The UAE's new cyber crime law (all you need to know)

The objective of the new law is the protection of the public from the spread of false rumours and deception on social media, government databases and websites and other IT platforms. 

Article 11 of the Cybercrimes Law imposes a fine of not less than AED 50,000 (and up to AED 200,000) on any person who falsely creates a social media account, email address or website in the name of another person. If the victim of the impersonation is defamed by the actions of the impersonator, a prison sentence of no less than one year would be imposed on the offender.

Article 11(2) the new law sanctions both, the publisher of the false information as well as other individuals that contribute to further spread the false information. In such instances, a burden is placed on the latter to ensure that any information they share is accurate, failing which they are held equally liable as the original publisher of the false information. 

Furthermore, Article 55 imposes a temporary prison sentence and a fine of not more than AED 2,000,000 to any individual that requests, accepts or takes a gift, material, or moral benefit, or promises it in exchange for the publication or republication of unlawful information or false data using IT in the country. 

Misleading advertisements (or advertisements regarding the trading of cryptocurrency) may result in imprisonment and a fine of not less than AED 20,000 and up to AED 500,000, pursuant to Article 48 of the new law. Online surveys and polls without permits have now been criminalised with fines up to AED 500,000 and a jail term. 

The Cybercrimes Law also criminalises the use of online platforms to beg for money or to seek help from the UAE authorities. The punishment for this is three months imprisonment and a minimum fine of AED 10,000. 

Sectors such as banking, media, healthcare, and scientific institutions are considered crucial to the UAE. Article 4 of the Cybercrimes Law provides for offences specific to the aforementioned sectors whereby penalties ranging from AED 500,000 to AED 3,000,000 will be imposed for the hacking of the systems belonging to a bank, media organisation, or a healthcare/scientific institution. 

Additionally, the Cybercrimes Law has amplified the sanctions pertaining to the hacking of government data and government institutions. A prison sentence of not less than 10 years and a fine of up to AED 5,000,000 may be imposed on individuals who unlawfully access or tamper with government data. 

Notwithstanding the issuance of a distinct personal data protection law as part of the 2022 legal reforms, which independently regulates the processing of personal data in the UAE, the Cybercrimes Law also provides that the unlawful collection, storage and/or processing of personal data of UAE citizens and residents is a criminal offence. A prison sentence of six months and a fine of up to AED 100,000 could be imposed for the illegitimate disclosure of personal data. 

The unauthorised interception of communications, non-consensual taking of photographs, spreading of false information, and the monitoring, disclosure or holding of location data of UAE nationals and residents is also considered unlawful, pursuant to the new Cybercrimes Law. 

Pursuant to Article 44 of the new law, photographing accident victims (whether injured or dead) without consent is punishable by law, save in exceptional circumstances permitted by authorities.