Oman's New Data Protection Law: Enforceability issues and is it too late?

Written by: Shahab Al Bulushi - Shahab@acolaw.net 
Edited by:  Reham Al Barakat - Reham@acolaw.net & Issam Alzein ialzein@expertom.com 

• Data is the new oil (16 years ago).

As has been repeatedly said over the last ten years, when the British mathematician Clive Humby declared in 2006 that "Data is the new oil,"

Facebook and Google were ahead in the market, utilizing data to understand consumers and target them. Many companies followed suit, and each discovered an intangible asset in Data that, if used correctly and in the absence of effective antitrust and Data protection laws, regulations, and implementation, those conglomerates had discovered gold in the form of Data.

• Too late? Data has undergone different changes that Oman has not grasped yet; the country is late to the process of the development of Data.

However, that was 16 years ago, and now we are in 2022, and Oman has released its first data-related law this year. The new Basic Statute of Oman, released last year, recognises privacy as one of the general principles that the country aims to protect. A data protection law would soon follow, and it did.

• One of the maxims of data is that everyone has the right to delete their data.

The law has retained general maxims known in data protection, including that everyone has the right to delete their data at any time; the rationale, therefore, is that since the person has willingly consented and entered his/her data into any website or platform, they have the right to delete it as well.

However, how far is that enforceable, especially in a country that has just started to recognize data in the absence of adequate expertise and understanding of data? A key question is how the executive bodies can detect any transgression or misuse of data.

• Data can be sold—for profit, and can be utilized to target consumers.

Users can often receive random promotions through their SMS or emails, and sometimes there could be a flood of promotional messages if someone is a regular shopper. Data can also be sold by companies who have more outreach than others. How can this private transaction and transfer be known to the executive bodies in Oman? It is again far from the eyes and hands of the bodies responsible for enforcing laws.

As Oman is becoming increasingly a consumerist society with the rise of goods to consume and services to obtain, data will ensue, and its importance will become more apparent. Reports have been released that social media platforms such as Instagram allegedly track customers and use their data to push for products and services that those users may opt for based on their likes and followings  (Location-tracking apps are definitely selling you out to advertisers - Vox). 

The ramifications of a consumerist society itself cannot be underestimated, as Edward Berners said in his book “Propaganda” that: “A crowd thinks in images, and the image itself immediately calls up a series of other images, having no logical connection with the first”; crowds “can only comprehend rough-and-ready associations of ideas,” leading to “the utter powerlessness of reasoning when it has to fight against sentiment.” “abstruse economic, political and ethical data, control and regiment the masses according to our will without their knowing about it”. This leads to control of choices, and furthering corporate powers and purchasing powers. In a relatively small market, the question remains, is the Omani regulator aware of the dangers of data and how it may be utilized in a manipulative way? 

• Data laws without actual implementation or understanding of their importance render them redundant. Change comes from the inside out.

 Michael Foucault understood power as "Power is everywhere" and "comes from everywhere," so in this sense, it is neither an agency nor a structure (Foucault 1998: 63). Instead, it is a kind of 'metapower' or 'regime of truth' that pervades society in constant flux and negotiation. Foucault uses the term 'power/knowledge' to signify that power is constituted through accepted forms of knowledge, scientific understanding, and 'truth.'" (Foucault: power is everywhere | Understanding power for social change | powercube.net | IDS at Sussex University).

Applying Foucault's understanding of power, the significance of data in Oman is not well grasped nor widely discussed within the pillars of society and individuals. As a result, only a few institutions and individuals understand the significance of data on account that the majority don't and thus may utilize the data without the latter's knowledge or control. Looking at the post-data law in Oman and the platforms of Omani ministries and executive bodies, they have been inactive in the area of data. And assessing from pre-data law, amidst the promotions and SMS advertisements received by users; nothing has been reported as a data breach to date; which means that the promotional messages are targeting specific users by guessing out numbers!

The Omani society in 2022 is yet to recognize the magnitude of data as an intangible asset, and this renders any law or regulation just words on paper, just like the intellectual property laws in Oman. Releasing laws without outreach by the government to the public about to the subject of the law “data”, how it may affect them and how they may report for any breach renders the data protection law just another law in the checklist to be released. 

