QFC Data Protection Regulations 2021 and automated decisions

What it is

The Qatar Financial Centre has its own data protection regime, separate from the State of Qatar’s PDPPL. The QFC Data Protection Regulations 2021 and the accompanying Data Protection Rules follow the structure of the GDPR closely. Article 2 says that, to the fullest extent the QFC Law permits, State laws on the same matters do not apply in the QFC. Version 3 of the Regulations came into force on 6 December 2023.

Article 22 is the rule on automated individual decision-making, including profiling. It is the most direct rule on AI decisions anywhere in Qatari law. Article 27, on data protection impact assessments, sits alongside it.

Who it applies to

Under Article 7, the Regulations apply to processing by a data controller or processor incorporated or registered in the QFC, whether or not the processing happens inside the QFC. They also apply to a controller or processor outside the QFC that processes personal data through a QFC firm as part of ongoing arrangements, but only to that processing. The Data Protection Office reads this second limb as covering data subjects who are in Qatar.

The QFC Data Protection Office, led by the Data Protection Commissioner, supervises the Regulations and publishes detailed guidance on each article.

What it requires

Article 22(1) gives a data subject the right not to be subjected to a decision based solely on automated processing, including profiling, if the decision would have a legal effect on them or would otherwise significantly affect them. The Office’s guidance gives examples such as eligibility for credit, access to health services and decisions that deny someone an employment opportunity.

Article 22(2) sets three exceptions.

• Contract. The decision is necessary to enter into or perform a contract between the data subject and the controller. The guidance says it must be necessary, not merely a condition of the contract.
• Law or regulation. The decision is made under laws or regulations that apply to the controller. The guidance notes that none are currently specified.
• Consent. The data subject has given explicit written consent to the decision being based solely on automated processing.

Under Article 22(3), where a firm relies on the contract or consent exception it must put suitable safeguards in place. These must include the right to obtain human intervention, to express a point of view and to contest the decision. Article 22(4) bars these decisions from relying on sensitive personal data unless the person has given explicit written consent or the processing is necessary for substantial public interest reasons with suitable safeguards.

Article 27 requires a data protection impact assessment before processing that is likely to result in a high risk, and in particular where automated processing, including profiling, leads to decisions with a legal or similarly significant effect. The Data Protection Office’s published list adds evaluation and scoring, biometric processing, combining datasets, and processing that uses innovative technologies, naming artificial intelligence, machine learning and large language models. The Data Protection Rules set the minimum content of the assessment, and Article 27(6) requires the firm to review processing against it, especially when the risk changes.

For an AI system in a QFC firm, the practical questions follow from that. Does the system decide on its own, with a legal or significant effect on a person? Which exception applies? Can the person reach a human, give their view and challenge the outcome? And has a DPIA been done and kept current?

Key dates

• 6 December 2023. Version 3 of the QFC Data Protection Regulations comes into force.

How it relates to other frameworks

Article 22 is close to word for word with GDPR Article 22, and the Office’s guidance draws on UK GDPR definitions of profiling. Firms that already meet the GDPR rule for a system will usually find the QFC rule familiar, with the difference that consent must be explicit and written.

Within the Gulf, the Dubai International Financial Centre takes a different route with DIFC Regulation 10, which sets specific duties for autonomous and semi-autonomous systems. Outside the QFC, banks and other entities licensed by the Qatar Central Bank work to the QCB Artificial Intelligence Guideline, which has its own human review and customer disclosure requirements. Groups with entities on both sides often design one AI review process that meets both.

A note on this page

This is Aicura’s reading of Articles 22 and 27 of the QFC Data Protection Regulations 2021 and the Data Protection Office’s guidance. It is not legal advice and it is not the Regulations themselves. Read the primary sources published by the Qatar Financial Centre, and take advice on how they apply to your firm.