Full Report
The war in Iran has drawn attention to arrests in the United Arab Emirates over online content, but the legal framework behind that enforcement has existed for years.
Analysis Summary
# Regulation/Compliance: UAE Federal Decree-Law No. 34 of 2021 on Combatting Rumors and Cybercrimes
## Overview
This regulation governs the use of information technology and digital platforms in the United Arab Emirates. It is designed to regulate online behavior, protect digital data, and prevent the spread of "fake news," rumors, or content deemed harmful to the state's security, public order, or individual privacy.
## Key Details
- **Issuing Authority:** UAE Federal Government
- **Effective Date:** January 2, 2022
- **Jurisdiction:** United Arab Emirates (Applies to all residents, visitors, and entities operating within the UAE).
- **Status:** In Effect
## Requirements
### Mandatory Requirements
1. **Implicit Consent for Media:** Users must obtain explicit permission before sharing photographs, videos, or screenshots involving other private individuals.
2. **Content Standards:** Prohibits the publication of any content that offends foreign states, contradicts public morals, or endangers national security.
3. **Data Localization/Reporting:** Service providers may be required to disclose user data or remove content upon request from judicial authorities.
4. **Accuracy of Information:** Mandates that individuals and organizations refrain from disseminating "rumors" or unverified news that aligns with official government narratives.
### Recommended Practices
1. **Social Media Auditing:** Regularly review personal and corporate social media accounts for content that could be interpreted as politically sensitive.
2. **Strict Privacy Settings:** Use high-level privacy settings to limit the visibility of shared content to trusted networks only.
3. **Internal Policy Development:** Organizations should implement social media "Code of Conduct" policies for employees.
## Affected Organizations
- **Industries:** Media, Social Media Platforms, Technology, and any commercial entity with a digital presence.
- **Organization Size:** All sizes; the law applies to individual users as well as multinational corporations.
- **Geographic Scope:** Within the borders of the UAE; also applies to content posted abroad if it affects UAE national interests.
## Compliance Timeline
- **Late 2021:** Law promulgated by the UAE President.
- **January 2, 2022:** Law officially came into force.
- **Ongoing:** Continuous enforcement and monitoring by UAE telecommunications and security authorities.
## Implementation Guidance
### Assessment Phase
- Audit existing digital archives and social media histories for content involving screenshots of private conversations or sensitive political commentary.
### Implementation Phase
- Train staff and residents on the definitions of "Cybercrime" under UAE law, emphasizing that "private" digital spaces (like WhatsApp) are subject to these regulations.
- Establish protocols for obtaining written consent before publishing any third-party imagery.
### Validation Phase
- Periodic legal review of digital marketing materials and public-facing communication to ensure alignment with "public morals" and "national interest" standards.
## Technical Requirements
- **Content Filtering:** Platforms must have mechanisms to quickly identify and remove prohibited content.
- **Encryption Limitations:** Law enforcement may require access to encrypted communications if they are deemed relevant to national security investigations.
## Penalties & Enforcement
- **Fines:** Ranging from AED 100,000 to AED 5,000,000 (approx. $27,000 to $1.36 million USD).
- **Other Consequences:** Immediate deportation for non-citizens; seizure of devices; permanent bans from using social media; and prison sentences (potentially life imprisonment for state security offenses).
- **Enforcement:** Proactive monitoring by the "e-Police" and the Telecommunications and Digital Government Regulatory Authority (TDRA).
## Related Standards
- **GDPR Alignment:** While the UAE has a separate Data Protection Law (Law No. 45 of 2021), the Cybercrime law interacts by penalizing the "breach of privacy" without consent.
- **National Cybersecurity Strategy:** Aligns with the UAE's broader goal of creating a "secured and resilient" digital environment.
## Resources
- **Official Documentation:** [u.ae/en/about-the-uae/strategies-initiatives-and-awards/federal-governments-strategies-and-plans/the-uae-national-cybersecurity-strategy] (Defanged URL)
- **Guidance Documents:** UAE Ministry of Foreign Affairs (MoFA) travel and residency advisories.
## Practical Recommendations
- **Screenshots:** Never share a screenshot of a conversation or another person’s profile without documented permission.
- **Political Sensitivity:** Refrain from criticizing the UAE government, its allies, or commenting on regional conflicts (e.g., Iran/Israel) in a manner that contradicts official state positions.
- **Reporting:** If you are the victim of a cybercrime, use the official "My Safe Society" app rather than retaliating online.