Listen to the article
In the summer of 2020, the Egyptian government passed the Personal Data Protection Law to establish a new regime for the regulation of collecting data on citizens.
“The law aims to regulate lawful collection and treatment of personal data, and its protection against infringement more generally, and sensitive data more particularly,” says Loay El-Shawarby, principal of the El-Shawarby law firm.
On top of that, the law grants the right of “private citizens to offer specific consent to data collection requests and to remain lawfully assured that they could revoke their consent at will, or to amend the offered data,” he adds.
The new law also regulates e-commerce activities and companies will need a license to practice online activities and cannot sell consumer data to third parties.
Does the law go far enough, though? Does it go too far? Does it favor big companies over smaller ones? Or does it ensure equity? And what motivated the drafting of the law in the first place?
In recent years, concerns over digital privacy issues have been a hot topic globally in light of questionable practices by big tech companies such as Facebook and Amazon, which garnered attention and oversight from numerous governments around the world.
In the era of the digital economy, data has become the new raw material and fossil fuel to be mined and processed for its upkeep. Tech companies engage in a rush to acquire this “digital gold” to find out what grabs users’ attention and what keeps their attention on their devices and platforms.
According to Ayman Ismail, Abdul Latif Jameel Endowed Chair of Entrepreneurship and associate professor at the AUC School of Business, “any business that’s in advertising is really big about capturing and mining data because that’s the key thing of targeting.”
However, the degrees to which the world’s big tech companies have gone after data is yet to take hold in Egypt. “I have not seen businesses in Egypt at that level of sophistication and trying to overreach in terms of their data. I have not seen many local companies that are that aggressive in capturing data or in using it,” he says.
Ismail adds that the top local players in the scramble for data are the telecommunications companies and the banks, “followed by the Uber-like tech companies that have access to the data on your phone.”
What were the initial motives to pass the data protection bill in the first place though?
Moustafa Moharram is the founder and chief executive officer of Moharram & Partners, a public policy firm that facilitates discussions between the private sector and the government regarding policy, legislative and regulatory issues. They facilitated discussions between the government and some of the biggest names in the tech industry including Google, Microsoft, Amazon, Facebook and Twitter regarding the Personal Data Protection Law.
Moharram’s firm helped to hold several rounds of discussions between the government and tech firms, including the first public-private dialogue sessions at the Ministry of Communications and Information Technology. They also held hearing sessions at the Egyptian parliament with tech companies and provided comments, feedback and recommendations to the parliament’s information communication technology (ICT) committee.
One of the most important motives for the government pursuing the bill was the investment component, according to Moharram. “One of the main objectives behind the initiation of this […] law was actually to make sure that the Egyptian legal regime is complying with the [..] GDPR,” he says.
The General Data Protection Regulation (GDPR) is the main law governing data protection and privacy in the European Union (EU) and the European Economic Area (EEA) and was issued in 2018. “It was very important for many countries to adapt their legal regime to be up to the GDPR standards,” Moharram says.
“Without adapting your laws to be consistent with the GDPR, it would have been very difficult for Egypt to attract investment and it would have restricted the ability of Egyptian companies working in tech to work with their European counterparts,” he adds.
Additionally, Moharram reveals that the government has for years been interested in the idea of making Egypt a regional hub for ICT and a data passage between Europe, Africa and Asia due to the country’s strategic location. “Something that comes with this is the data centers [which] Egypt is very much interested in being a hub for,” motivating the government to modernize its data laws.
However, there have been some concerns over how the law appears to so far be applying a blanket policy on all companies. El-Shawarby says “the law does not distinguish addressees in terms of size or financial capacity, including in respect of the licenses, permits and certifications required, [whose] costs may turn out to be substantial. The maximum fees are EGP 2 million for the license, EGP 500,000 for a permit or a certification. The law does not stipulate a minimum though.”
He stresses that the law needs to clarify how it is going to distinguish between smaller companies such as local startups and bigger multinational tech giants.
“Would it be burdensome for startups and SMEs [small and medium-sized enterprises] to comply with? [That is] my initial concern,” Ismail says, who is also the founding director of AUC’s business incubator, Venture Lab. “It’s great for the consumers and for the space overall. But how easy or hard would it be for the companies to comply with? Would it generate a lot of additional costs? Maybe some people will be able to, others will not. That’s what I would love to feel comfortable with.”
In Moharram’s opinion, in the discussions between the government and the private sector concerning the law, there “wasn’t enough representation of Egyptian startups that are important because they give additional dimensions to the conversation that [need] to be taken into consideration.”
The law provides certain requirements that companies need to adhere to, Moharram says, and the discussions were mostly with big companies who have the capabilities and expertise to easily comply.
“This is not always the case when it comes to startups and small companies [who] are an important driver of the economy and that’s why it’s important to give them a voice and to make sure that they are heard [and] not be surprised [about] some of the aspects of this law [that] might harm their business.
