Data Protection Report - Norton Rose Fulbright

It has been reported that Saudi Arabia’s Cabinet has approved changes to the Kingdom’s Anti-Cyber Crime Law (Royal Decree No. M/17 dated 8 Rabi1 1428) that could allow offenders to be publicly named and shamed.

Article 6 of the Law currently provides for a penalty of up to five years’ imprisonment and/or a fine not exceeding three million riyals (USD 800,000) for any person found guilty of a range of offences, including the “production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, and privacy, through the information network or computers”. The additional powers granted to the courts under the amended provision will allow the publication of a summary of the ruling in one or more local newspapers or any other medium deemed suitable by the court in the context of the type of the crime, its severity and its impact. The publication can only be made once the ruling gains the status of “final ruling,” and the offender may also be required to pay for the costs of publication.

It is an interesting development in a region of emergent privacy laws. The ability to publish a person’s name and details of a criminal offence they have committed – information that would be ‘sensitive personal data’ under European data protection laws – creates an exception to the usual rights that would be available to a person to protect their personal privacy or reputation. The effect of the legislation is such that those rights are lost if the person is found guilty of violating another person’s privacy.

Public naming and shaming has long been a tool for pressure groups and activists, particularly in countries with high social and reputational values. The internet and social media have dramatically increased the ease and speed with which a person’s reputation can be condemned. In 2005, a woman in South Korea became known as Dog Poop Girl online after she was identified for having failed to pick up her pet’s mess on the subway. It was reported that she quit university as a result of the consequent harassment after her name and photograph was published.

This phenomenon, of course, is not limited to the Middle East and Asia. In the United States, DroughtShame is a crowdsourcing app designed to capture geotagged photographic evidence of citizens who ignore California’s strict water restrictions, and controversy has been ongoing over the launch of the ‘.sucks’ gTLD that ostensibly allows for websites to be established for the sole purpose of criticising a person, company or brand.

Saudi Arabia’s law changes are an example of the increasing willingness of legislators to use social shaming as a deterrent for anti-social offences. The Chinese government recently announced increased penalties for violators of the country’s anti-smoking laws including public naming and shaming of smokers, while the laws in the Australian state of Victoria were amended in 2014 to give victims of domestic violence the right to name and shame their attackers.

However, it should be remembered that, outside these legalised forms of publication, there are often restrictions under libel and privacy laws that prohibit direct and public shaming of individuals or companies. In 2011, the DubaiNameShame website and Twitter page was closed following warnings that posting the names and incriminating photographs of bad drivers and companies giving poor customer service in the UAE was illegal under local libel laws. And in the United Kingdom, a police force was investigated by the Information Commissioner’s Office last year for potential violations of the Data Protection Act in relation to a campaign of naming and shaming drunk drivers.