, Alara Resources and Omani firm Al Hadeetha Investment formed in 2011 for the purpose of exploring and developing mining initiatives in the sultanate. The Al Hadeetha copper project at Washihi, the single-largest copper resource in Oman, is set to become the next producer of copper concentrate in Oman. The award of the EPC contract for the project’s copper concentrator plant with a capacity of 1 million tonnes per annum is imminent.

The UK’s Savannah Resources PLC also reported early July that they have made progress on obtaining mining licences for the first two of a planned series of high-grade copper mine developments in Oman. Savannah, a 65% shareholder in the Omani company Al Fairuz Mining, the holder of the Block 5 exploration licence, which includes the Mahab 4 and Maqual South copper deposits, has received ministerial sign-off clearing the way for the grant of a licence.

A new mining law and the national mining strategy currently in development by the Public Authority of Mining in collaboration with a consortium of international firms, are expected to be unveiled shortly in the second half of 2018. The draft Mineral Wealth law, which has undergone extensive stakeholder consultation for several years, as well as legislative scrutiny, edged closer to ratification after a joint meeting of Oman’s upper and lower houses of parliament at the end of June succeeded in consolidating views on a final draft. Hopes are high that the new law will add impetus to the solid minerals extractives sector by streamlining the licence application process (which currently requires regulatory approval from eight different ministries), and by extending the current five-year licence periods and mandatory annual renewal requirement.