The Royal Oman Police (RoP) has been the known authority for any such reports of breaches. However, the RoP is limited in resources and expertise when it comes to Data. Moreover, data-related matters require a different type of expertise and backdrop with a body dedicated to overseeing data and how it may be exploited!

Unfortunately, the expansion and production of the governmental projects are mostly focused on the ever-growing oil and gas (Production of crude oil, condensates surpass 60mn barrels in Oman - Times of Oman). This means that data in Oman is part of the neglected areas where proper and expertise-based implementation with enough resources and reach in is yet to be planned.

• Compared with the UK's AI strategy, which has three pillars.

 For example, countries such as the UK, when compared to Oman, are miles ahead in terms of data. The UK has released its national Artificial Intelligence policy on the interaction of AI and data-driven technologies by introducing three pillars (National AI Strategy - HTML version - GOV.UK (www.gov.uk). Under its National AI Strategy, the UK, and specifically under its third pillar, has focused on "fairness, bias, accountability, safety, liability, and transparency of AI systems." Meanwhile, in Oman, we are still being introduced to Data. This would not have come without the continuance efforts, pressure groups, and the UK's being part of international committees and institutions dedicated to Data for two decades.

• Intangible assets generally are underappreciated in Oman. The culture entails vivid results, and you have to see what you are getting.

Similarly, to Intellectual Property (IP) over 20 years ago, and how ineffective it is in Oman, one of the reasons thereof is the general lack of understanding or appreciation of IP as an intangible asset, as the society at large prefers tangible products and goods (something to see and touch) and prefers to opt for value and stuff that can be tangible in nature.

Data is likely to see the same fate as IP, with appearances pervading its existence, and committees being established to monitor and release basic publications (only as an appearance and on paper without actual implementation, except for those conglomerates which may realise—have already realised its importance). 

•   Regulating Data also necessitates that you consider the risks accompanied by Data.

The world is far ahead in terms of Data and the regulation thereof, and now with legislators starting to grasp NFTs (Non-fungible Tokens) (https://www.cnbc.com/2022/04/04/uk-to-mint-its-own-nft-and-push-forward-with-crypto-regulation.html), Oman is yet to grasp data and how it can possibly enforce data control laws. 

For example, in the European Union, with the release of the Data Act, far more progress has been made than where we are in Oman(The EU’s Data Act: Capstone of the EU Data Strategy - Kluwer Competition Law Blog) according to Kluwer Competition Law Blog: “The Data Act is an ambitious piece of legislation with implications for consumers and businesses across the economy, not limited to the technology sector.   The act aims to facilitate access to data by consumers and businesses; provide for government use of data in cases of “exceptional data need” (in some cases without compensation); facilitate switching between cloud and edge services; prevent unlawful data transfer by cloud service providers; promote interoperability across European data spaces; and set standards for “smart contracts” between “data holders” and data recipients.” So, it is essential to set initiatives and goals for what you want with your new laws. For example, what was the Omani government's goal when it released data laws? Is it a law for the sake of a law?

As part of the new antitrust laws, the Federal Trade Commission in the USA is targeting Amazon.(What’s the true cost of Amazon’s low prices? The FTC and Congress have antitrust concerns. - Vox) according to Vox: the company “uses data it collects from third-party sellers to give itself a competitive advantage. This was the subject of a “statement of objections” from the European Union, and as the DC attorney general has made clear, Amazon is notorious for creating its own versions of popular products sold by third parties. The company recently opened up some of its data to sellers, possibly in an effort to ward off some of this criticism, and says it prohibits the use of non-public data about individual sellers to develop its own products. But founder Jeff Bezos told Congress he couldn’t guarantee that policy has never been violated, and multiple press reports suggest that it has” 

The previous examples show where the global world is in terms of data. It is a declaration that conglomerates are not unlawfully allowed to utilize data, leading to a potential monopoly because of their platforms' broad reach and the large amount of data therein.

 The question remains whether the released data law has brought Oman up to date with Data or not. However, seemingly, the country is far behind and has a long way to catch up with, beginning with enforceability techniques and proper data language.