Cyrille Naffah is the Managing Partner of The Edge ™, an unconventional Law firm active across the Middle East. Cyrille has over 23 years of experience as a commercial and corporate lawyer (admitted to practice law in Lebanon) having advised several Fortune 500 companies doing business in both Lebanon and Saudi Arabia. He has practiced law both in private practice and as in-house counsel in some of the finest global and regional law firms and multinational corporations. Cyrille has focused his practice on franchising, distribution, commercial agencies, waste management, TMT, company formation and restructuring, M&A and other areas of the law.
The New Communications and Information Law (the “Law”) was enacted by Royal Decree No. M/106 dated 02/11/1443 H (corresponding to June 1st,2022 G). It repeals the former law (enacted by Royal Decree No. M/12 dated 12/3/1422 H) and is set to come into force one hundred eighty (180) days after its publication in the Saudi official gazette (umm al qura).
The key proclaimed objectives of the Law are to increase the flexibility and competitiveness of the Saudi digital infrastructure and economy and transform the Kingdom of Saudi Arabia into a regional technological and digital hub and generate substantiate foreign and domestic investments in fields such as cloud computing, Internet of Things (IOT), cybersecurity, Artificial Intelligence and a host of other associated activities.
The key features and concepts introduced by the Law are outlined below:
- DEFINITIONS
1-In the “Definitions” Section (Article 1), Information Technology is defined as “technologies, software programs, systems and networks including those supporting the creation of data or information, their aggregation, collection, processing, storage or analysis, including communications and IT applications and does not cover the data or information per se”.
2-It is worth noting that the Law introduces an authorization that must be applied for and obtained by all persons or entities based overseas who provide services that are connected to communications or information technology services-including digital content platforms- in the Kingdom, in such a way as to make them accessible to users (this can arguably apply to the owners/operators of forex or crypto-currency platforms and the implementing regulations of the Law, which are yet to be published, are likely to provide greater certainty around the scope of activities and operators to whom the Law applies).
3-The Law defines a service provider (although the Law is silent on who can be a service provider, it is safe to assume that the definition captures natural and juristic persons alike) as a “provider of communications, IT or associated activities -including digital content platforms-to the public, who is licensed, registered or authorized”.
4-The Law (Articles 1 “Definitions” section and 15 “Interconnection and Access”) defines a dominant service provider as a provider whose service covers forty percent (40%) at least of a communications or IT market or a part thereof. The Communications and Information Technology Commission (CITC) as the regulator shall have the right to amend this percentage if the conditions of the market warrant it. The CITC is also empowered to define the relevant criteria to determine a dominant service provider.
5-Interestingly, the Law contains definitions for tow novel concepts which were not defined in the former communications and IT law, namely those of emerging technologies and technological know-how.
Emerging technologies are defined as “technological inventions which represent a progressive step in a given field offering a competitive edge over existing technologies”.
Technological know-how, on the other hand is defined as any technological means for identifying in a unique way, resources, services or content which may be accessed via the internet”.
II-OBJECTIVES OF THE LAW
Article 2 of the Law lists some of the key objectives that the Saudi legislator has sought to achieve by enacting the law.
Most importantly, the Law is intended to assist in fulfilling the following goals:
- Develop the communications and IT sector to improve the quality of its services and its infrastructure;
- Encourage the digital transformation and the use of communications and IT in order to reap their advantages in all economic fields;
- Encourage technological invention, innovation, research and development in the communications and IT sectors;
- Transfer and localize technology in the communications and IT sectors and follow up their development;
- Protect the public and private interests and increase the level of trust of users of new technologies by offering communications and IT services of adequate quality, protect users against inappropriate content and preserve the secrecy of communications;
- Ensure transparency and clarity in licensing and authorization procedures;
- Ensure that principles of equality and non-discrimination in the provision of services, are consistently enforced and implemented;
- Encourage the access to developed communications and IT services, at appropriate prices across the Kingdom;
- Develop the share of local content in the communications and IT sectors and incentivize the use of the products and services of national providers.
