Consumers' Personal Data Protection in Saudi Arabia A Comparative Analytical Study

Consumer protection, in general, depends on the nature of transactions in which consumers engage. These transactions have changed radically due to the change in trade methods. In addition, many communities have shifted from being industrial societies to information societies. These shifts have made a profound impact on the level of protection that consumers enjoy. These shifts raise an important question: what is the impact of these shifts on the law's development? It has become common that every technological development usually leads to the same questions regarding the legitimacy of applying classical legal rules to recent developments. This dissertation claims that Saudi Arabia deals with data protection problems through traditional legal methods and does not have an effective legal system to protect consumer personal data. The question is then, how Saudi Arabia can protect consumers' personal data? This dissertation argues that data protection in Saudi Arabia is a challenge that can be met by studying and analyzing different data protection approaches in the world and drawing on national and international lessons. There are two main existing approaches in the world today to data protection: the self-regulation approach (U.S. approach) and the regulation approach (EU approach). In the self-regulation approach, the industry would be the main player in protecting consumers' personal data. In the regulation approach, the government imposes binding restrictions on how companies collect and use consumers' personal data. The question then becomes, which approach should Saudi Arabia adopt? In other words, who should be relied upon to protect consumers' personal data in Saudi Arabia? This dissertation argues that imposing data protection regulation in Saudi Arabia would be the best way to protect consumer personal data. First, this dissertation argues that unlike the industrialized world where governments believe in marketability to meet consumer preferences and rely heavily on market mechanisms rather than government regulations as a means of protecting consumers, the situation in developing countries is quite different, where consumers rely heavily on the government to come up with models, rules, and regulations to protect them from companies. Also, in many developing countries, consumers rarely raise issues that affect them in the purchase and use of the product. The fact that these individuals lack awareness of their rights as consumers plays a crucial role in the development of such protection. In addition, officials in developing countries lack the skills and experience to deal effectively with consumer complaints. Moreover, developing countries are overwhelmed by bureaucratic procedures when it comes to dealing with procedures and complainants. Under these circumstances, Saudi Arabia as a developing country must enforce binding regulation to provide consumer protection. Second, this dissertation argues that the existence of data protection regulation would promote economic efficiency in terms of reducing costs to the companies, providing a competitive advantage, and maintaining consumer confidence. Data protection regulations would increase the efficiency of the companies when they process consumers' personal data by imposing a number of core principles such as lawfulness, fairness, transparency, purpose limitation, accuracy, and confidentiality. Third, the existence of consumers’ personal data protection regulation increases the market efficiency in dealing with consumers by granting them a number of basic rights such as the right to be informed, the right of access, and the right to rectification. Finally, this dissertation argues that the market cannot comply with consumers' personal data protection without binding regulations. The voluntary nature of the self-regulation approach is the most significant obstacle to compliance and implementation with consumers' data protection. The empirical data indicates that the market experience under self-regulation reveals a failure to comply with and implement consumers' data protection policies. Certification and seal programs are ineffective forms of self-regulation. Data protection regulations can be flexible enough to achieve their intended purpose without failing to account for future changes and different industries. Finally, many countries and companies around the world have already adopted the European General Data Protection Regulation.

Grantor dc:publisher

University of Kansas

Year dc:date.issued

2020

Author dc:creator

• Abdullah, Ahmed

Advisor dc:contributor.advisor

• Hoeflich, Michael H.

• Law

Statement dc:rights

• Copyright held by the author.

Language dc:language.iso

en

Dc Identifier Other

http://dissertations.umi.com/ku:17092

OAI identifier oai:identifier

oai:kuscholarworks.ku.edu:1808/39324