Regulatory Updates: Digital Health Laws and Regulations in Saudi Arabia

0


In light of recent regulatory developments directly and indirectly impacting the digital health sector in…

In light of recent regulatory developments directly and indirectly impacting the digital health sector in Saudi Arabia, this article aims at further expanding the original Saudi Arabia chapter in the International Comparative Legal Guide – Digital Health 2023, published on 17 March 2023. (For the sake of clarity, this article shall cross reference the relevant sections from the previously published chapter).

The previously announced Personal Data Protection Law, issued by Royal Decree (M/19) dated 16/9/2021G (the “PDPL”), has undergone additional public consultation, where the PDPL was revisited and amended pursuant to Royal Decree (M/147) dated 05/09/1444H corresponding to 27/03/2023G (the “Amended PDPL”). The Amended PDPL shall now come into effect on 14/09/2023G and shall grant entities a one-year grace period to comply with the provisions of the Amended PDPL. The Amended PDPL offers greater flexibility for data processes, which was subject to heavy oversight and procedural requirements under the PDPL. Further, the Implementing Regulations of the Amended PDPL shall also come into force in September 2023. The Amended PDPL and the Implementing Regulations shall specify the ability to process data outside of KSA and the mechanisms to resolve data breaches.

Upon the effective date of the Amended PDPL, certain governmental authorities and agencies, such as the Ministry of Health (the “MOH”) and the Saudi Health Council (the “SHC”), may revisit the requirements for the provision of telemedicine, and the relevant Policies to conform to the Amended PDPL and its Implementing Regulations.

In addition to the relevant laws and regulations that protect individual data and individual privacy, and are subject to scrutiny and oversight by Saudi Arabian governmental authorities, as described under question 4.1 of the chapter, the Amended PDPL, upon its enforcement, shall impose criminal sanctions for the unlawful publishing or disclosure of sensitive personal data conducted with the intent to harm the personal data subjects or for achieving personal gain. Some of the penalties include a fine not exceeding SAR 3,000,000 and/or imprisonment for a period not exceeding two years.  Additional sanctions may be imposed for violating the provisions of the PDPL, such as a warning or a fine not exceeding SAR 5,000,000 (which may be doubled for repeat offenders). The Amended PDPL has removed the restrictions and penalties relating to the transfer of personal data outside of KSA (which was originally imposed under the PDPL).

Additionally, further to key issues related to data sharing, as previously described under question 5.1 of the chapter, health care institutions must also consider the Policies issued by the SHC, which must be considered when the patients’ personal data (such as health records) are exchanged for limited and justifiable reasons, such as the provision of clinical care, emergency care and additional support and care within another department of the healthcare provider’s organisation.

Healthcare providers and organisations should take into consideration the Amended PDPL and its Implementing Regulations,  and prepare the relevant internal policies in accordance with SHC’s standards under the Policies (which may, as discussed above, be subject to amendment upon the enactment of the Amended PDPL).

In respect to trade secret developments, there have been recent developments to question 6.3 of the chapter, where the draft Intellectual Property Law, which was up for public consultation until 04/05/2023, recognises that trade secrets can be protected and are rightfully owned by those individuals or businesses that gain access to them by lawful and honest commercial means. However, the provisions of the draft do not define what trade secrets are, how they can be duly registered to its rightful owners nor the duration of protection.

With regards to ownership of intellectual property rights to algorithms improved by machine learning without active human involvement, as discussed in question 8.3 of the chapter, the draft Intellectual Property Law recognises the importance of Artificial Intelligence (“AI”) being classified as intellectual property when the contribution of a natural person is evident. However, intellectual property generated by AI may be part of the public domain in the event the natural person’s contribution is not prominent, and rather, is heavily dependent on AI.

The above regulatory changes are a testament to Saudi Arabia’s ever changing legal landscape. The new developments are aligned with the Saudi Arabian National Transformation Program encouraging growth and development across all sectors in Saudi Arabia, to promote a more comprehensive legal regime that aligns with international practices and universal standards.

 

 

link

Leave a Reply

Your email address will not be published. Required fields are marked *