III-LICENSING REQUIREMENTS
Article 5 of the Law provides that licenses must be obtained from the CITC prior to undertaking any of the following activities:
- Providing communications services to the public or using a communications’ network to this end;
- Providing infrastructure services to public communications networks;
- Using any numbering or frequency resources;
- Providing Saudi domain names’ registration services or establishing centers for their registration.
The Board of Directors of the CITC may require that a license be obtained from or registration be effected with the commission in the following cases:
- Provision of specific communications or IT services including digital content platforms. The Board shall specify the nature of these services and lay out the rules governing them;
- Possession or use of communications or IT devices and equipment;
- Creation of a private communications’ network.
Moreover, Article 5 provides that the Board of the CITC shall set forth the conditions and requirements for obtaining a specific license, registration or authorization and specifies that the CITC shall determines the cases in which its approval shall be required to connect a private communications network to a public network.
IV- OWNERSHIP AND TRANSFER OF LICENSES
Article 7 of the Law provides that the CITC’s prior approval shall be obtained in each of the following cases:
- The occurrence of a substantial change in the ownership structure of the licensee or authorized provider;
- The assignment of the license, registration or authorization to a third party.
It is worth noting that Article 7 does not specify what constitutes a “substantial change” in the ownership structure of the licensee and it is to be hoped that the implementing regulations will clarify the ownership percentage whose transfer will be deemed to constitute a substantial change, triggering the requirement of a prior approval from the CITC.
Moreover, Article 7 provides that a “no-objection” letter should be obtained from the Commission whenever a “substantial Change” occurs at the level of the top management of the licensee or authorized provider. The same remark as above applies here regarding what constitutes a “substantial change” in the top management of a service provider.
Article 7 provides that, in both cases, the CITC shall render its decision within ninety (90) days from the date on which the application is finalized. If the Commission does not respond within the aforesaid time frame, it shall be deemed to have approved the application.
V-INTERCONNECTION AND ACCESS
Article 15 of the Law provides that all service providers must accede to reasonable requests for interconnection and access made by other providers, in accordance with the provisions of the implementing regulations.
Dominant service providers in a given market, must accede to requests for interconnection and access made by other providers on reasonable conditions and prices, based on the rates approved by the Commission.
In the event that two service providers are unable to agree the conditions for interconnection and access, either of them may refer the matter to the Commission for its adjudication and the decision of the Commission in this regard shall be binding on both parties.
VI- COMPETITION
Article 20 of the Law deals with competition and contains provisions aimed at preventing the constitution of the monopoly in the communications and IT sectors.
It stipulates that a service provider is under an obligation to seek the approval of the CITC’s Board prior to engaging in any merger with another provider (whether based locally or overseas) and notify the CITC in writing within five (5) working days from reaching an agreement in principle regarding the contemplated merger.
Moreover, a service provider or any natural or juristic person must obtain the approval of the CITC’s Board prior to buying five percent (5%) or more of the shares of a service provider licensed to operate in the Kingdom or whenever the contemplated transaction has the effect of making the buyer a dominant service provider.
Article 21 of the Law prohibits any dominant service provider (in a relevant market) from abusing his position. The definition of what constitutes a “abuse of dominant position” is left to be addressed by the implementing regulations.
Finally, Article 22 of the Law forbids service providers from entering into agreements to engage in practices that would result in a service provider acquiring a dominant position in a relevant communications’ market or part thereof, or would have the effect of reducing or preventing competition or lessening its effectiveness and any provisions in such agreements which would have such consequences are deemed null and void.
The implementing regulations shall define the agreements or practices that are anti-competitive and the measures to be adopted in this regard.
VII-DATA PROTECTION, CONFIDENTIALY AND SECRECY OF COMMUNICATIONS
Articles 23, 24 and 32 deal with data protection, confidentiality and secrecy of communications.
Article 23 provides that each service provider is under an obligation to take appropriate measures and arrangements to protect the confidentiality of the personal information and documents of users and prevent them from being accessed, consulted or used in any unlawful manner.
