With the enactment of new e-transactions and data protection law issued on 10 October 2018 (Law No.81/2018), Lebanon is now one of 145 countries that have an e-transaction law and 107 countries with a data protection law. For the past several years, the Lebanese Parliament had struggled to tackle these issues, which are crucial not only for business but also for the protection of personal privacy. From the standpoint of economic players that conduct business in Lebanon via electronic means, many aspects of the law are worthy of note.

The evidentiary weight of e-documents / e-signature

One core achievement of Law No.81/2018 (the Law) lies in its acknowledgment of contemporary business culture, where electronic communications are common practice. The Law's main input in this respect relates to endeavouring to equate e-signatures and e-documents with paper-based signatures and documents. It is noteworthy that, until the enactment of the Law, electronic communications were only able to be relied upon as preliminary evidence in Lebanon. This meant considerable hindrance for business.

However, the Law and surrounding framework is not yet sufficient to allow for e-documents and paper-based documents to be treated alike in all respects. For instance, an implementing decree is required to address the legal recognition of electronic authentication certificates (used in the process of authenticating digital signatures). More importantly, until authentication service providers (also referred to as certification service providers or CSPs) are approved by the Lebanese Accreditation Council (COLIBAC), which is yet to determine the conditions for such accreditation, the courts will have discretionary power to assess the evidentiary weight and reliability of all e-documents and corresponding electronic signatures.

Since COLIBAC does not exclusively focus on e-commerce matters, it is likely that such implementing measures will not be issued in the immediate future. There is therefore a risk that the implementation of the Law will be delayed.

This said, the banking industry in Lebanon may not necessarily suffer from such downfalls – the Central Bank, which has formerly tackled electronic transactions¹ and is generally quick to take action, was enabled by the Law to issue implementing measures and notably to specify the rules according to which e-signatures relating to e-payments and transfers shall be authenticated. To this day, the banking sector is, generally speaking, a step ahead of the rest of the economy when it comes to electronic communications and trade.

Defining a framework for e-commerce

The approach adopted by the Law does not differ substantially from that adopted by the ECOMLEB draft law² : the purpose of the legislator has not been to enact an exhaustive and self-sufficient internet code of commerce but rather to establish rules that could fill the legal vacuum created by internet technology and that would complement the existing legal and regulatory provisions that currently govern trade, contracts, banking transactions³ and consumer protection⁴.

The Law addresses new economic players, platforms and practices. It defines for instance the data host and network service provider's liability (and the limits of such liability). It also provides for the establishment of a Domain Name Registry notably endowed with the authority to register domain names under the .lb ccTLD and to specify the conditions that must be met in this context. This authority will take over tasks that have been carried out to date by the American University of Beirut⁵. With respect to the Domain Name Registry, the implementation of the Law will depend on whether and when it will be established and whether and when it will issue the aforementioned rules relating to the registration of domain names. Also worthy of note with respect to the specifics of electronic communications are the Law's provisions that govern behaviour in relation to internet technology. The Law's provisions on cyber-criminality thus take into account and punish relatively severely any threats to the integrity of the IT system and to e-commerce. Moreover, the Law addresses marketing practices that are specific to e-commerce such as aggressive spamming. It also endeavours to protect internet users by fostering more ethical and transparent online business practices, notably by establishing disclosure requirements.

With respect to the banking industry, the Law also brings about changes such as the acknowledgment of electronic money, which the Central Bank did not have authority to introduce. The rationale that underpins the Law appears to be, as a general matter, favourable to banking customers. For instance, save where they can provide certain evidence required under the Law, banks are deemed liable for any illegal or fraudulent electronic transfer or card payment where the customer notified them of the same as required under the Law. This is worth mentioning since individuals' rights are not otherwise fully protected under the Law when it comes to personal data, as discussed further below.

Personal data protection

In the past, only in certain industries (such as the health care industry) were individuals protected (and, even in this case, only to a certain extent) in relation to the collection, processing and use of their personal data. The Law now addresses any collection, processing or use of personal data whether via electronic means or otherwise.

In particular, the Law determines the conditions that need to be satisfied in order for the collection, processing, retention and use of personal data to be legal, which conditions mainly revolve around obtaining each concerned individual data subject's consent. Under the Law, a prior declaration to the Ministry of Economy and Trade is required in order to collect, process and use personal data, save where the Law requires a licence or where it provides that neither a declaration nor a licence is required. A relatively long list providing for the latter exceptions can be found in the Law.

With respect to the model provided by the European General Data Protection Regulation, the Law by comparison is not as detailed or comprehensive, primarily as it fails to provide for the establishment of an independent regulatory body in charge of monitoring personal data protection. This pitfall is the main reason why the Law has attracted criticism, since in practice this will create a limit to the protection afforded to individuals, notably on the internet.

Conclusion

To the extent that it fills the legal vacuum created by the legislator's failure to address the challenges introduced by internet technologies, the Law does provide both individuals and businesses with an increased level of legal security. Yet, in light of the former ECOMLEB draft law, the recently enacted Law affords individuals a lesser degree of protection when it comes to the collection, processing and use of their personal data. Finally, the Law still awaits the enactment of certain implementing decrees/regulations that will help to secure its proper understanding and implementation.

Elias would like to thank Dr. Georgette Salamé, a senior associate at Chedid Law Offices in association with Dentons, for her major contribution to this article.

1. See for instance Basic Circular No.69/2000 as amended.
2. Pierre Catala: "Avant-projet de loi sur la communication, l'écriture et les transactions électroniques", 2005, https://www.fondation-droitcontinental.org/fr/wp-content/uploads/2013/12/le_droit_du_commerce_electronique_-_pr_catala.pdf
3. The Code of Currency and Credit as well as the Central Bank's implementing regulations.
4. The Code of Obligations and Contracts, the Commercial Code as well as Law No.659/2005 (the Consumer Protection Law).
5. http://webstandards.omsar.gov.lb/English/Procedure-for-Registering-a-New-Domain-Name