< Back

Share |

CCTV in the United Arab Emirates – the legal framework

March 2014

It is a given nowadays that we are routinely recorded going about our everyday lives.  Cameras record not only the images of the individuals themselves, but all manner of information relating to individuals such as car registration numbers and models and time spent at work.

According to figures published by The National newspaper in Dubai, there were around 25,000 CCTV cameras in Dubai in 2011. This figure is likely to be considerably larger by now.  Only recently, another article in Gulf News reported that Abu Dhabi authorities have increased the number of CCTV cameras on the streets to try and reduce the number of traffic offences.

cctv camera

Back in 2011, The National called for a law regulating the use of CCTV cameras in the United Arab Emirates (UAE) at a federal level but this has not been forthcoming although some Emirates do have specific regulations like Dubai's Law no.24 of 2008, which regulates security services providers in the Emirate of Dubai and provides guidelines on where and how cameras can be installed in public or private areas.  Despite the lack of a specific unified law in the UAE covering CCTV, there are a number of different laws and regulations both at federal and local level, which are relevant.  There are various laws and regulations which protect fundamental human rights, such as the right to one's own image as well as the right to privacy and confidentiality.  Unfortunately, none of these cover the recording and processing of information by CCTV, particularly when this is done without consent.

The current legislative protection for individuals resides primarily in the UAE Constitution of 1971, which guarantees the right to confidentiality of communications and Federal Law No. 9 of 1987, as amended (Penal Code), in which articles 378 and 379, set out statutory offences and punishments for publication of private matters or the unauthorised disclosure of private information (although private information is not a legally defined term).

Law No. 15 of 1980 Regarding Printed Matters and Publications (the Press Law), provides that publishing news, photographs or comments connected with the private or family life of individuals is not permitted, even where accurate, if publication would offend the concerned individual(s).  It is also prohibited to publish anything which involves disclosure of a secret that would damage the reputation of a person or his business or to publish anything  intended to threaten him or force him to pay money or offer a benefit to third parties or deny him freedom to work.  "Publication" is defined as any writing, drawings, musical compositions, photographs or any other means of expression whether written, audio or visual, which are capable of being "circulated".  The definition of "circulation" is quite broad and includes, among other things, "any other work, which makes such items in any way available for a number of people".  It is debatable as to whether the Press Law could be used to protect and regulate information stored and processed by CCTV but it clearly provides for the protection of an individual's image and reputation and restricts the right to publish or circulate information or images which might damage his/her reputation or his/her ability to work.

Prisoner in handcuffsFederal Law No. 2 of 2006 on Combating Technology Crimes, provides for sanctions of imprisonment (for not less than one year) or a fine (of not less than AED fifty thousand), against "whoever (...) publishes any news or pictures connected with the sanctity of the private or family life of individuals, even if true, via the information network or any means of information technology".  While not set out in the law, in practice, sanctions only apply where the individual did not authorise the publication.  It is conceivable that this law could be used against anyone who has published CCTV footage on the information network without the consent of the relevant individual.

At a federal level, we should also mention the laws that regulate the use of CCTV cameras in certain specific areas such as Federal Central Bank Notice 3692 of 2012, regulating the use of cameras to store the image of bank's customers: "the Customer hereby authorises the Bank to fix a Close Circuit Television (CCTV) camera at its premises to capture and retain the Customer's image (by photo, video recording or other means) and to provide the same to the police, central bank or any other competent authorities at any time without any approval by or notification to the Customer".

Lastly, the Decree of the Council of Ministers No. 13 of 2009, On the Approval of the General Standards Guide for Worker Dormitories and the Services Attached Thereto, prescribes the use of CCTV cameras in all residential worker compounds.  There is no requirement to obtain the consent of the individuals being recorded under this Decree.

filing systemAt a state level, Dubai and Abu Dhabi have specific privacy laws and regulations that apply to the processing and storage of personal data. The Dubai International Financial Centre (DIFC) Data Protection Law and Regulation 2007, which applies in the DIFC free zone, The Health Data Protection Regulation Number (7) of 2008, applicable to companies based in Dubai Healthcare City, The Health Information Retention and Disposal Policy issued in May 2007 by the Health Authority of Abu Dhabi, which applies to medical practitioners and institutions in the Emirate of Abu Dhabi and The Charter Patient Rights and Responsibilities issued on the 5th of January 2011 by the Dubai Health Authority and applicable to medical practitioners and medical institutions in the Emirate of Dubai and outside of the Dubai Healthcare City free zone, all deal with the storage and the processing of information of individuals or patients. However, these laws only apply to certain areas and not to the entire territory of the United Arab Emirates, creating de facto inequality of protection between individuals depending on where that individual works or lives.

The above-mentioned regulations (both at federal and regional level) often require written consent of the concerned individual for the processing of images and other information. However, it is almost unheard of to be asked for this type of consent in the UAE in relation to CCTV footage (with the exception of banks, which request your consent at the time of signing their general conditions). Articles 8 and 9 of the Dubai International Finance Centre Data Protection Regulation 2007 could be used to help regulate the use of cameras even outside the DIFC free zone and as guidelines for users and providers to establish when it is permissible to store the image of an individual and which policies should apply. The current legislative framework lacks a comprehensive law at federal level that would address and clarify the concerns, questions and inequalities that are currently unresolved.

If you have any questions on this article or would like to propose a subject to be addressed by the Global Data Hub please contact us.

CCTV camera
Clotilde Iaia

Clotilde Iaia      

Clotilde looks at the (lack of) regulation of CCTV cameras in the UAE

"The current legislative framework lacks a comprehensive law at federal level that would address and clarify the concerns, questions and inequalities that are currently unresolved. "