Service providers shall prepare and submit to the CITC, for its approval, their policies regarding the protection of the confidentiality of such information and documents.
Users’ information and documents may not be disclosed without their consent and if any breach occurs (in any manner whatsoever), the service provider shall take all necessary measures to protect the information and documents of users and notify the particulars and details of any incident to the CITC.
Article 32 provides that telephone conversations and information sent or received over public communications’ networks are secret and may not be viewed, listened to nor recorded except as provided for in the relevant laws (national security, threats to public order, criminal activities being the typical exceptions).
VII-CYBERSECURITY
The preamble to the Law provides that the Law is enacted without prejudice to the powers and missions of the National Cybersecurity Authority. It also states that the CITC shall follow up on the commitment by service providers to use the necessary diligence to protect cybersecurity and sensitive infrastructure (defined as communications and IT devices or equipment whose impairment or breakdown-in whole or in part- affects the stability or security of the communications and IT sectors) and monitor the constant compliance by service providers with the cybersecurity level imposed by the National Cybersecurity Authority.
VIII-VIOLATIONS AND PENALTIES
Articles 26 and 27 of the Law provide a list of violations and penalties as well as a brief description of the procedure for imposing penalties and challenging any decisions rendered.
Article 26 considers the following to be violations to the provisions of the Law:
- Possession, sale, lease, loan, manufacture, production or circulation -in any manner whatsoever- of any communications or IT device, equipment, service, system, software or the like which do not conform with the approved technical specifications and standards or with the conditions and requirements of the CITC;
- Undertaking any of the activities that require a license, registration or authorization prior to having obtained the same;
- Presenting misleading information to the public or the competent authorities regarding the communications or IT services;
- Obstructing the work of the inspectors appointed by the CITC;
- Misuse of communications or IT services;
- Engaging in any anti-competitive practice;
- Intentionally or negligently causing damages or disrupting communications networks or illegally using the same;
- Refusing to provide reports, information or documents requested by the Commission to carry out its tasks;
- Any other actions in breach of the provisions of the Law, the implementing regulations or the regulatory decisions issued by the Commission.
Article 27 provides a list of the penalties that may be imposed by the Commission on any contravening service provider:
- A fine not exceeding twenty five million Saudi Riyals ($6,666,666 approximately);
- Suspend the infringing service in whole or in part;
- Deprive the provider-for a specified period- of his right to obtain a license to provide communications or IT services or of his right to renew it;
- Take down the digital content platform either in whole or in part.
The decision imposing the penalty shall become effective from the date on which it is served upon the contravening service provider.
The committee which has imposed a penalty may order the service provider to publish the decision on the internet, in a local newspaper or in any other manner provided that publication is undertaken only after the decision has become final and the service provider shall bear the costs of publication.
One or more committees shall be established by the Board of the CITC to review matters involving violations of the provisions of the Law and impose penalties on infringers. The decisions rendered by these committees are appealable before the administrative court within thirty (30) days from the date of their notification to the contravening service providers.
IX-IMPLEMENTING REGULATIONS
Implementing Regulations will be issued by the Minister of Communications based on a text proposed by the Board of the CITC within one hundred eighty (180) days from the date of publication of the Law in the Saudi official gazette (umm al qura).
CONCLUSION
Although the Law introduces novel concepts (e.g. emerging technologies, digital content platforms, technological know-how), it failed due to its limited scope to capture more fully the legal implications of the introduction of such new technologies and products and has not even touched upon key issues such as forex and cryptocurrency platforms, Internet of Things (IoT), Non-Fungible Tokens (NFT), Artificial Intelligence (AI) and ignored the host of key challenges such new technologies and concepts may pose when using communications and IT enabled networks or supports. We hope that the implementing regulations will fill some of these perceived gaps.
Nonetheless, the Law may be considered a major milestone in the Kingdom’s legislative efforts to provide a solid and modern regulatory framework to technological endeavors and investments which are critical in effectively transforming the Kingdom into a regional technology hub, attracting significant foreign investments in these crucial sectors and generating much needed employment opportunities to boost and diversify its economy.